CrypTweet: Strong Encryption for Twitter DMs

It's been a while in the making, but this is well worth some attention.

I've been lucky enough to be an early tester on CrypTweet - http://plexusproject.org/ - a public-key based method for encryption of Twitter DMs.

A base version is now available on the site linked above. It works nicely out of the box, but is kind of raw - minimal functional set, and all that.

For anyone interested in this kind of thing, for any number of reasons, may I (mis)quote that great Australian music commentator, Ian "Molly" Meldrum, and suggest you do yourself a favor by checking CrypTweet out.

trib -- @trib about.me/trib

Are you serious? If you need secure messaging, surely you have other options than twitter?

Just copy and paste a PGP encrypted message to pastebin.ca and and tweet the link, if you must.

I think you are discounting the level of thought and care that went into this. Meh, fail.

I just gave it a quick scan and found some issues: 1. PKCS1 verification looks vulnerable to a timing attack. 2. They're using plain RSA to encrypt message data without any padding like OAEP. This is not semantically secure. 3. They are not generating strong primes for RSA keys.

Please describe a realistic scenario in which all of the following are true:

1) You are in imminent danger of being "shot in the face" or similarly harmed;

2) Your best means of salvation from (1) is communication via Twitter DM;

3) The absence of a means in which your message could be encrypted on the client side beyond the HTTPS connection to Twitter's servers would significantly increase the chance of (1).

This is a serious question.