“Early access” currently but I don’t pay for X or anything and it’s there for me. This comes after X were criticised and had all sorts of “backdoor” conspiracy theories being pushed after they took their private encrypted DMs offline the other day to add improvements.

  • 𝕸𝖔𝖘𝖘@infosec.pub
    English
    0·
    2 days ago

    there’s no way for anyone, including X, to read your messages.

    That defeats the purpose of a messaging platform.

    I know what they meant, but the phrasing is so, so stupid. Anyone who is considering this platform, should think twice before doing so. If they get the phrasing of such a simple sentiment this, incoherently wrong, what does their code look like and what do the encryption protocols look like? If I’d have to guess… AI slop.

    • FreedomAdvocate@lemmy.net.auOPEnglish
      0·
      2 days ago

      The phrasing is only stupid if you are trying to have an issue with it. Obviously you and the person you’re chatting to can read your messages. That doesn’t need to be said, it’s inferred.

      End to End Encryption is easy. Why do you guys all seem to think it’s hard?

      • rottingleaf@lemmy.worldEnglish
        0·
        2 days ago

        Encryption is easy, safe key exchange and extension (or whatever it’s called) for messages longer than the key is harder to make right. If every pair of people on the planet had a common ethereal endless source of entropy, then all they’d have to do is encrypt messages with it and provide address in that source.

        OK, I should go offline for some time

    • FreedomAdvocate@lemmy.net.auOPEnglish
      0·
      2 days ago

      You don’t just log in to their new chat with a 4 digit pass key lol. You need to be logged in to X, meaning password and (hopefully) 2FA would need to be “hacked” in order to even get to the 4 digit password.

  • UnfortunateShort@lemmy.worldEnglish
    0·
    3 days ago

    Platform from a whiny, fascist asshole for whiny, fascist assholes. Not that everyone on that platform is one, some might just have a high tolerance for bs

  • HyperfocusSurfer@lemmy.dbzer0.comEnglish
    0·
    3 days ago

    Lmfao, 4 digit password? That’s like 1 femtosecond to bruteforce given whoever tries to access your messages isn’t rate-limited *ahem, feds*

      • HyperfocusSurfer@lemmy.dbzer0.comEnglish
        0·
        2 days ago

        I guess it can be done relatively securely using both the password and the code to derive the encryption key while not storing it on the servers (while 2fa isn’t of any help here given it’s kinda random with shared seed). I, however, doubt it’s done that way: 1st of all, decryption should then only be possible after one enters their account password for the second time, as well as the conversation password (since the password shouldn’t be stored in plaintext after you’ve entered it), and, secondly, that’ll basically drop the chat history as soon as one changes the password, which is neither convenient nor mentioned.

        Then, if it works how I assume it does, i.e. the actual encryption key is stored on the xitter’s servers and only retrieved once you enter the encryption password, then they can decrypt your messages (either by immediately using that if the password just tells 'em who they should give the key to, or by bruteforcing the password if it decrypts/derives the actual key), which defeats the whole point of e2ee.

        • FreedomAdvocate@lemmy.net.auOPEnglish
          0·
          2 days ago

          They specifically say they can not decrypt your messages.

          Why does everyone in here think that E2E encryption is some insanely hard new thing? It’s been “solved” for years lol. It’s not hard to do.

          • HyperfocusSurfer@lemmy.dbzer0.comEnglish
            0·
            2 days ago

            Because cryptography is hard, especially when you’re trying to do it in a user-friendly manner, with syncing encrypted conversations between devices and whatnot. Like, it’s kinda the whole reason why the classic reply to “how do I make my own encryption algorithm” is “don’t”.

            Also, with proprietary platforms you can’t make sure stuff’s encrypted the way they say it is

  • kipo@lemm.eeEnglish
    0·
    3 days ago

    Who holds the encryption keys? If it’s X/Twiiter, I wouldn’t trust it at all, especially considering who owns it.

        • FreedomAdvocate@lemmy.net.auOPEnglish
          0·
          2 days ago

          Are you? Because X is the only platform that’s legally fighting against government ordered censorship. X is the only social media platform that pretty much only bans you if you break the law, instead of banning you the second you question the echo chambers preferred message.

