X is now offering me end-to-end encrypted chat — you probably shouldn't trust it yet | TechCrunch
https://techcrunch.com/2025/09/05/x-is-now-offering-me-end-to-end-encrypted-chat-you-probably-shouldnt-trust-it-yet/
315 points · 98 comments · view on lemmy.world
98 Comments
SnoringEarthworm@sh.itjust.works · 130 pts · 321d
TL;dr of the article :
This secret stays between you, me, and Elon.
I hope politicians use the hell out of it, so we can see what they really think when it gets (inevitably) hacked in a few weeks.
Naich@lemmings.world · 24 pts · 321d
What is the "A" in "AITM"?
BananaOnionJuice@lemmy.dbzer0.com · 27 pts · 321d
This is the first time I heard of AITM, thought it was a new name for MITM:
https://www.blueshielditns.com/post/man-in-the-middle-vs-adversary-in-the-middle-understanding-the-differences-and-staying-safe
kuberoot@discuss.tchncs.de · 4 pts · 320d
Are you sure that site is trustworthy? It kinda reads like an LLM being told to explain the difference between two names for the same thing and basically rephrasing the same thing. I'd imagine it might just be a different name to get rid of a male-coded word.
kami@lemmy.dbzer0.com · 20 pts · 321d
Adversary
EncryptKeeper@lemmy.world · 14 pts · 321d
It’s just MITM but with extra steps
Someonelol@lemmy.dbzer0.com · 13 pts · 321d
Ah yes, Malcolm in the Middle is behind this all along.
lemmyman@lemmy.world · 9 pts · 321d
Anal
gressen@lemmy.zip · 7 pts · 321d
Anyone
Triumph@fedia.io · 7 pts · 321d
Aliens
floofloof@lemmy.ca · 5 pts · 321d
Elon.
trashboat@midwest.social · 3 pts · 321d
Apple
RVGamer06@sh.itjust.works · 3 pts · 320d
Asshole
ThePantser@sh.itjust.works · 2 pts · 321d
Administrator
pirat@lemmy.world · 2 pts · 320d
Agencies
renegadespork@lemmy.jelliefrontier.net · 22 pts · 321d
Then it's literally not even E2EE, lol
answersplease77@lemmy.world · 2 pts · 320d
is it different with signal, telegram, whatsapp?
CosmoNova@lemmy.world · 1 pts · 320d
If you chat on Xitter you‘re chatting with mecha Hitler.
Goodlucksil@lemmy.dbzer0.com · 0 pts · 321d
They are stupid, but not that stupid.
hansolo@lemmy.today · 14 pts · 321d
Never attribute to malice what can be attributed to incompetence.
tabular@lemmy.world · 12 pts · 321d
I used to give the benefit of the doubt but when there are bad incentives in play and shit keeps happening.. then perhaps that is naïve sometimes, unfortunately.
hansolo@lemmy.today · 4 pts · 321d
Do you mean bad incentives?
And sure, I don't disagree, but these people are also not actually that smart. I would worry more about this getting hacked in a week way before Elon gets a chance to use it against anyone.
tabular@lemmy.world · 3 pts · 321d
Thanks, I do.
artyom@piefed.social · 104 pts · 321d
So...they're just blatantly lying?
ReallyActuallyFrankenstein@lemmynsfw.com · 43 pts · 321d
Right, they have the key, and the lock, but the key isn't in the lock, so it's utterly impossible for them to access it.
FauxLiving@lemmy.world · 14 pts · 321d
Typical corpo doublespeak
InnerScientist@lemmy.world · 16 pts · 321d
It's encrypted with a 4 digit pin so they'll have to spend at least 316.8809e-10 years on brute-forcing it.
lando55@lemmy.zip · 9 pts · 320d
That's why my PIN is 5 digits: 12345
adarza@lemmy.ca · 10 pts · 320d
One. Two. Three. Four. Five?
That's amazing. I've got the same combination on my luggage.
scala@lemmy.ml · 2 pts · 320d
Suck. Suck. Suck. Suck!
FreedomAdvocate@lemmy.net.au · 4 pts · 321d
No - did you even read the article? An x employee confirmed that they’re using the “special” servers to store the keys that mean that they cannot see them. The author then says that the employee confirming it doesn’t mean they do, because the author doesn’t want it to be true.
Natanael@infosec.pub · 1 pts · 320d
There are hardware for that called hardware security modules, but yeah I definitely wouldn't trust Twitter's implementation - especially because they probably just need the auth team to tell the HSM that the user logged in when they didn't to get that key
A proper implementation would use multiple security measures and require a reset (delete) of certain private account data before the account access can be reset, otherwise the user's password would be needed (for key derivation) or some other secret held by the user's devices (in the TPM chip or equivalent)
FreedomAdvocate@lemmy.net.au · -3 pts · 320d
So again, you think you know better than the employee simply because you want it to be done incorrectly.
Natanael@infosec.pub · 1 pts · 320d
I've run a cryptography forum for 10 years. I can tell snake oil from the real deal.
