Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

X's new "encrypted" XChat feature doesn't seem to be any more secure

theregister.com

Post reply on HN
Print view View original

61–70 of 86 posts

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#61

Post by mort96 »

briandear wrote: post #27
mort96 wrote: post #6

Earlier quoted context omitted.

The first time I heard about this "XChat" was through a screenshot of Musk's tweet where he said it has "bitcoin style" encryption. Honestly, it was obvious just from reading that, that Musk has absolutely no idea what he's talking about when it comes to cryptography, and that nobody he has talked to on the development team has any clue either. That doesn't mean that we know for sure that the team doesn't have crypto…

You think Elon Musk doesn’t know what he’s talking about? Sorry, you might disagree with his politics, but the assertion that he doesn’t know what he’s talking about it absurd.

> You think Elon Musk doesn’t know what he’s talking about?

Correct

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#62

Post by 0xFEE1DEAD »

tonyhart7 wrote: post #46
8-prime wrote: post #42

Earlier quoted context omitted.

When the message you push out through that websocket are something that server knows about intrinsically, as in, the message contents are produced by the server there is nothing wrong with the approach. When your server facilitates a communication between two clients and just acts as the infrastructure E2EE can become relevant. If the clients want to be able to exchange information withouth the server being able to s…

- I have public chat that user can chatting in public room (seems like I dont need for this one) - then notification service is probably something I want to E2EE then, but Idk about performance hit cost would be

A public chat - like one that anyone can join at any time without needing an invitation?

If so, then you really don't need any extra encryption.

If not, then it depends on who's using your chat, how they use it, and for what purpose. Are the users of the chat room a small group with occasional users joining or leaving, or are many users expected to join and leave at any given moment?

That being said, encrypting the notifications won't bring any real benefits. A bad actor would simply focus on trying to compromise your server.

If you do decide that full e2ee would benefit your users, then look for someone who can help you implement it.

Implementing real e2ee for a 2 party chat is hard for someone without experience.

Implementing e2ee for a group chat is hard even for someone with experience.

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#63

Post by mort96 »

mjg59 wrote: post #58
hmry wrote: post #44

Earlier quoted context omitted.

Thank you for the breakdown. Since we're on the topic of having to trust X, is there any reason to believe X wouldn't insert some code into the client JS (behind some per-account flag) to exfiltrate your key or PIN, if they were ordered to do so? I wouldn't rely on a website as a secure communication client, that seems like a job for an open-source native application. But I'm no expert.

Oh, yeah, with no infrastructure to actually attest to the website (or the app) being trustworthy you're inherently placing trust in Twitter. Use Signal.

I think Signal is as secure as is reasonably possible, but it's worth noting that even with Signal, you can't actually verify that the app you've downloaded reflects the source code. The GitHub issue about reproducible builds is closed as not planned: https://github.com/signalapp/Signal-iOS/issues/641

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#64

Post by fzeroracer »

Meekro wrote: post #29
mort96 wrote: post #6

Earlier quoted context omitted.

The first time I heard about this "XChat" was through a screenshot of Musk's tweet where he said it has "bitcoin style" encryption. Honestly, it was obvious just from reading that, that Musk has absolutely no idea what he's talking about when it comes to cryptography, and that nobody he has talked to on the development team has any clue either. That doesn't mean that we know for sure that the team doesn't have crypto…

It sounds like an offhand comment that we shouldn’t read much into. Bitcoin’s creator demonstrated an impressive mastery of cryptography—- it was made to be extremely resilient (including to quantum computing) and no one has ever broken it despite billions of dollars being on the line. Maybe Musk meant to say that he thinks his product will be similarly resilient. He might also mean that the secp256k1 elliptic curve…

The world's richest man was caught cheating at video games via hiring people to play for him for the sake of cred. I don't think I would give him anything.

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#65

Post by mschoch »

briandear wrote: post #27
mort96 wrote: post #6

Earlier quoted context omitted.

The first time I heard about this "XChat" was through a screenshot of Musk's tweet where he said it has "bitcoin style" encryption. Honestly, it was obvious just from reading that, that Musk has absolutely no idea what he's talking about when it comes to cryptography, and that nobody he has talked to on the development team has any clue either. That doesn't mean that we know for sure that the team doesn't have crypto…

You think Elon Musk doesn’t know what he’s talking about? Sorry, you might disagree with his politics, but the assertion that he doesn’t know what he’s talking about it absurd.

