Musk wants end-to-end encryption for Twitter DMs. It may not be that simple | Hacker News Reader

Musk wants end-to-end encryption for Twitter DMs. It may not be that simple

cnn.com

6 pointsKaibeezy5 comments

Open articleView on HN

> "They haven't done it yet because it's hard. Really hard."

How "hard" is it though?

The following seems straightforward to me:

- Generate a pgp key pair

- protect private key with a E2E password ("if you forget your E2E password, all your DMs will be lost")

- store public key and encrypted private key in the Twitter account

- download private key to each device/browser session the user logs in to, have them enter the E2E password to decrypt it

- make public key of any user available to anyone they send message to

Why would this not work?

Not something I would call exactly good user experience for your average twitter user... And then come the governments which will have slight issues on this. And fake apps, third-party apps, malicious browsers and malware in general...

It is simple, but actually to make it usable for other than nerds and have them not yell at twitter when they handily forget their password and can't recover. Not really worth the customer support and PR load following.

Right, specifically which part is different "in a modern, patched web browser" that makes it so hard compared to a desktop or mobile app? Or even the point about being so much harder to add after having non-e2e messages beforehand, I don't buy--they can co-exist with a new default.

You don't want to re-use that private key on every device. You need separate keys for each device.

You want to be able to burn the private key of a given device without burning all keys for all devices.

It's a pity the web doesnt have standards for security devices helping to encrypt content. Twitter or anyone else would have to go build end to end encryption.

NitroKey threw together a sample web platform api for using FIDO devices to secure content[1]. No real uptake though.

This still might not help the case here, where other people also need to be able to decrypt with the public key. In general, I think the perspective is at the nose of where we are: regulation & clampdowns abound, nations-states making up endless reams of expectations & demands. Data is no longer oil: data is toxic[2].

[1] https://github.com/Nitrokey/nitrokey-webcrypt

[2] https://www.schneier.com/blog/archives/2016/03/data_is_a_tox... https://news.ycombinator.com/item?id=11273356 (180 points, 6 years ago, 65 comments)

Reply on news.ycombinator.com