▲ 66 points
back
79 comments
The implementation seems to be libsodium sealed boxes, with the key material sequestered using the juicebox.xyz protocol. In itself this seems broadly fine, with the significant proviso as mentioned in https://help.x.com/en/using-x/encrypted-direct-messages that identity is not verified at present, and as a result it's trivially MITMable.
But there's something more subtle here. Juicebox means that your key material is remotely stored in encrypted form. In an ideal setup, it's split between multiple different realms operated by different people, and the key material is stored in HSMs. There's a complicated dance where you prove knowledge of the PIN without actually revealing the PIN, and then the remote realms hand over the key material and you reassemble it into your key by decrypting it with a key also derived from your PIN.
If Twitter is running their own Juicebox realms then you're having to trust them. Even if the realms are implemented as HSMs, they're in a position to see the encrypted key material as it exits the HSM. And if they're not in HSMs, then the encrypted key material is just sitting there where they can see it. This doesn't intrinsically give them the key, since it still needs the PIN to decrypt it - but the key derivation function from the PIN is just 32 rounds of argon2id with 16MB of memory use, and given the PIN is limited to 4 digits, that's going to take about a second of GPU aided brute forcing to drop out the actual key.
As noted in the help doc, this isn't forward secure, so the moment they have the key they can decrypt everything. This is so far from being a meaningful e2ee platform it's ridiculous.
This is a very thorough technical analysis—thanks for sharing! It seems like even though Juicebox itself uses libSodium sealed boxes and HSMs, the security is ultimately constrained by the 32 rounds of argon2id for the PIN derivation and Twitter’s ability to access the encrypted key material. Perhaps its biggest selling point is deployment flexibility rather than being a true end-to-end encrypted platform.
Thank you for the breakdown.
Since we're on the topic of having to trust X, is there any reason to believe X wouldn't insert some code into the client JS (behind some per-account flag) to exfiltrate your key or PIN, if they were ordered to do so?
I wouldn't rely on a website as a secure communication client, that seems like a job for an open-source native application. But I'm no expert.
Oh, yeah, with no infrastructure to actually attest to the website (or the app) being trustworthy you're inherently placing trust in Twitter. Use Signal.
I think Signal is as secure as is reasonably possible, but it's worth noting that even with Signal, you can't actually verify that the app you've downloaded reflects the source code. The GitHub issue about reproducible builds is closed as not planned: https://github.com/signalapp/Signal-iOS/issues/641
As a user of XChat[0] since 1999, I can tell you that it's definitely not encrypted or secure. Don't believe the hype!
[0]: http://xchat.org
Somehow I feel like they should just go all in at call it BitchX[1], that also have the same Bitcoin style of encryption, none.
I really hope you're not still using it. It was last updated in 2010. Even the website hasn't been updated to use HTTPS.
Oh, wait, is Elon porting the venerable xchat to Rust? :)
> Oh, wait, is Elon porting the venerable xchat to Rust? :)
If this hasn't been done already, I have a new weekend project!
For those of you who don't know, the project was archived in 2024 but there was at least one modern fork of XChat in the form of HexChat: https://hexchat.github.io/
Honestly we're a little short on good IRC clients, so it's not that stupid.
> Dubbed "XChat" (not to be confused with the venerable Linux/Windows IRC app of the same name)
It’s not the same XChat
@grok is this true?
Is there grok on hackernews?
Looking into this
Concerning
I think you missed the joke. As a fellow XChat user I can assure you, Elon is wrong.
I apparently did, although I still struggle to understand what the joke is, to be honest.
Thank you for at least explaining that I missed a joke, it’s a lot more helpful than downvotes. (I’m not complaining, I don’t really care about internet points, I was just confused about what I did wrong) :)
In a nutshell: we have unclear comments from Musk and unclear statements in the FAQ (which might not have been written by a technical person). Until they release a technical white paper, we don’t know anything for sure.
Sure we do - the client code is already out there.
Has anyone posted an analysis of its security?
The first time I heard about this "XChat" was through a screenshot of Musk's tweet where he said it has "bitcoin style" encryption. Honestly, it was obvious just from reading that, that Musk has absolutely no idea what he's talking about when it comes to cryptography, and that nobody he has talked to on the development team has any clue either.