          • muusemuuse@lemm.eeEnglish
            0·
            2 days ago

            It’s not. They have been caught steering traffic over and over again. If you say anything Elon dislikes and it starts getting attention, their algorithm will hide your posts once Elon tells it to. Elon LOVES censorship so long as he’s in control of it.

              • muusemuuse@lemm.eeEnglish
                0·
                2 days ago

                See the “lol” everyone? It means he’s trying make my assertion sound ridiculous because he didn’t have a way to counter it and doesn’t want believe it. People do this on the internet so they can pretend they are winning.

                • FreedomAdvocate@lemmy.net.auOPEnglish
                  0·
                  2 days ago

                  Without the weights or promotion criterion.

                  Oh so you’ve seen the weights and promotion criterion and know what musk is changing and when? Cause if you don’t, you’re just spreading conspiracy theories.

                  Thanks for the rule breaking insult though.

      • roofuskit@lemmy.worldEnglish
        0·
        2 days ago

        I prefer to judge people by their actions, not by the bullshit they spew. If you really think he champions free speech you are not at all paying attention to his actions.

  • FreedomAdvocate@lemmy.net.auOPEnglish
    0·
    3 days ago

    Maybe the mods should add another rule to the sidebar saying only negative X posts are allowed, since that’s clearly all the “community” wants lol.

    The fact this is being treated as bad news is unbelievable.

    • yoshisaur@lemm.eeEnglish
      0·
      3 days ago

      I think it’s because many people (including me) doubt it’s actually private and secure. The last thing you should ever trust xitter with is your privacy and security. If it actually is private and secure, that’s great

      • FreedomAdvocate@lemmy.net.auOPEnglish
        0·
        3 days ago

        What are you basing your doubts on? When has X under Musk had anything happen to doubt their encryption? You think the guy fighting for free speech and ending people getting in trouble for what they say is going to lie about this?

        • pinball_wizard@lemmy.zipEnglish
          0·
          2 days ago

          When has X under Musk had anything happen to doubt their encryption?

          Musk routinely hires young unqualified technicians, and abused, laid off, or otherwise alienated much of the top talent at Twitter, in the name of cost savings.

          There’s plenty of other stories out there of Musk’s ego interfering with his staff’s ability to do their jobs properly.

          Most recently, the new DOGE has suffered substantial security lapses, associated with under-hiring and under-provisioning against cyber security threats, under Musk’s leadership.

          Even before Twitter was aquired, Twitter had an embarrassing memorable history with public figures suffering from security incidents caused by Twitter’s own staff, training, technology or processes. This was arguably not a huge problem for an almost fully public messaging platform, but could be disasterous for anyone relying on this new E2EE solution, if it is incorrectly implemented.

          The talent needed to correctly implement secure end to end encryption is rare, on a good day, for a good employer with a strong history of loyalty to their staff. X arguably has little to none of that going for it, today.

          There’s very little reason to assume that X, under Musk’s current leadership, has correctly securely implemented end-to-end encryption, and there are reasonable reasons for people to fear that E2EE developed at X may have serious security flaws.

          • FreedomAdvocate@lemmy.net.auOPEnglish
            0·
            2 days ago

            Most recently, the new DOGE has suffered substantial security lapses,

            Did they? What? The made up ones where people claimed that DOGE gave russian hackers access to databases despite DOGE never even requesting access to their systems?

            Even before Twitter was aquired, Twitter had an embarrassing memorable history with public figures suffering from security incidents caused by Twitter’s own staff, training, technology or processes.

            Funny that you say this after you said this:

            Musk routinely hires young unqualified technicians, and abused, laid off, or otherwise alienated much of the top talent at Twitter, in the name of cost savings.

            So twitters staff, training, technology and processes were the source of these embarrassing incidents…but then Musk shouldn’t have gotten rid of them?

            but could be disasterous for anyone relying on this new E2EE solution, if it is incorrectly implemented.

            And there’s nothing to say that it is incorrectly implemented other than hopes and dreams by people who want it to be.

            The talent needed to correctly implement secure end to end encryption is rare, on a good day, for a good employer with a strong history of loyalty to their staff.

