X's new "encrypted" XChat feature doesn't seem to be any more secure
66 points
3 months ago
| 11 comments
| theregister.com
| HN
mjg59
3 months ago
[-]
The implementation seems to be libsodium sealed boxes, with the key material sequestered using the juicebox.xyz protocol. In itself this seems broadly fine, with the significant proviso as mentioned in https://help.x.com/en/using-x/encrypted-direct-messages that identity is not verified at present, and as a result it's trivially MITMable.

But there's something more subtle here. Juicebox means that your key material is remotely stored in encrypted form. In an ideal setup, it's split between multiple different realms operated by different people, and the key material is stored in HSMs. There's a complicated dance where you prove knowledge of the PIN without actually revealing the PIN, and then the remote realms hand over the key material and you reassemble it into your key by decrypting it with a key also derived from your PIN.

If Twitter is running their own Juicebox realms then you're having to trust them. Even if the realms are implemented as HSMs, they're in a position to see the encrypted key material as it exits the HSM. And if they're not in HSMs, then the encrypted key material is just sitting there where they can see it. This doesn't intrinsically give them the key, since it still needs the PIN to decrypt it - but the key derivation function from the PIN is just 32 rounds of argon2id with 16MB of memory use, and given the PIN is limited to 4 digits, that's going to take about a second of GPU aided brute forcing to drop out the actual key.

As noted in the help doc, this isn't forward secure, so the moment they have the key they can decrypt everything. This is so far from being a meaningful e2ee platform it's ridiculous.

reply
_elephant
3 months ago
[-]
This is a very thorough technical analysis—thanks for sharing! It seems like even though Juicebox itself uses libSodium sealed boxes and HSMs, the security is ultimately constrained by the 32 rounds of argon2id for the PIN derivation and Twitter’s ability to access the encrypted key material. Perhaps its biggest selling point is deployment flexibility rather than being a true end-to-end encrypted platform.
reply
hmry
3 months ago
[-]
Thank you for the breakdown.

Since we're on the topic of having to trust X, is there any reason to believe X wouldn't insert some code into the client JS (behind some per-account flag) to exfiltrate your key or PIN, if they were ordered to do so?

I wouldn't rely on a website as a secure communication client, that seems like a job for an open-source native application. But I'm no expert.

reply
mjg59
3 months ago
[-]
Oh, yeah, with no infrastructure to actually attest to the website (or the app) being trustworthy you're inherently placing trust in Twitter. Use Signal.
reply
mort96
3 months ago
[-]
I think Signal is as secure as is reasonably possible, but it's worth noting that even with Signal, you can't actually verify that the app you've downloaded reflects the source code. The GitHub issue about reproducible builds is closed as not planned: https://github.com/signalapp/Signal-iOS/issues/641
reply
mjg59
3 months ago
[-]
The Android build is reproducible, iOS is (to the best of my knowledge) hard work for a number of reasons.
reply
herewulf
3 months ago
[-]
As a user of XChat[0] since 1999, I can tell you that it's definitely not encrypted or secure. Don't believe the hype!

[0]: http://xchat.org

reply
mrweasel
3 months ago
[-]
Somehow I feel like they should just go all in at call it BitchX[1], that also have the same Bitcoin style of encryption, none.

1) https://en.wikipedia.org/wiki/BitchX

reply
alimbada
3 months ago
[-]
I really hope you're not still using it. It was last updated in 2010. Even the website hasn't been updated to use HTTPS.
reply
Yoric
3 months ago
[-]
Oh, wait, is Elon porting the venerable xchat to Rust? :)
reply
bilekas
3 months ago
[-]
> Oh, wait, is Elon porting the venerable xchat to Rust? :)

If this hasn't been done already, I have a new weekend project!

reply
Greed
3 months ago
[-]
For those of you who don't know, the project was archived in 2024 but there was at least one modern fork of XChat in the form of HexChat: https://hexchat.github.io/
reply
mrweasel
3 months ago
[-]
Honestly we're a little short on good IRC clients, so it's not that stupid.
reply
bilekas
3 months ago
[-]
I have resorted to rolling my own version of irccloud. It became embarrassing how much I spent over the years for such a simple service. Also learning then irc protocol in its bizarre entirety was pretty fun.
reply
SbEpUBz2
3 months ago
[-]
kvirc ftw!
reply
Vinz_
3 months ago
[-]
> Dubbed "XChat" (not to be confused with the venerable Linux/Windows IRC app of the same name)

