Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

X's new "encrypted" XChat feature doesn't seem to be any more secure

theregister.com

Post reply on HN
Print view View original

51–60 of 86 posts

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#51

Post by tonyhart7 »

mort96 wrote: post #49
tonyhart7 wrote: post #24

Earlier quoted context omitted.

hey, I literally doing this right now, what's wrong with that?? I mean its just for notification to my app so its not something critical

If your threat model is such that it's perfectly fine for the server to know everything that's coming from and going to the client, there's no problem at all. That's probably your situation, it's okay that the server knows what notifications it's sending to your app. If your threat model is such that you'd rather not have the server know what's sent to and from the client, it's not enough to just encrypt the data in…

then what happen if E2EE receiver is server itself???

I want to prevent vector attack such MiTM if TLS is somehow hacked

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#52

Post by amitrip »

briandear wrote: post #27
mort96 wrote: post #6

Earlier quoted context omitted.

The first time I heard about this "XChat" was through a screenshot of Musk's tweet where he said it has "bitcoin style" encryption. Honestly, it was obvious just from reading that, that Musk has absolutely no idea what he's talking about when it comes to cryptography, and that nobody he has talked to on the development team has any clue either. That doesn't mean that we know for sure that the team doesn't have crypto…

You think Elon Musk doesn’t know what he’s talking about? Sorry, you might disagree with his politics, but the assertion that he doesn’t know what he’s talking about it absurd.

[dead]

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#53

Post by protocolture »

briandear wrote: post #28
qalmakka wrote: post #18

Earlier quoted context omitted.

well, in Musk's defence he's been selling BS to people for the better part of the last three decades and people are still giving him money, so...

Those rockets, the ones that went into space, are those BS? Starlink works. Tesla’s were the most desirable electric car until politics came into it. And PayPal? Literally changed the internet.

Yeah see you fall into the usual trap.

Elon sells a 2-3 phase project, and then delivers phase 1. Thats the entire man.

Tesla: Was meant to revolutionise car making and green the planet. He delivered a pretty ok set of electric cars and got completely outflanked by traditional car makers. He also used it to rescue his brothers failing business.

Starlink: Its billed as an uninterruptible censorship ignoring super internet in space where government cant get it. But what he delivered is just landline fiber extended by 1 - 2 satellite hops. Its great for rural areas but the business complies with all legal censorship requirements where it operates. My back of the napkin math tells me its ultimate goals are completely unachievable, and MEO internet providers IMHO are catching up.

SpaceX: SpaceX is really good, they have brought in everyone from JPL and other places and absolutely nailed low cost orbital payload. In fact I read speculation they will take boeings contracts for Artemis prep. However what he sold is the relocation of humanity to mars which is no closer to being achieved, and as far as I can tell, he has literally no one but concept artists working on.

Hyperloop etc: Basically kickstarted the boring company which IIRC is one of his better long term prospects. He wont be creating super fast mass transit systems but he can shave months off of boring projects.

Xitter: Billed as an uncensored town square, the place has just engaged in the other teams censorship and is generally a cess pit.

Neuralink: Apparently almost as good as stuff displayed on Beyond 2000 25+ years ago.

tl;dr guy is a salesman. The fact that he can sell you a dream and then pretend like he delivered it without delivering it is a testament to his business strengths. But dont drink the koolaid.

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#54

Post by mort96 »

tonyhart7 wrote: post #51
mort96 wrote: post #49

Earlier quoted context omitted.

If your threat model is such that it's perfectly fine for the server to know everything that's coming from and going to the client, there's no problem at all. That's probably your situation, it's okay that the server knows what notifications it's sending to your app. If your threat model is such that you'd rather not have the server know what's sent to and from the client, it's not enough to just encrypt the data in…

then what happen if E2EE receiver is server itself??? I want to prevent vector attack such MiTM if TLS is somehow hacked

In a typical server-backed web app architecture, TLS is the protection against MITM. You're gonna have a really really hard time making something which protects against MITM better than TLS.

There are things you can do to make it more difficult to hack your TLS connection though, for example you could use key pinning to make sure that your app will only accept a server with the certificate you expect. This would protect against an IT admin installing root certs on their users' devices, or against certificate authorities issuing fake certificates for your domain.

