X is now offering the final encrypted chat. You probably don’t have to faith.

X, before Twitter, has started to roll His new cipratory messaging feature called “chat” or “xchat”.

The company says the new communication feature is end-to-endMeaning messages only can be read by the mentioned and their receiver, and – in theory – no one access to x, can access him.

Excessive of Cryptation, rescue, there is achieved that the actual of Xchat XChat implementation should not be confident. They tell him that is far more widely by the sign, a widely regarded technology the state of the art when you are threepacks at the end to lift to the end.

In XChat, once a user Click on “set up now,” he asks to create a 4-digit pin, that will be used to encrypt the user’s private key. This key is then stored on X. The private key is essentially a secret encryption key assigned to each user, which serves the purpose of decrypt the messages. As in many sorting establishments of endless, a private key is on a wig with a public key, that is what a sittent uses to cry the messages to the receiver.

This is the first red flag for xchat. The signals interrupt the private key of a user on their device, not on their servers. As and where exactly the private keys are stored on X servers are also important.

Matthert, a security search Who has posted a post blog about xchat in June, when x announced the new service and slowly started to roll itHe wrote that if the company would not use what they are called security modules, to store the keys, then the company could tamper with the messages and potential. HSMS are the servants made specifically to make it more difficult for the company they owned them to access the data inside.

An ingenial x she said In a post in June that the company makes its Hussms but no society has provided a try so far. “Fence is done this is’ trust us, earthy of us, territory” garrett to techcrough.

The second red flag, that x itself admit In the X Chat Support page is that the current service deployment could afford “a malicious orx uses” to compromise cultivated conversation.

That’s what is technically called a “Opponent-in-the-average“AitM attack. What does the total point of a mixture of the end of the end of the end.

Garrett said x “gives you the public key every day I am communicating with them, so they are implemented, you can’t test a new key”, and made a attack of attack.

Another red flag is that none of the xchat implementation, at this point, it is Open Source, audit to smell, that is I openly documented in detail. I am X…………….. DO YOU it says Thrown “rates open our implementation and describe the technology of the cryptptopop in depth in the middle of a technical class after this year.”

Finally, x does not bid “Secirmy perfect answer“A Cryptographic Metorism for which new message is encrypted, which means that if an attack has shown the private pages. It may only describe the last message, and not all paid. The business you this lack.

By the way, Garrett does not think xchat is at a point where users have to trust you alone.

“You are all involved is entire confidence, the absorption and technically worse than the sign”, grecto said to Techcrunnch. “And even if they were fully reliably to start, may stop trusting the trust in many ways or impetution during the initial impetution, is to prove.”

Garrett is not the only expert that develops concerns. Matthew Green, a encryption we experts who teaches at JohnS Hopkins University, you agree.

“For the moment, until you get a full of someone who doesn’t trust anymore that you were no trust in more than the other run,” green said Techcrunnch. (Xchat is a separate feature living, at least for now, together with directed direct messages.)

X did not answer multiple questions send to their picture email address.