It’s not the same XChat

reply
DavidDiazUA
3 months ago
[-]
@grok is this true?
reply
Imustaskforhelp
3 months ago
[-]
Is there grok on hackernews?
reply
astar1
3 months ago
[-]
lol!
reply
RUnconcerned
3 months ago
[-]
Looking into this
reply
0xAFFFF
3 months ago
[-]
Concerning
reply
bilekas
3 months ago
[-]
I think you missed the joke. As a fellow XChat user I can assure you, Elon is wrong.
reply
Vinz_
3 months ago
[-]
I apparently did, although I still struggle to understand what the joke is, to be honest.

Thank you for at least explaining that I missed a joke, it’s a lot more helpful than downvotes. (I’m not complaining, I don’t really care about internet points, I was just confused about what I did wrong) :)

reply
Meekro
3 months ago
[-]
In a nutshell: we have unclear comments from Musk and unclear statements in the FAQ (which might not have been written by a technical person). Until they release a technical white paper, we don’t know anything for sure.
reply
mjg59
3 months ago
[-]
Sure we do - the client code is already out there.
reply
Meekro
3 months ago
[-]
Has anyone posted an analysis of its security?
reply
mjg59
3 months ago
[-]
reply
mort96
3 months ago
[-]
The first time I heard about this "XChat" was through a screenshot of Musk's tweet where he said it has "bitcoin style" encryption. Honestly, it was obvious just from reading that, that Musk has absolutely no idea what he's talking about when it comes to cryptography, and that nobody he has talked to on the development team has any clue either.

That doesn't mean that we know for sure that the team doesn't have cryptography experts, but ... I have my doubts. Surely we'd have heard details by now if that was the case.

(I mean "Bitcoin style"! The most important part of encrypted chat is confidentiality, and no part of Bitcoin's architecture even ATTEMPTS to ensure confidentiality! Everything's permanently stored in plaintext on the public ledger FFS!!!!)

reply
Meekro
3 months ago
[-]
It sounds like an offhand comment that we shouldn’t read much into.

Bitcoin’s creator demonstrated an impressive mastery of cryptography—- it was made to be extremely resilient (including to quantum computing) and no one has ever broken it despite billions of dollars being on the line. Maybe Musk meant to say that he thinks his product will be similarly resilient.

He might also mean that the secp256k1 elliptic curve (which Bitcoin uses) is also used by their product in some way, such as for a key exchange.

You can read anything with the assumption that the writer is an absolute idiot, but I’d give the world’s richest man more credit than that.

reply
ben_w
3 months ago
[-]
> You can read anything with the assumption that the writer is an absolute idiot, but I’d give the world’s richest man more credit than that.

Before the pandemic, I would've said similar, even despite some of his errors of judgement.

Since then, and the trend started earlier, it has become difficult to ignore that (1) he responds poorly to experts contradicting him, and (2) outside his actual domains of expertise (rockets and sales/motivational pitches*) he's just as much of a noob as everyone other opinionated loudmouth on the internet.

* the latter of which is, IMO, one of the two big reasons Tesla share price is 10x to 30x what it should be, and that in turn is why he's the richest man on the planet.

The other is that surviving the stock shorters probably burned people off shorting that stock, so the market is mostly now mostly just the exhuberent optimists unbalanced by doubters.

reply
timschmidt
3 months ago
[-]
> he's just as much of a noob as everyone other opinionated loudmouth on the internet.

That would be a step ahead of most of the ultra wealthy, in my humble experience. Family money seems to do nothing positive for critical thinking skills or practical experience.

reply
cyanydeez
3 months ago
[-]
At best, he brings technical ideas. Not implementation.
reply
theseustheseus
3 months ago
[-]
He implements implementation.
reply
fzeroracer
3 months ago
[-]
The world's richest man was caught cheating at video games via hiring people to play for him for the sake of cred. I don't think I would give him anything.
reply
Meekro
3 months ago
[-]
You're right that he cheated (in some sense), but I don't think "caught" is the right word since he admitted it when he was asked point-blank. He paid someone to level up his character before he played it, not to stream in his name and pretend to be him.