That doesn't mean that we know for sure that the team doesn't have cryptography experts, but ... I have my doubts. Surely we'd have heard details by now if that was the case.
(I mean "Bitcoin style"! The most important part of encrypted chat is confidentiality, and no part of Bitcoin's architecture even ATTEMPTS to ensure confidentiality! Everything's permanently stored in plaintext on the public ledger FFS!!!!)
It sounds like an offhand comment that we shouldn’t read much into.
Bitcoin’s creator demonstrated an impressive mastery of cryptography—- it was made to be extremely resilient (including to quantum computing) and no one has ever broken it despite billions of dollars being on the line. Maybe Musk meant to say that he thinks his product will be similarly resilient.
He might also mean that the secp256k1 elliptic curve (which Bitcoin uses) is also used by their product in some way, such as for a key exchange.
You can read anything with the assumption that the writer is an absolute idiot, but I’d give the world’s richest man more credit than that.
> You can read anything with the assumption that the writer is an absolute idiot, but I’d give the world’s richest man more credit than that.
Before the pandemic, I would've said similar, even despite some of his errors of judgement.
Since then, and the trend started earlier, it has become difficult to ignore that (1) he responds poorly to experts contradicting him, and (2) outside his actual domains of expertise (rockets and sales/motivational pitches*) he's just as much of a noob as everyone other opinionated loudmouth on the internet.
* the latter of which is, IMO, one of the two big reasons Tesla share price is 10x to 30x what it should be, and that in turn is why he's the richest man on the planet.
The other is that surviving the stock shorters probably burned people off shorting that stock, so the market is mostly now mostly just the exhuberent optimists unbalanced by doubters.
Musk is a salesman.
Using crypto as a phrase makes it more interesting for journalists, gives them something to pad their articles with.
You say musk has no idea, but he has too talent working for him and they will explain stuff.
He will then think of the PR and Sales angle and adjust the product/press releases accordingly.
You think Elon Musk doesn’t know what he’s talking about? Sorry, you might disagree with his politics, but the assertion that he doesn’t know what he’s talking about it absurd.
Sure we know that we should not trust anything Musk or X claims? By now? I mean, come on.
Some things Musk claimed have happened, others have not. For example, he promised that they would release a satellite Internet platform that was better than most of the others, and they did.
On the other hand, he promised that Grok 3 would be massively better than ChatGPT, and it turned out to be comparable at best.
> Currently, we do not offer protections against man-in-the-middle attacks. As a result, if someone—a malicious insider or X itself as a result of a compulsory legal process—were to compromise an encrypted conversation
I assume this means that the "encryption" is about as strong as base64.
I bet they're using WebSocket over HTTPS and calling that "encrypted chat" because it technically is.
hey, I literally doing this right now, what's wrong with that??
I mean its just for notification to my app so its not something critical
Well, in Musk's defense, he promised Bitcoin-style encryption and it does indeed appear to be as much encrypted as Bitcoin is.
well, in Musk's defence he's been selling BS to people for the better part of the last three decades and people are still giving him money, so...
Promises made, promises kept.
It seems to me like this is what happens when you do impulsive, hype-driven development. I assume a junior walked into Elon's office, and pitched it with the words "Bitcoin style encryption, as a chat platform--Written in Rust, almost entirely developed my Grok3", and he was sold.
I'm not being cynical or funny, I legitimately think, after having worked with some hype-driven leadership people, that this is quite common and results in a lot of flawed slop products, which are hyped up by leaders who don't know what they're talking about.
Admitting that this sort of product doesn't do what they think it does would mean admitting that they are wholly incompetent and got tricked by the hype; and that's not acceptable. So it get sunk-cost-fallacied into being a real product even more.
In my experience, it's never "a junior". There are people who build their entire careers on doing things like this. The rest of the story is completely believable, despite put in an unnecessarily sarcastic tone.
Basically, The Emperor’s New Clothes[0].
Not your keys,
Not your data
E2EE is almost pointless in smartphone apps. If the same organization controlling the infrastructure controls the two ends it's effectively a no-op.
They plan to train on the chat aren't they?
> "as a result of a compulsory legal process"
What does this mean?
Self chatting features will be live by the end of the year.
Just port it to Wayland. /s