> This is technically wrong or badly worded Could you explain why? > Is it just saying since you run their software on your device they could steal your priva

> This is technically wrong or badly worded Could you explain why? > Is it just saying since you run their software on your device they could steal your private key? No. It's saying that because there's no indication of which keys the conversation key is being sent to, if Twitter added an additional public key to a users's set of registered keys, anyone who initiated a DM with that user would have no way of knowing that they were sending a copy of the conversation key to Twitter. This doesn't involve any modification of the client code.