Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

X's new "encrypted" XChat feature doesn't seem to be any more secure

theregister.com

Post reply on HN
Print view View original

31–40 of 86 posts

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#31

Post by michaelteter »

Meekro wrote: post #23
0xEF wrote: post #4

Earlier quoted context omitted.

Sure we know that we should not trust anything Musk or X claims? By now? I mean, come on.

Some things Musk claimed have happened, others have not. For example, he promised that they would release a satellite Internet platform that was better than most of the others, and they did. On the other hand, he promised that Grok 3 would be massively better than ChatGPT, and it turned out to be comparable at best.

When you make a lot of bold claims, and you have your (or a lot of someone else's) money to help you back up the claims with (clumsy) actions, sometimes your bold claims turn out to be truthy.

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#34

Post by _elephant »

mjg59 wrote: post #15

The implementation seems to be libsodium sealed boxes, with the key material sequestered using the juicebox.xyz protocol. In itself this seems broadly fine, with the significant proviso as mentioned in https://help.x.com/en/using-x/encrypted-direct-messages that identity is not verified at present, and as a result it's trivially MITMable. But there's something more subtle here. Juicebox means that your key material i…

This is a very thorough technical analysis—thanks for sharing! It seems like even though Juicebox itself uses libSodium sealed boxes and HSMs, the security is ultimately constrained by the 32 rounds of argon2id for the PIN derivation and Twitter’s ability to access the encrypted key material. Perhaps its biggest selling point is deployment flexibility rather than being a true end-to-end encrypted platform.

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#35

Post by xorcist »

lionkor wrote: post #19

It seems to me like this is what happens when you do impulsive, hype-driven development. I assume a junior walked into Elon's office, and pitched it with the words "Bitcoin style encryption, as a chat platform--Written in Rust, almost entirely developed my Grok3", and he was sold. I'm not being cynical or funny, I legitimately think, after having worked with some hype-driven leadership people, that this is quite comm…

In my experience, it's never "a junior". There are people who build their entire careers on doing things like this. The rest of the story is completely believable, despite put in an unnecessarily sarcastic tone.

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#37

Post by bilekas »

Vinz_ wrote: post #7
herewulf wrote: post #3

As a user of XChat[0] since 1999, I can tell you that it's definitely not encrypted or secure. Don't believe the hype! [0]: http://xchat.org

> Dubbed "XChat" (not to be confused with the venerable Linux/Windows IRC app of the same name) It’s not the same XChat

I think you missed the joke. As a fellow XChat user I can assure you, Elon is wrong.

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#38

Post by ben_w »

Meekro wrote: post #29
mort96 wrote: post #6

Earlier quoted context omitted.

The first time I heard about this "XChat" was through a screenshot of Musk's tweet where he said it has "bitcoin style" encryption. Honestly, it was obvious just from reading that, that Musk has absolutely no idea what he's talking about when it comes to cryptography, and that nobody he has talked to on the development team has any clue either. That doesn't mean that we know for sure that the team doesn't have crypto…

It sounds like an offhand comment that we shouldn’t read much into. Bitcoin’s creator demonstrated an impressive mastery of cryptography—- it was made to be extremely resilient (including to quantum computing) and no one has ever broken it despite billions of dollars being on the line. Maybe Musk meant to say that he thinks his product will be similarly resilient. He might also mean that the secp256k1 elliptic curve…

> You can read anything with the assumption that the writer is an absolute idiot, but I’d give the world’s richest man more credit than that.

Before the pandemic, I would've said similar, even despite some of his errors of judgement.

Since then, and the trend started earlier, it has become difficult to ignore that (1) he responds poorly to experts contradicting him, and (2) outside his actual domains of expertise (rockets and sales/motivational pitches*) he's just as much of a noob as everyone other opinionated loudmouth on the internet.

* the latter of which is, IMO, one of the two big reasons Tesla share price is 10x to 30x what it should be, and that in turn is why he's the richest man on the planet.

The other is that surviving the stock shorters probably burned people off shorting that stock, so the market is mostly now mostly just the exhuberent optimists unbalanced by doubters.

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#39

Post by bilekas »

Yoric wrote: post #14
herewulf wrote: post #3

As a user of XChat[0] since 1999, I can tell you that it's definitely not encrypted or secure. Don't believe the hype! [0]: http://xchat.org

Oh, wait, is Elon porting the venerable xchat to Rust? :)

> Oh, wait, is Elon porting the venerable xchat to Rust? :)

If this hasn't been done already, I have a new weekend project!

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#40

Post by mrweasel »

herewulf wrote: post #3

As a user of XChat[0] since 1999, I can tell you that it's definitely not encrypted or secure. Don't believe the hype! [0]: http://xchat.org

Somehow I feel like they should just go all in at call it BitchX[1], that also have the same Bitcoin style of encryption, none.

1) https://en.wikipedia.org/wiki/BitchX

Post reply on HN