Paying someone to level your character is officially against Blizzard's rules in all of their games, but their lack of enforcement reveals that they don't care as long as the monthly payments clear. World of Warcraft is overrun with people selling gold and boosts-- given that they're openly advertising this in Stormwind, it wouldn't be a stretch to call it de-facto legal (or at least decriminalized). Heck, Blizzard is selling gold and level boosts on its own website! [1]

[1] https://us.shop.battle.net/en-us/family/world-of-warcraft

reply
fzeroracer
3 months ago
[-]
He argued that he was top of the ladder and a top hardcore player in Path of Exile. The rest of your argument is just an excuse for someone lying directly to your face. The only reason why he didn't get banned from Path of Exile (as he should've been) is because he's rich and now tied with the US government.
reply
sharpshadow
3 months ago
[-]
I thought they didn’t ban him, because they are preoccupied with PoE2..
reply
cyanydeez
3 months ago
[-]
Uh, theres way more evidence musk is a moron than anything else.
reply
v5v3
3 months ago
[-]
Musk is a salesman.

Using crypto as a phrase makes it more interesting for journalists, gives them something to pad their articles with.

You say musk has no idea, but he has too talent working for him and they will explain stuff.

He will then think of the PR and Sales angle and adjust the product/press releases accordingly.

reply
briandear
3 months ago
[-]
You think Elon Musk doesn’t know what he’s talking about? Sorry, you might disagree with his politics, but the assertion that he doesn’t know what he’s talking about it absurd.
reply
ben_w
3 months ago
[-]
"with artificial intelligence, we are summoning the demon." - Musk

He then invested in OpenAI, is still trying to make FSD a thing, wants humans and AI to merge via Neuralink, made humanoid robots, and made grok because he parted ways with OpenAI.

If he knows what he's talking about in general, this combination makes him a demonolater.

Given how often (and for how long) he keeps saying FSD is just around the corner — and how poorly recieved have been TBC's tunnels, Neuralink's research, grok, Twitter's changes under Musk, Optimus, Cybertruck, his comments when sharing a video of him attempting to play high-leveled characters in some video games — I have every reason to think he doesn't know much outside of rockets and sales/motivational speeches.

I don't even need to reference the salutes, supporting AfD, DOGE etc. as examples here.

reply
lawn
3 months ago
[-]
He's made many comments that betray the fact that he's absolutely clueless in many areas, even those he should be knowledgeable in.

This is just the latest example.

reply
mort96
3 months ago
[-]
> You think Elon Musk doesn’t know what he’s talking about?

Correct

reply
protocolture
3 months ago
[-]
Elon Musk doesnt know what he is talking about, when he strays away from business to pretend he is technical.

Doing so, is a business tactic. We know he is full of shit, but it gives him some kind of status in front of other business people.

reply
0xEF
3 months ago
[-]
Sure we know that we should not trust anything Musk or X claims? By now? I mean, come on.
reply
Meekro
3 months ago
[-]
Some things Musk claimed have happened, others have not. For example, he promised that they would release a satellite Internet platform that was better than most of the others, and they did.

On the other hand, he promised that Grok 3 would be massively better than ChatGPT, and it turned out to be comparable at best.

reply
michaelteter
3 months ago
[-]
When you make a lot of bold claims, and you have your (or a lot of someone else's) money to help you back up the claims with (clumsy) actions, sometimes your bold claims turn out to be truthy.
reply
cyanydeez
3 months ago
[-]
Sure, ill sell you this broken clock. Its been shown to know atleast two times a day.
reply
threeseed
3 months ago
[-]
> Currently, we do not offer protections against man-in-the-middle attacks. As a result, if someone—a malicious insider or X itself as a result of a compulsory legal process—were to compromise an encrypted conversation

I assume this means that the "encryption" is about as strong as base64.

reply
mort96
3 months ago
[-]
I bet they're using WebSocket over HTTPS and calling that "encrypted chat" because it technically is.
reply
tonyhart7
3 months ago
[-]
hey, I literally doing this right now, what's wrong with that??

I mean its just for notification to my app so its not something critical

reply
mort96
3 months ago
[-]
If your threat model is such that it's perfectly fine for the server to know everything that's coming from and going to the client, there's no problem at all. That's probably your situation, it's okay that the server knows what notifications it's sending to your app.

If your threat model is such that you'd rather not have the server know what's sent to and from the client, it's not enough to just encrypt the data in flight, which is what HTTPS does. With encrypted chat, we typically want what we refer to as end-to-end encryption, where the server can't see the content of messages sent between users.

reply
tonyhart7
3 months ago
[-]
then what happen if E2EE receiver is server itself???

