In his quest to turn a simple and functioning Twitter app into X, the everything app that doesn’t do anything very well, Last week, Elon Musk introduced audio and video calling on X, a capability that is turned on by default. it leaks your IP address to anyone you talk with, and it’s incredibly confusing to figure out how to limit who can call you.
The new function was introduced by X's official news account in a post on Wednesday. It read, "Everyone on X can now use voice and video calling! Who are you phoning first? X penned.
We looked at X’s official help center page and ran tests of the feature to analyze how the calling feature works and to understand the risks associated with it.
While an individual's IP address is not very sensitive, high-risk users may find it risky as these online identifiers can be linked to an individual's online activities and used to infer location.
First off, on both iOS and Android, the phone symbol now shows in the upper right corner of the Messages section of the X app, which houses the audio and video calling functionality.
A screenshot of X’s audio and video calling feature on Android. Image Credits:
Calling is enabled by default in the X apps. The caveat is that you can only make and receive calls on X’s app, and not yet in your browser.
Because calls are made directly to the devices of the participants, they are by default peer-to-peer, which implies that both parties share each other's IP addresses. As we noted in November, this is how the majority of messaging and calling applications work, including FaceTime, Facebook Messenger, Telegram, Signal, and WhatsApp.
Calls between users are routed peer-to-peer such that IP addresses "may be visible to the other," according to X's official help center.
If you want to hide your IP address, you can turn on the toggle “Enhanced call privacy” in X’s Message settings. By switching on this setting, X says the call “will be relayed through X infrastructure, and the IP address of any party that has this setting enabled will be masked.”
 |
| A screenshot of the settings for X’s audio and video calling feature for iOS |
X doesn’t mention encryption in the official help center page at all, so the calls are probably not end-to-end encrypted, potentially allowing Twitter to listen in on conversations. End-to-end encrypted apps, Signal or WhatsApp — prevent anyone other than the caller and the recipient from listening in, including WhatsApp and Signal.
We inquired about the presence of end-to-end encryption in X's press email. The only response we received was X's automated default to media inquiries, which is, "Busy now, please check back later." Additionally, we emailed Joe Benarroch, a spokesman for X, but we never heard back.
Because of these privacy risks, we recommend switching off the calling feature completely.
HOW TO KEEP YOUR TWITTER SECURE WITHOUT GIVING ELON MUSK ANY MONEY
If you choose to use this call feature, it's crucial to know who can contact you and who you may call. Depending on your settings, this can become a very complex and confusing process.
The default setting (as you can see above) is “People you follow,” but you can choose to change it to “People in your address book,” if you shared your contacts with X; “Verified users,” which would allow anyone who pays for X to call you; or everyone, if you would like to receive spam calls from any rando.
TechCrunch decided to test several different scenarios with two X accounts: a newly created test account and a long-standing real account. Using open source network analysis tool Burp Suite, we could see the network traffic flowing in and out of the X app.
As of the time of writing, the results are as follows:
- When neither account follows each other, neither account sees the phone icon, and thus neither can call.
- The message is received when the test account DMs the real account, however neither account is able to see the phone icon.
- When the real account accepts the DM, the test account can then call the real account. And if nobody picks up, only the test account caller’s IP is exposed.
- The test account is configured to allow inbound calls for "follow" only, so when it initiates a call and the actual account answers (revealing the real account's IP address, thus both sets of IP addresses), the test account is unable to call back.
- When the real account follows the test account back, both can contact each other.
According to the network analysis, Periscope—a livestreaming service and app from Twitter—was used by X to develop the calling feature before it was shut down in 2021. Our network analysis reveals that even if the call's contents are inaudible, the X app makes it as if it were a live Twitter/X broadcast because X is using Periscope for his calling.
Ultimately, whether to use X calling is your choice. You can do nothing, which potentially exposes you to calls from people you probably don’t want to get calls from and can compromise your privacy. Or you can try to limit who can call you by deciphering X’s settings. Or, you can just switch off the feature altogether and not have to worry about any of this.
Former Twitter CEO sues Elon Musk
Another day, another Elon Musk legal dispute. On Monday, four former Twitter executives—among them the former CEO Parag Agrawal—filed a lawsuit against Musk, claiming they are due more than $128 million in severance pay.
When Musk bought Twitter (now X), one of his very first moves as the company’s owner was to fire Agrawal, CFO Ned Segal, and lawyers Sean Edgett and Vijaya Gadde. According to the lawsuit, Musk has a “special ire” toward these former executives, who worked hard to hold Musk to his $44 billion commitment when he tried to back out. The lawsuit quotes Walter Isaacson’s biography of Elon Musk, which quotes Musk as saying he would “hunt every single one” of Twitter’s C-suite “till the day they die.”
Gadde in particular, who was engaged in a number of well-publicized Twitter content moderation judgments, has drawn harsh criticism from Musk. Following his bid to purchase Twitter, he made fun of the executive with memes, which led to a barrage of hateful comments directed at her on the internet.
It’s not just these executives who haven’t gotten their severance pay. Musk has faced severallawsuits from former Twitter employees who are also waiting for a check. Under Musk’s ownership, the company has stopped paying rent on some of its offices, which has led to even more lawsuits and evictions.
In the case, Musk asserted that these executives had engaged in "willful misconduct" and "gross negligence" in their letters of termination, but he was never able to provide proof to support his claims.
“This is the Musk playbook: to keep the money he owes other people, and force them to sue him,” the lawsuit reads. “Even in defeat, Musk can impose delay, hassle, and expense on others less able to afford it.”