[dead]

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#66

Post by hiimkeks »

tonyhart7 wrote: post #51
mort96 wrote: post #49

Earlier quoted context omitted.

If your threat model is such that it's perfectly fine for the server to know everything that's coming from and going to the client, there's no problem at all. That's probably your situation, it's okay that the server knows what notifications it's sending to your app. If your threat model is such that you'd rather not have the server know what's sent to and from the client, it's not enough to just encrypt the data in…

then what happen if E2EE receiver is server itself??? I want to prevent vector attack such MiTM if TLS is somehow hacked

Ah, the Zoom Gambit

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#67

Post by qalmakka »

briandear wrote: post #28
qalmakka wrote: post #18

Earlier quoted context omitted.

well, in Musk's defence he's been selling BS to people for the better part of the last three decades and people are still giving him money, so...

Those rockets, the ones that went into space, are those BS? Starlink works. Tesla’s were the most desirable electric car until politics came into it. And PayPal? Literally changed the internet.

The point is not that he doesn't deliver anything, or that he never achieved any sort of success - he did, he is incredibly successful. The point is that he constantly oversold what his goals were and made promises that couldn't be kept, often to get the funding he needed to reach his definitely less ambitious concrete goals.

Yeah he made the electric car popular, but it can be argued that in order to make his company economically viable he basically lied to his investors and customers about self driving cars for almost a decade, when he had nothing real in his hands. Thanks to those promises he got the money to keep the company afloat until it had the manufacturing capability to actually deliver the cars they sold; and someone may argue he would have failed if he had been honest from the beginning, and that maybe people wouldn't have invested the money they did if he hadn't set unachievable goals to begin with

And this is a pattern you can see in all of his companies; he promises the world Mars, gets a lot of funding and then instead of delivering on the "dream" target, he uses the money to deliver a valid but definitely less "romantic" product he can actually sell. One time is ok, but it's basically a modus operandi now. And this gives me a strong suspicion that the product was the real goal all along, and he knew he had to lie about the "dream" in order to get the capital at all

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#68

Post by v5v3 »

mort96 wrote: post #6
Meekro wrote: post #2

In a nutshell: we have unclear comments from Musk and unclear statements in the FAQ (which might not have been written by a technical person). Until they release a technical white paper, we don’t know anything for sure.

The first time I heard about this "XChat" was through a screenshot of Musk's tweet where he said it has "bitcoin style" encryption. Honestly, it was obvious just from reading that, that Musk has absolutely no idea what he's talking about when it comes to cryptography, and that nobody he has talked to on the development team has any clue either. That doesn't mean that we know for sure that the team doesn't have crypto…

Musk is a salesman.

Using crypto as a phrase makes it more interesting for journalists, gives them something to pad their articles with.

You say musk has no idea, but he has too talent working for him and they will explain stuff.

He will then think of the PR and Sales angle and adjust the product/press releases accordingly.

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#69

Post by mjg59 »

mort96 wrote: post #63
mjg59 wrote: post #58

Earlier quoted context omitted.

Oh, yeah, with no infrastructure to actually attest to the website (or the app) being trustworthy you're inherently placing trust in Twitter. Use Signal.

I think Signal is as secure as is reasonably possible, but it's worth noting that even with Signal, you can't actually verify that the app you've downloaded reflects the source code. The GitHub issue about reproducible builds is closed as not planned: https://github.com/signalapp/Signal-iOS/issues/641

The Android build is reproducible, iOS is (to the best of my knowledge) hard work for a number of reasons.

Re: X's new "encrypted" XChat feature doesn't seem to be any more secure

#70

Post by cyanydeez »

Meekro wrote: post #29
mort96 wrote: post #6

Earlier quoted context omitted.

The first time I heard about this "XChat" was through a screenshot of Musk's tweet where he said it has "bitcoin style" encryption. Honestly, it was obvious just from reading that, that Musk has absolutely no idea what he's talking about when it comes to cryptography, and that nobody he has talked to on the development team has any clue either. That doesn't mean that we know for sure that the team doesn't have crypto…

It sounds like an offhand comment that we shouldn’t read much into. Bitcoin’s creator demonstrated an impressive mastery of cryptography—- it was made to be extremely resilient (including to quantum computing) and no one has ever broken it despite billions of dollars being on the line. Maybe Musk meant to say that he thinks his product will be similarly resilient. He might also mean that the secp256k1 elliptic curve…

Uh, theres way more evidence musk is a moron than anything else.
Post reply on HN