I want to prevent vector attack such MiTM if TLS is somehow hacked

reply
mort96
3 months ago
[-]
In a typical server-backed web app architecture, TLS is the protection against MITM. You're gonna have a really really hard time making something which protects against MITM better than TLS.

There are things you can do to make it more difficult to hack your TLS connection though, for example you could use key pinning to make sure that your app will only accept a server with the certificate you expect. This would protect against an IT admin installing root certs on their users' devices, or against certificate authorities issuing fake certificates for your domain.

reply
tonyhart7
3 months ago
[-]
Yeah this app maybe don't need that

but for things like IoT running websocket connection for long time maybe I need that

reply
hiimkeks
3 months ago
[-]
Ah, the Zoom Gambit
reply
tonyhart7
3 months ago
[-]
wdym, elaborate
reply
hiimkeks
3 months ago
[-]
The first time zoom announced E2EE, they didn't actually have it and then said something like "well the server is the end, and then there is another end...". IIRC In the end they acquihired keybase so they fix the crypto for them.
reply
8-prime
3 months ago
[-]
When the message you push out through that websocket are something that server knows about intrinsically, as in, the message contents are produced by the server there is nothing wrong with the approach.

When your server facilitates a communication between two clients and just acts as the infrastructure E2EE can become relevant. If the clients want to be able to exchange information withouth the server being able to snoop in on what is being sent, then you'd want to use E2EE. With that the server won't be able to read what is being sent.

reply
tonyhart7
3 months ago
[-]
- I have public chat that user can chatting in public room (seems like I dont need for this one)

- then notification service is probably something I want to E2EE then, but Idk about performance hit cost would be

reply
0xFEE1DEAD
3 months ago
[-]
A public chat - like one that anyone can join at any time without needing an invitation?

If so, then you really don't need any extra encryption.

If not, then it depends on who's using your chat, how they use it, and for what purpose. Are the users of the chat room a small group with occasional users joining or leaving, or are many users expected to join and leave at any given moment?

That being said, encrypting the notifications won't bring any real benefits. A bad actor would simply focus on trying to compromise your server.

If you do decide that full e2ee would benefit your users, then look for someone who can help you implement it.

Implementing real e2ee for a 2 party chat is hard for someone without experience.

Implementing e2ee for a group chat is hard even for someone with experience.

reply
tonyhart7
3 months ago
[-]
welp, I am just gonna look at Telegram/Signal source and make a lite version for it
reply
mort96
3 months ago
[-]
I don't think you want to look at the source code, and I don't think you want to look at Telegram. You should have a look at the Signal Protocol: https://en.m.wikipedia.org/wiki/Signal_Protocol. It's well documented. Maybe there are libraries which implement it.

(Though I still think that "how can I protect against TLS being broken?" is the wrong question and you should instead ask "how can I ensure that TLS doesn't break?".)

reply
Hamuko
3 months ago
[-]
Well, in Musk's defense, he promised Bitcoin-style encryption and it does indeed appear to be as much encrypted as Bitcoin is.
reply
qalmakka
3 months ago
[-]
well, in Musk's defence he's been selling BS to people for the better part of the last three decades and people are still giving him money, so...
reply
briandear
3 months ago
[-]
Those rockets, the ones that went into space, are those BS? Starlink works. Tesla’s were the most desirable electric car until politics came into it. And PayPal? Literally changed the internet.
reply
xorcist
3 months ago
[-]
I don't think that was intended as an argument that Starlink or Tesla doesn't exist but that there has been many not entirely truthful promises made when building the brands. Tesla exists, but some investors really believed it was to be taken private, or perhaps even that Full Self Driving would be capable of earning money while you sleep, or any other of a thousand more or less realistic promises that has been publicly made.

I do wish that the Paypal statement would be a bit more nuanced though. Yes, Musk made a lot of money on the dot-com hype by way of Paypal. And he seems to have built strong friendships from that, weirdly with the same people that fired him. But his involvement in Paypal was that he let it buy the startup he was in and demanded to be CEO. He then only showed interest in throwing out the FreeBSD it was built on and replace it with NT (which was the hottest fad at the time) and to rename the company to "X". Neither happened, and he was quickly let go before the company risked bankruptcy. It's rather far fetched to go from that to "changing the Internet". Paypal won and X didn't.

reply
qalmakka
3 months ago
[-]
The point is not that he doesn't deliver anything, or that he never achieved any sort of success - he did, he is incredibly successful. The point is that he constantly oversold what his goals were and made promises that couldn't be kept, often to get the funding he needed to reach his definitely less ambitious concrete goals.