            Absolutely not true lol. Secure end to end encryption is a solved problem. It’s not hard to implement.

        • Blemgo@lemmy.worldEnglish
          0·
          3 days ago

          I’m not the one who you asked, but I’d still give some feedback of my own. Musk as a person is a difficult character. I would even go as far as calling him narcissistic.

          • He got thrown out of PayPal for his incessant micromanagement and disruptions to the flow of the company
          • he bought himself into Tesla to replace the CEO with himself
          • he tends to depict himself as one of the greatest tech geniuses out there, yet often the plans he presents to the public are often poorly thought out and serve no other purpose than to show his “talents”
          • when his proposal to build a tiny submarine for the Than Luang cave rescue was shot down and a British diver was chosen instead he resorted to call the diver a “pedo guy”
          • his latest attempts in politics, especially concerning DOGE feel completely half baked and, again, how he presents himself in his position feels more like an ego trip than something more reasonable
          • he publicly had talks with the controversial German political party “Alternative für Deutschland”, which are currently legally considered “assured right-wing extremists” and have had a history of having Nazis and Nazi sympathisers in their ranks

          I generally can’t trust someone who seems to put himself first at everything to handle anything related to security when the role allows him to exploit it for his own gains. And I do not trust someone who supports political groups known for trying to oppress minorities to defend actual rights for free speech.

  • Blemgo@lemmy.worldEnglish
    0·
    3 days ago

    The question is whether this actually is E2EE, as it’s easy to fake by using a man in the middle attack and hard to prove. The only real way to prove it for sure is to run a third party security audit, like Signal does.

    Taking down the old system doesn’t inspire confidence either, as this downtime could easily been used to interrupt old conversations in order to implement a way to decrypt the messages on the servers before passing it on to the actual recipient, as all keys would have to be re-issued.

    • thedruid@lemmy.worldEnglish
      0·
      3 days ago

      With recent advances, there is nothing released online that can be believed. A. I fakes are everywhere and in everything

      So I wouldn’t trust them even then.

      • just_another_person@lemmy.worldEnglish
        0·
        3 days ago

        Untrue. Many Zero-Trust platforms out there that give you the tools to confirm when you are in fact e2e encrypted. They publish their docs, open source their tools, and give verification tools to check.

        • thedruid@lemmy.worldEnglish
          0·
          3 days ago

          Anything, even your tools can be faked. Anything. You may not like it, and for the most part most mundane data isn’t worth faking, but there’s no real way to trust any online anymore

              • just_another_person@lemmy.worldEnglish
                0·
                3 days ago

                I’m confused about this conversation. Are you the idiot here, or do you think I am?

                Your AI generated article doesn’t have any actual information, doesn’t deal with MITM attacks, and has zero context about how anything it mentions could be used to attack what we’re discussing here.

                Unless you have a quantum responder in the chain, there isn’t a currently known way to fake an exchange of keys to infiltrate secure channels secured by keys.

                Not only would this destroy the currently existing Internet, you’d be seeing floods of information exfilateates for sale on the black market.

                Not only have you not contributed to this conversation, you’ve proven to be absolutely ignorant about the topic, and you are awarded no points.

                God have mercy on your soul.

                • thedruid@lemmy.worldEnglish
                  0·
                  3 days ago

                  Youngster, your not an idiot.

                  You just proved my point

                  See you don’t agree with an article. You think it’s a. I generated. Fine

                  Prove it beyond a shadow of a doubt. You can’t. …

                  Your simply not looking at it from a vriepoirnt of having watched this outcome be developed intentionally by controlling men

                  It is what it is. No amount of name calling, or wishful thinking on your part. Will change that.

                  You are making statements that unfortunately have been proven incorrect in the real world.

                  It’s faked all the time because THERES MONRY IN IT.

                  If there’s money in it, it is happening. No amount of pretending that a quantum computer( Which isn’t available so is a non factor in reality, so I’ll ignore the irrelevant argument. ) is the only way to fake traffic.

                  And on to your argument. You’ve proven nothing. Your comment has nothing of substance in it, and what is was Trumpian in focus and meaning.

                  I truly wish you a good day. I’m too tired of overly confident tech bros to continue this.