Elon Musk spent his Friday reposting criticism of competitors after the launch of the XChat app, a standalone messaging option for X users. “Signal, WhatsApp, Telegram, and iMessage all have serious security problems,” read a message Musk reposted, in part. “XChat is the only secure, encrypted messaging app.” Encryption experts I spoke with in the lead-up to this launch expressed cautious skepticism about XChat’s execution and defended other communication platforms, like Signal, as solid choices.
One of XChat’s red flags is that users must connect an existing X account to log in and start messaging. “I’m a little suspicious of that, because the more data points you connect together about a person, the more you can track what they’re doing,” says Maria Villegas Bravo, counsel at the Electronic Privacy Information Center. Bravo considers Musk’s past attacks on other apps to be worrisome and self-serving.
Last year, when Musk unveiled XChat as a revamped, encrypted version of direct messages on X, security experts questioned the effectiveness of storing users’ cryptographic keys on X’s servers rather than on-device, as Signal does. “Given XChat’s history of security vulnerabilities, I would hesitate to use this until it’s received a thorough outside auditing,” says Cooper Quintin, a senior staff technologist at the Electronic Frontier Foundation.
While Musk wants the discussion to be over which encrypted messaging app is the best—XChat vs. Signal vs. WhatsApp—that’s the wrong comparison. After downloading XChat and going hands-on, there’s another, much less sexy, chat app it reminds me of: Facebook’s Messenger. That app you may have on your phone out of an obligation to message your grandma occasionally? Exactly. Rather than launching a sleek, new encrypted messaging app, Musk dropped an insular, junky extension of his social media platform that happens to include encrypted messaging.
Late Launch
When the XChat team posted earlier this month about the app’s wide release, the “expected” launch date listed on Apple’s App Store page was April 17. This date shifted multiple times before release, changing from the original date to April 23, then April 24. The app also showed April 25 and April 27 as potential launch dates, before it dropped unexpectedly on Friday the 24th. (An official launch date for Android has yet to be announced.)
During this prelaunch period, the right app didn’t always appear when searching for its name. An app that also bore the name “XChat App,” though with a Russian-language design and no connection to Musk, rose to at least the seventh spot on Apple’s free download charts in the social media category. “Scam app,” read one user review, “This is not the real XChat.”
When the XChat app eventually arrived, the launch seemed haphazard. At first, folks in the US could access the app, while those in the UK could not. “UK should be live soon; had one snag,” wrote Nikita Bier, the head of product at X, in response to frustrated posters on social media. When early downloaders also complained about confusion during the onboarding process, Bier told them to “blame Apple” and its app requirements.
First Impressions
When I first downloaded the XChat app, I wasn’t sure who to message first. Looking through my iMessage history, none of the top five friends and family members that I text the most often even have X accounts. So, right at the top, XChat felt too niche for my actual messaging needs, putting aside any encryption concerns.
Lost and trying to find someone, anyone to message on XChat, I spent my afternoon scrolling through old DMs and decided to reignite three previous chats. After I sent my nudges, a pop-up appeared in the chat logs, “This conversation is now end-to-end encrypted.” Though I didn’t really need it because no one texted me back while I was testing the XChat app—I only received pitiful heart and flame emoji reactions to my messages.