Musk's Twitter doesn't know how to do key distribution. The only major company using HSMs the way Musk intends to is Apple, and they have far more and much more experienced cryptographers than X does.
FreedomAdvocate@lemmy.net.au · -1 pts · 320d
So again - you just don’t want it to be true, and you think the people that know more than you about it are lying.
Natanael@infosec.pub · 0 pts · 319d
You sound like an antivaxxer defending a crank
FreedomAdvocate@lemmy.net.au · 0 pts · 318d
You sound like a conspiracy theorist defending wearing an aluminium foil hat.
SaharaMaleikuhm@feddit.org · 0 pts · 321d
The Muskrat lying? No, never!
popekingjoe@lemmy.world · 44 pts · 321d
...yet? How bout just not trusting it at all?
Manjushri@piefed.social · 10 pts · 321d
Hah, beat me by 17 seconds!
sentient_loom@sh.itjust.works · 30 pts · 321d
That "yet" is the narrative hook to trick us into feeling like it will soon be trustworthy, and that our assumed suspicions refer to a temporary state of untrustworthiness. Clever girls!
paraphrand@lemmy.world · 7 pts · 321d
Feels like Bluesky’s federation promise.
sentient_loom@sh.itjust.works · 1 pts · 321d
I think you can install your own bluseky instance and federated with others.
paraphrand@lemmy.world · 2 pts · 321d
I don’t consider the PDS stuff to be fully federated. That’s just keeping your data on a different server, as far as I understand it. To be federated it needs to be a full interoperable server like mastodon, or lemmy.
You should also be able to host a non federated instance, or one with limited federation.
If they have moved past that, and I can open a server and have people sign up for accounts, then I stand corrected.
Natanael@infosec.pub · 1 pts · 320d
Bluesky federates across different layers, it's modular, it doesn't have a comparable same-layer federation. It is fully interoperable, just not by the method you're used to.
You can host your own partial appview now (caching and indexing your and your friends' comment), and multiple people have managed to run their own relays for cheap (caching most of the posts in the network), and you can pull the rest of data you need to browse from the other relays and use the service as usual. You can run your own moderation labeler, use your own app, just your own account, etc...
Just look at the interoperable blacksky project by a bunch of black devs making their own infrastructure for accounts and moderation, etc.
To be non federated, all you have to do is not announce your server and not accept arbitrary connections
Due to content addressing, limited federation isn't really a thing by the usual definition. You can filter content from any PDS you don't like, but can't really control who can see already public posts
Reverendender@sh.itjust.works · 2 pts · 321d
Correct, foolish human! Now sign up.
renegadespork@lemmy.jelliefrontier.net · 23 pts · 321d
How about: "You probably should trust or use X at all... ever."
DarkFuture@lemmy.world · 20 pts · 320d
Hey y'all. Reminder not to trust a platform owned and operated by a Nazi manchild.
Netrunner@programming.dev · 18 pts · 320d
Brain damaged people trust x again.
BD89@lemmy.sdf.org · 18 pts · 320d
Shouldn't trust it yet.
Or ever.
adespoton@lemmy.ca · 18 pts · 321d
YET?
Manjushri@piefed.social · 18 pts · 321d
Yet? What kind of idiot would imagine that X would or could provide actual secure communication?
Zeon@lemmy.world · 15 pts · 321d
It's proprietary, how could you possibly trust it?
lando55@lemmy.zip · 1 pts · 320d
Do you think this is the face of a liar
Etzello@midwest.social · 1 pts · 320d
The face of this liar makes my face go on fire
Typhoon@lemmy.ca · 13 pts · 320d
With a white circle and a swastika inside?
6nk06@sh.itjust.works · 11 pts · 321d
Our good friend Elon cannot be trusted? I don't believe you, this must be propaganda to discredit his good manners.
ReallyActuallyFrankenstein@lemmynsfw.com · 2 pts · 321d
Accusing gentle Elon of a misdeed?
TwinTitans@lemmy.world · 11 pts · 320d
Why are people evening using this site anymore? It’s been severely compromised.
lechekaflan@lemmy.world · 2 pts · 320d
What some call "normies" besides most celebrities.
Mwa@thelemmy.club · 1 pts · 320d
most likely vendor lockin and i hate it its common on social media.
TuxEnthusiast@sopuli.xyz · -4 pts · 320d
Cause it has an audience unlike mastodon or bluesky. All the other alternatives are dead.
balance8873@lemmy.myserv.one · 2 pts · 320d
Your hero just joined bluesky so not that dead
Mwa@thelemmy.club · 1 pts · 320d
but bluesky(i think similar to twitter but slightly lower users??) has a bigger audience then mastodon, most people i saw there still use twitter.
mazzilius_marsti@lemmy.world · 11 pts · 320d
"xchat" sounds like one of those porn chat rooms
notgivingmynametoamachine@lemmy.world · 10 pts · 320d
If you trust ANYTHING Musk has for you well then have I got a bridge to sell you.
