Archive — US — techcrunch
X is now offering me end-to-end encrypted chat — you probably shouldn’t trust ityet
X (formerly Twitter) has launched 'XChat,' an end-to-end encrypted messaging feature, but experts warn it shouldn't be trusted due to security flaws. Unlike Signal, XChat stores user keys on its servers and lacks critical encryption practices, raising concerns about potential unauthorized access to messages. Experts suggest users exercise caution until further audits and improvements are made.
Key points
- X has introduced 'XChat' for encrypted messaging, claiming messages are only readable by sender and receiver.
- Security experts like Matthew Garrett express skepticism over XChat's encryption implementation.
- User's private key is stored on X's servers, unlike Signal, which keeps it on the user's device, creating vulnerability.
- Concerns include lack of hardware security modules (HSMs) and potential for 'adversary-in-the-middle' (AITM) attacks.
- XChat is currently not open source, with plans to release detailed information later.
- Experts warn that without further audits, XChat may be no more secure than unencrypted direct messages.
Why it matters
- Growing concerns around data privacy and security in digital communications following high-profile data breaches.
- Increased vigilance among consumers and experts on the trustworthiness of encryption methods and implementations.
- The trend towards encrypted communication reflects broader moves towards enhanced privacy measures in technology.
XChat's initial launch raises significant security concerns that could undermine user trust in encrypted messaging. Until further audits validate its security and transparency claims, experts recommend users remain cautious.