X's new "encrypted" XChat feature doesn't seem to be any more secure

Post by cyanydeez » Wed, Jun 04, 2025, 12:32 PM UTC

ben_w wrote: post #38

Meekro wrote: post #29

Earlier quoted context omitted.

It sounds like an offhand comment that we shouldn’t read much into. Bitcoin’s creator demonstrated an impressive mastery of cryptography—- it was made to be extremely resilient (including to quantum computing) and no one has ever broken it despite billions of dollars being on the line. Maybe Musk meant to say that he thinks his product will be similarly resilient. He might also mean that the secp256k1 elliptic curve…

> You can read anything with the assumption that the writer is an absolute idiot, but I’d give the world’s richest man more credit than that. Before the pandemic, I would've said similar, even despite some of his errors of judgement. Since then, and the trend started earlier, it has become difficult to ignore that (1) he responds poorly to experts contradicting him, and (2) outside his actual domains of expertise (ro…

Post by tonyhart7 » Wed, Jun 04, 2025, 12:56 PM UTC

0xFEE1DEAD wrote: post #62

tonyhart7 wrote: post #46

Earlier quoted context omitted.

- I have public chat that user can chatting in public room (seems like I dont need for this one) - then notification service is probably something I want to E2EE then, but Idk about performance hit cost would be

A public chat - like one that anyone can join at any time without needing an invitation? If so, then you really don't need any extra encryption. If not, then it depends on who's using your chat, how they use it, and for what purpose. Are the users of the chat room a small group with occasional users joining or leaving, or are many users expected to join and leave at any given moment? That being said, encrypting the n…

Post by beej71 » Wed, Jun 04, 2025, 2:08 PM UTC

Post by [deleted] » Wed, Jun 04, 2025, 2:18 PM UTC

mjg59 wrote: post #15

The implementation seems to be libsodium sealed boxes, with the key material sequestered using the juicebox.xyz protocol. In itself this seems broadly fine, with the significant proviso as mentioned in https://help.x.com/en/using-x/encrypted-direct-messages that identity is not verified at present, and as a result it's trivially MITMable. But there's something more subtle here. Juicebox means that your key material i…

Post by Meekro » Wed, Jun 04, 2025, 2:32 PM UTC

fzeroracer wrote: post #64

Meekro wrote: post #29

Earlier quoted context omitted.

It sounds like an offhand comment that we shouldn’t read much into. Bitcoin’s creator demonstrated an impressive mastery of cryptography—- it was made to be extremely resilient (including to quantum computing) and no one has ever broken it despite billions of dollars being on the line. Maybe Musk meant to say that he thinks his product will be similarly resilient. He might also mean that the secp256k1 elliptic curve…

The world's richest man was caught cheating at video games via hiring people to play for him for the sake of cred. I don't think I would give him anything.