HubertManne@piefed.social · 9 pts · 320d
probably??? try definitely and ever
hansolo@lemmy.today · 9 pts · 321d
Quick everyone, install this just so that if Pete Hegseth invites people to the next airstrikes chat group, your satirical JD Vance account will be next to the real JD Vance's account and he'll probably add you both and figure it out later.
CitizenKong@lemmy.world · 8 pts · 320d
I don't trust anything coming out of Elon's fascisthole. Deleted the app when he bought it and never looked back.
DarkFuture@lemmy.world · 3 pts · 320d
I refuse to even click on links. If a friend sends me an X link to something funny/interesting I tell them "I don't click on Nazi links" and ask them to find me another source.
Pondis@lemmy.world · 8 pts · 321d
I wouldnt trust X with a picture of my shoes
givesomefucks@lemmy.world · 8 pts · 321d
Never trust any social media sites "private" chat.
Especially not one of the big ones run by weirdo fascists. You know Elmo is going to snoop on anyone relatively famous, or that just say something he doesn't like.
In all honesty, there's zero reason to even have accounts on them
pivot_root@lemmy.world · 5 pts · 321d
Even if the server had zero knowledge of your private keys (which is doubtful), I'm sure the client code won't have any backdoors. It's only the social media "platform" owned by the world's most thin-skinned billionaire.
Bebopalouie@lemmy.ca · 8 pts · 320d
Yet? More like never.
TomMasz@piefed.social · 7 pts · 321d
Or ever.
edgarzen@sh.itjust.works · 7 pts · 320d
Signal and encrypted email only.
DarkFuture@lemmy.world · 3 pts · 320d
Friends and I swapped our group chat to Signal the day Trump was inaugurated...the first time.
If things keep going the way they are, no one should be communicating on anything but encrypted messaging apps.
HootinNHollerin@lemmy.dbzer0.com · 7 pts · 321d
Or ever
br0da@lemmy.world · 6 pts · 321d
It’s like a regular encrypted chat but with peepholes and racism.
abbiistabbii@lemmy.blahaj.zone · 6 pts · 320d
All of this has the same vibes as the time Brigham Young University amended their code of conduct to allow people to come out as queer, let some students come out, and then changed the CoC back and expelled the students.
thatradomguy@lemmy.world · 5 pts · 320d
shouldn't trust it yetshouldn't trust it everZedstrian@lemmy.dbzer0.com · 4 pts · 321d
Don't trust it at all.
obsidianfoxxy7870@lemmy.blahaj.zone · 3 pts · 321d
I do really like E2EE but why do I need it in everything?
If I want to talk to someone I would rather them message me on Signal or something that I trust more.
renegadespork@lemmy.jelliefrontier.net · 4 pts · 321d
Yeah, way too many services have chats. I think it's because every large platform wants to be an "everything app". Messaging is a really easy to feature to implement to (theoretically) add value.
Telorand@reddthat.com · 3 pts · 321d
Cool, and I bet it will be just as trustworthy as WhatsApp (i.e. not at all).
DFX4509B_2@lemmy.org · 2 pts · 319d
Probably shouldn't? How 'bout definitely shouldn't, ditto for Twitter in general. Give ATproto shit all you want but at least you can move to an independent PDS with it.
Granted ActivityPub is still ideal over ATproto, but both are better than a centralized black box.
lechekaflan@lemmy.world · 2 pts · 320d
LOL nope. I'd use anything else. As in NO X.
It was eyerolling back when that dickhead decided to sell blue checkmarks instead of issuing them only to verified celebrities.
SabinStargem@lemmy.today · 1 pts · 320d
Ah, new ways for Kegsbreath to expose his idiocy.
AwesomeLowlander@sh.itjust.works · 1 pts · 320d
Mohamad20ZX@sopuli.xyz · 1 pts · 318d
Hozerkiller@lemmy.ca · -3 pts · 320d
I trust it but there is a major misunderstanding of end to end encryption. Some implementations the platform holder does not have a key to decrypt data but it is far from a requirement. All end to end means is there's a blocker preventing the network from seeing what you send not twitter who im assuming has a copy of the key.
notarobot@lemmy.zip · 6 pts · 320d
That is NOT end to end encryption. That is transport layer encryption. So basically SSL
End to end is from sender to recipient. No one in the middle should be able to read anything
Hozerkiller@lemmy.ca · -3 pts · 320d
It's like ssl but done at the application layer. Nobody in the middle can read it except it's nobody in the middle of you and twitter and twitter and the recipient. If you put something on a platform and they have the key they will always be able to read it if they want to.
notarobot@lemmy.zip · 2 pts · 320d
are you being dense on purpose? sender and recipient are both users. never twitter.
i'm not saying that twitter's messaging is secure. the opposite. what i'm saying is that you statement of "All end to end means is there’s a blocker preventing the network from seeing what you send not twitter" is 100% objectively wrong.