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#55

Post by lawn »

briandear wrote: post #27
mort96 wrote: post #6

Earlier quoted context omitted.

The first time I heard about this "XChat" was through a screenshot of Musk's tweet where he said it has "bitcoin style" encryption. Honestly, it was obvious just from reading that, that Musk has absolutely no idea what he's talking about when it comes to cryptography, and that nobody he has talked to on the development team has any clue either. That doesn't mean that we know for sure that the team doesn't have crypto…

You think Elon Musk doesn’t know what he’s talking about? Sorry, you might disagree with his politics, but the assertion that he doesn’t know what he’s talking about it absurd.

He's made many comments that betray the fact that he's absolutely clueless in many areas, even those he should be knowledgeable in.

This is just the latest example.

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#56

Post by tonyhart7 »

mort96 wrote: post #54
tonyhart7 wrote: post #51

Earlier quoted context omitted.

then what happen if E2EE receiver is server itself??? I want to prevent vector attack such MiTM if TLS is somehow hacked

In a typical server-backed web app architecture, TLS is the protection against MITM. You're gonna have a really really hard time making something which protects against MITM better than TLS. There are things you can do to make it more difficult to hack your TLS connection though, for example you could use key pinning to make sure that your app will only accept a server with the certificate you expect. This would prot…

Yeah this app maybe don't need that

but for things like IoT running websocket connection for long time maybe I need that

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#57

Post by [deleted] »

mort96 wrote: post #8
threeseed wrote: post #5

> Currently, we do not offer protections against man-in-the-middle attacks. As a result, if someone—a malicious insider or X itself as a result of a compulsory legal process—were to compromise an encrypted conversation I assume this means that the "encryption" is about as strong as base64.

I bet they're using WebSocket over HTTPS and calling that "encrypted chat" because it technically is.

[deleted]

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#58

Post by mjg59 »

hmry wrote: post #44
mjg59 wrote: post #15

The implementation seems to be libsodium sealed boxes, with the key material sequestered using the juicebox.xyz protocol. In itself this seems broadly fine, with the significant proviso as mentioned in https://help.x.com/en/using-x/encrypted-direct-messages that identity is not verified at present, and as a result it's trivially MITMable. But there's something more subtle here. Juicebox means that your key material i…

Thank you for the breakdown. Since we're on the topic of having to trust X, is there any reason to believe X wouldn't insert some code into the client JS (behind some per-account flag) to exfiltrate your key or PIN, if they were ordered to do so? I wouldn't rely on a website as a secure communication client, that seems like a job for an open-source native application. But I'm no expert.

Oh, yeah, with no infrastructure to actually attest to the website (or the app) being trustworthy you're inherently placing trust in Twitter. Use Signal.

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#59

Post by bilekas »

mrweasel wrote: post #41
bilekas wrote: post #39

Earlier quoted context omitted.

> Oh, wait, is Elon porting the venerable xchat to Rust? :) If this hasn't been done already, I have a new weekend project!

Honestly we're a little short on good IRC clients, so it's not that stupid.

I have resorted to rolling my own version of irccloud. It became embarrassing how much I spent over the years for such a simple service. Also learning then irc protocol in its bizarre entirety was pretty fun.

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#60

Post by timschmidt »

ben_w wrote: post #38
Meekro wrote: post #29

Earlier quoted context omitted.

It sounds like an offhand comment that we shouldn’t read much into. Bitcoin’s creator demonstrated an impressive mastery of cryptography—- it was made to be extremely resilient (including to quantum computing) and no one has ever broken it despite billions of dollars being on the line. Maybe Musk meant to say that he thinks his product will be similarly resilient. He might also mean that the secp256k1 elliptic curve…

> You can read anything with the assumption that the writer is an absolute idiot, but I’d give the world’s richest man more credit than that. Before the pandemic, I would've said similar, even despite some of his errors of judgement. Since then, and the trend started earlier, it has become difficult to ignore that (1) he responds poorly to experts contradicting him, and (2) outside his actual domains of expertise (ro…

> he's just as much of a noob as everyone other opinionated loudmouth on the internet.

That would be a step ahead of most of the ultra wealthy, in my humble experience. Family money seems to do nothing positive for critical thinking skills or practical experience.

Post reply on HN