Twitter is rolling out support for encrypted direct messages

Twitter announced to begin rolling out support for encrypted direct messages (DM) on the platform, six months after the company’s CEO Elon Musk announced the feature in November 2022.

A new way of communicating on Twitter – encrypted direct messages – will appear as separate conversations in addition to existing direct messages and will be visually distinguished from unencrypted conversations by a padlock icon on the avatar of the user you are talking to.

The feature is currently limited to verified users and those who interact with them. It is essential that both sender and receiver have the latest versions of Twitter applications (Android, iOS and web).

The recipient must also follow the sender, or have previously sent a message to the sender or previously accepted a direct message request from the sender.

While Twitter didn’t reveal many details about the new feature, the company said it uses a “combination of strong cryptographic schemes” to encrypt messages, links and reactions that are part of an encrypted conversation. Encrypted chat content remains encrypted while stored on Twitter’s infrastructure, and is only decrypted on the recipient’s device.

Sending an encrypted message is similar to sending a regular unencrypted message. If you are eligible to send encrypted messages, you will see a toggle after clicking the message icon to enable “encrypted mode”.

For now, encrypted messages can only be sent to one recipient, and Twitter has announced that it will soon expand this feature to group chats. The new function does not support the exchange of media and other files, but only text, links and reactions.

Although the messages themselves are encrypted, the metadata (recipient, creation time, etc.) is not, nor is any associated content (only the links are encrypted, not any content they refer to).

New devices cannot currently join existing encrypted conversations, and if you try to access an existing encrypted conversation on a new device, you’ll see an error message saying the conversation is unavailable on that device. The device will be considered a new device in the context of encrypted messages, if the Twitter application is reinstalled on the device.

Users can register up to 10 devices to send and receive encrypted messages. Once you’ve reached your limit, you won’t be able to send or receive encrypted messages on any new devices signed in to Twitter. Also, users do not have the option to see the list of registered devices or to cancel device registration.

Logging out of Twitter will delete all messages, including encrypted DMs, from your device.

The current architecture “offers no protection against man-in-the-middle attacks” – if someone, for example, a malicious insider or Twitter itself bound by legal process, were to compromise an encrypted conversation, neither the sender nor the receiver would know. Twitter also said that they are working to make such attacks more difficult and even impossible.

Twitter also said that it is currently not possible to report an encrypted message. If you have a problem with an encrypted chat participant, you can report the account itself and the Twitter team will look into it. You also have the option to prevent someone from sending you encrypted messages.

Note that if you delete an encrypted message, it is only deleted from your account, but the recipient will still see the encrypted message or conversation you deleted.