Yeah he made the electric car popular, but it can be argued that in order to make his company economically viable he basically lied to his investors and customers about self driving cars for almost a decade, when he had nothing real in his hands. Thanks to those promises he got the money to keep the company afloat until it had the manufacturing capability to actually deliver the cars they sold; and someone may argue he would have failed if he had been honest from the beginning, and that maybe people wouldn't have invested the money they did if he hadn't set unachievable goals to begin with

And this is a pattern you can see in all of his companies; he promises the world Mars, gets a lot of funding and then instead of delivering on the "dream" target, he uses the money to deliver a valid but definitely less "romantic" product he can actually sell. One time is ok, but it's basically a modus operandi now. And this gives me a strong suspicion that the product was the real goal all along, and he knew he had to lie about the "dream" in order to get the capital at all

reply
protocolture
3 months ago
[-]
Yeah see you fall into the usual trap.

Elon sells a 2-3 phase project, and then delivers phase 1. Thats the entire man.

Tesla: Was meant to revolutionise car making and green the planet. He delivered a pretty ok set of electric cars and got completely outflanked by traditional car makers. He also used it to rescue his brothers failing business.

Starlink: Its billed as an uninterruptible censorship ignoring super internet in space where government cant get it. But what he delivered is just landline fiber extended by 1 - 2 satellite hops. Its great for rural areas but the business complies with all legal censorship requirements where it operates. My back of the napkin math tells me its ultimate goals are completely unachievable, and MEO internet providers IMHO are catching up.

SpaceX: SpaceX is really good, they have brought in everyone from JPL and other places and absolutely nailed low cost orbital payload. In fact I read speculation they will take boeings contracts for Artemis prep. However what he sold is the relocation of humanity to mars which is no closer to being achieved, and as far as I can tell, he has literally no one but concept artists working on.

Hyperloop etc: Basically kickstarted the boring company which IIRC is one of his better long term prospects. He wont be creating super fast mass transit systems but he can shave months off of boring projects.

Xitter: Billed as an uncensored town square, the place has just engaged in the other teams censorship and is generally a cess pit.

Neuralink: Apparently almost as good as stuff displayed on Beyond 2000 25+ years ago.

tl;dr guy is a salesman. The fact that he can sell you a dream and then pretend like he delivered it without delivering it is a testament to his business strengths. But dont drink the koolaid.

reply
blitzar
3 months ago
[-]
Promises made, promises kept.
reply
lionkor
3 months ago
[-]
It seems to me like this is what happens when you do impulsive, hype-driven development. I assume a junior walked into Elon's office, and pitched it with the words "Bitcoin style encryption, as a chat platform--Written in Rust, almost entirely developed my Grok3", and he was sold.

I'm not being cynical or funny, I legitimately think, after having worked with some hype-driven leadership people, that this is quite common and results in a lot of flawed slop products, which are hyped up by leaders who don't know what they're talking about.

Admitting that this sort of product doesn't do what they think it does would mean admitting that they are wholly incompetent and got tricked by the hype; and that's not acceptable. So it get sunk-cost-fallacied into being a real product even more.

reply
xorcist
3 months ago
[-]
In my experience, it's never "a junior". There are people who build their entire careers on doing things like this. The rest of the story is completely believable, despite put in an unnecessarily sarcastic tone.
reply
ChrisMarshallNY
3 months ago
[-]
Basically, The Emperor’s New Clothes[0].

[0] https://wikipedia.org/wiki/The_Emperor%27s_New_Clothes

reply
focusgroup0
3 months ago
[-]
Not your keys, Not your data
reply
msgodel
3 months ago
[-]
E2EE is almost pointless in smartphone apps. If the same organization controlling the infrastructure controls the two ends it's effectively a no-op.
reply
asdaqopqkq
3 months ago
[-]
They plan to train on the chat aren't they?
reply
beej71
3 months ago
[-]
> "as a result of a compulsory legal process"

What does this mean?

reply
blitzar
3 months ago
[-]
Self chatting features will be live by the end of the year.
reply
marcodiego
3 months ago
[-]
Just port it to Wayland. /s
reply