41–50 of 86 posts
Earlier quoted context omitted.
Oh, wait, is Elon porting the venerable xchat to Rust? :)
> Oh, wait, is Elon porting the venerable xchat to Rust? :) If this hasn't been done already, I have a new weekend project!
Earlier quoted context omitted.
I bet they're using WebSocket over HTTPS and calling that "encrypted chat" because it technically is.
hey, I literally doing this right now, what's wrong with that?? I mean its just for notification to my app so its not something critical
When your server facilitates a communication between two clients and just acts as the infrastructure E2EE can become relevant. If the clients want to be able to exchange information withouth the server being able to snoop in on what is being sent, then you'd want to use E2EE. With that the server won't be able to read what is being sent.
Earlier quoted context omitted.
well, in Musk's defence he's been selling BS to people for the better part of the last three decades and people are still giving him money, so...
Those rockets, the ones that went into space, are those BS? Starlink works. Tesla’s were the most desirable electric car until politics came into it. And PayPal? Literally changed the internet.
I do wish that the Paypal statement would be a bit more nuanced though. Yes, Musk made a lot of money on the dot-com hype by way of Paypal. And he seems to have built strong friendships from that, weirdly with the same people that fired him. But his involvement in Paypal was that he let it buy the startup he was in and demanded to be CEO. He then only showed interest in throwing out the FreeBSD it was built on and replace it with NT (which was the hottest fad at the time) and to rename the company to "X". Neither happened, and he was quickly let go before the company risked bankruptcy. It's rather far fetched to go from that to "changing the Internet". Paypal won and X didn't.
The implementation seems to be libsodium sealed boxes, with the key material sequestered using the juicebox.xyz protocol. In itself this seems broadly fine, with the significant proviso as mentioned in https://help.x.com/en/using-x/encrypted-direct-messages that identity is not verified at present, and as a result it's trivially MITMable. But there's something more subtle here. Juicebox means that your key material i…
Since we're on the topic of having to trust X, is there any reason to believe X wouldn't insert some code into the client JS (behind some per-account flag) to exfiltrate your key or PIN, if they were ordered to do so?
I wouldn't rely on a website as a secure communication client, that seems like a job for an open-source native application. But I'm no expert.
Earlier quoted context omitted.
The first time I heard about this "XChat" was through a screenshot of Musk's tweet where he said it has "bitcoin style" encryption. Honestly, it was obvious just from reading that, that Musk has absolutely no idea what he's talking about when it comes to cryptography, and that nobody he has talked to on the development team has any clue either. That doesn't mean that we know for sure that the team doesn't have crypto…
You think Elon Musk doesn’t know what he’s talking about? Sorry, you might disagree with his politics, but the assertion that he doesn’t know what he’s talking about it absurd.
He then invested in OpenAI, is still trying to make FSD a thing, wants humans and AI to merge via Neuralink, made humanoid robots, and made grok because he parted ways with OpenAI.
If he knows what he's talking about in general, this combination makes him a demonolater.
Given how often (and for how long) he keeps saying FSD is just around the corner — and how poorly recieved have been TBC's tunnels, Neuralink's research, grok, Twitter's changes under Musk, Optimus, Cybertruck, his comments when sharing a video of him attempting to play high-leveled characters in some video games — I have every reason to think he doesn't know much outside of rockets and sales/motivational speeches.
I don't even need to reference the salutes, supporting AfD, DOGE etc. as examples here.
Earlier quoted context omitted.
hey, I literally doing this right now, what's wrong with that?? I mean its just for notification to my app so its not something critical
When the message you push out through that websocket are something that server knows about intrinsically, as in, the message contents are produced by the server there is nothing wrong with the approach. When your server facilitates a communication between two clients and just acts as the infrastructure E2EE can become relevant. If the clients want to be able to exchange information withouth the server being able to s…
- then notification service is probably something I want to E2EE then, but Idk about performance hit cost would be
Earlier quoted context omitted.
The first time I heard about this "XChat" was through a screenshot of Musk's tweet where he said it has "bitcoin style" encryption. Honestly, it was obvious just from reading that, that Musk has absolutely no idea what he's talking about when it comes to cryptography, and that nobody he has talked to on the development team has any clue either. That doesn't mean that we know for sure that the team doesn't have crypto…
You think Elon Musk doesn’t know what he’s talking about? Sorry, you might disagree with his politics, but the assertion that he doesn’t know what he’s talking about it absurd.
Doing so, is a business tactic. We know he is full of shit, but it gives him some kind of status in front of other business people.
As a user of XChat[0] since 1999, I can tell you that it's definitely not encrypted or secure. Don't believe the hype! [0]: http://xchat.org
Earlier quoted context omitted.
I bet they're using WebSocket over HTTPS and calling that "encrypted chat" because it technically is.
hey, I literally doing this right now, what's wrong with that?? I mean its just for notification to my app so its not something critical
If your threat model is such that you'd rather not have the server know what's sent to and from the client, it's not enough to just encrypt the data in flight, which is what HTTPS does. With encrypted chat, we typically want what we refer to as end-to-end encryption, where the server can't see the content of messages sent between users.
Earlier quoted context omitted.
Sure we do - the client code is already out there.
Has anyone posted an analysis of its security?