🚨Reminder: XChat claim of “end-to-end encrypted” chats is misleading at best.
XChat uses the Juicebox protocol to secure the encryption keys with only a 4-digit code which cannot be brute forced.
While that sounds absurd, the Juicebox protocol achieves this by splitting up the encryption key and distributing it to various independent “realms”, doing it in such a way that there isn’t a single realm that has the whole encryption key and can verify the 4-digit pin independently.
The whole scheme falls apart if all the realms are controlled by a single entity, which is exactly how XChat does it. As you can see in the screenshot of the traffic produced by the new XChat app when creating a new 4-digit pin: all the realms are under the x[.]com domain with an SSL certificate that belongs to X. (The XChat app does not use certificate pinning, which allowed network traffic to be intercepted and decrypted)
Since X operates all the realms, that means X can quite easily recover all the keys for any “end-to-end encrypted” chats in XChat