No - did you even read the article? An x employee confirmed that they’re using the “special” servers to store the keys that mean that they cannot see them. The author then says that the employee confirming it doesn’t mean they do, because the author doesn’t want it to be true.
There are hardware for that called hardware security modules, but yeah I definitely wouldn’t trust Twitter’s implementation - especially because they probably just need the auth team to tell the HSM that the user logged in when they didn’t to get that key
A proper implementation would use multiple security measures and require a reset (delete) of certain private account data before the account access can be reset, otherwise the user’s password would be needed (for key derivation) or some other secret held by the user’s devices (in the TPM chip or equivalent)
I’ve run a cryptography forum for 10 years. I can tell snake oil from the real deal.
Musk’s Twitter doesn’t know how to do key distribution. The only major company using HSMs the way Musk intends to is Apple, and they have far more and much more experienced cryptographers than X does.
There are hardware for that called hardware security modules, but yeah I definitely wouldn’t trust Twitter’s implementation - especially because they probably just need the auth team to tell the HSM that the user logged in when they didn’t to get that key
So again - you’re just hoping that they’ve done it wrong, based on nothing other than you wanting them to have done it wrong. They’ve told you they did, but you don’t believe them based on…nothing…nothing whatsoever…other than your hatred.
Feel free to tell me how your knowledge of cryptography proves that it’s done incorrectly though. Please.
No - did you even read the article? An x employee confirmed that they’re using the “special” servers to store the keys that mean that they cannot see them. The author then says that the employee confirming it doesn’t mean they do, because the author doesn’t want it to be true.
There are hardware for that called hardware security modules, but yeah I definitely wouldn’t trust Twitter’s implementation - especially because they probably just need the auth team to tell the HSM that the user logged in when they didn’t to get that key
A proper implementation would use multiple security measures and require a reset (delete) of certain private account data before the account access can be reset, otherwise the user’s password would be needed (for key derivation) or some other secret held by the user’s devices (in the TPM chip or equivalent)
So again, you think you know better than the employee simply because you want it to be done incorrectly.
I’ve run a cryptography forum for 10 years. I can tell snake oil from the real deal.
Musk’s Twitter doesn’t know how to do key distribution. The only major company using HSMs the way Musk intends to is Apple, and they have far more and much more experienced cryptographers than X does.
So again - you just don’t want it to be true, and you think the people that know more than you about it are lying.
You sound like an antivaxxer defending a crank
You sound like a conspiracy theorist defending wearing an aluminium foil hat.
If you can’t demonstrate that you know more about cryptography then me, it’s time for you to admit you’re wrong
You said this
So again - you’re just hoping that they’ve done it wrong, based on nothing other than you wanting them to have done it wrong. They’ve told you they did, but you don’t believe them based on…nothing…nothing whatsoever…other than your hatred.
Feel free to tell me how your knowledge of cryptography proves that it’s done incorrectly though. Please.