X's audio and video calls, which are on by default, are peer-to-peer, revealing users' IP addresses to each other unless they toggle an enhanced privacy setting
The new X calling feature can hurt your privacy — In his quest to turn a simple and functioning Twitter app into X …
TechCrunch
Context & Ripple Effects
X positioned calling as a way to communicate without exchanging phone numbers, then expanded the feature from a limited rollout to broader availability. The earlier rollout to all users made the default network design relevant to a much larger share of the service.
The feature had already given users controls over who may call them, including an opt-out and caller-permission model. This report adds a separate privacy consideration: what technical information is exposed once a call connects.
First-order effects
People using X calls must enable the enhanced privacy setting if they do not want their IP address shared directly with the other party.
X inherits an immediate trust and usability problem: a safety-relevant control is optional while the peer-to-peer behavior is the default.
Second-order effects
The broader calling rollout means privacy-conscious users may reassess whether to enable calls at all, rather than only narrowing who can contact them.
The distinction between contact permissions and connection privacy raises the burden on X to make call settings and their consequences clearer to users.
Third-order effects
If social platforms continue adding communications features atop public identity networks, privacy defaults—not merely feature availability—will become a central point of product differentiation.
The episode illustrates a persistent trade-off in platform expansion: replacing phone-number-based communication can reduce one form of exposure while introducing network-level exposure unless privacy protections are designed into the default.
The trend: Social platforms are evolving into all-in-one communication services, making network-privacy defaults as consequential as their messaging and calling features.
@citizenlab 6/ So many at-risk activists still use Twitter / X. Their stakes are life, death and liberty as @maasalan rightly points out. By @sanyaburgess https://inews.co.uk/... [image]
Heads up, especially creators, the new X feature to accept calls is turned on and it REVEALS YOUR IP ADDRESS by default! Apparently we are back in the Skype era. Make sure to at least turn on call privacy. [image]
5/ Dictators target dissidents & protesters via Twitter. Pushing a default-on feature with privacy and security risks to everyone's phones is reckless. E.g. our @citizenlab report: https://citizenlab.ca/... [image]
7/ So @lorenzofb & @zackwhittaker took a quick poke at Twitter calling and found... periscope? ft contributing reporting by @CarlyPage_ & @JagmeetS13 https://techcrunch.com/... [image]
Instantly opted out - why is this option-in by default?! A security nightmare: “Important context for safety: by default, calls are enabled & every call reveals both users' IP addresses to each other. Users who wish to keep IPs private must change their privacy settings.”
4/ A gentle personal plea to @XSecurity: P2p calling & chat apps = *super* heavily targeted for 0click dev b/c of discoverability, ubiquity, complex call stack, etc... Given your high profile+risk users, please prioritize actively monitoring for exploit dev + targeting.
2/ Security side: Adding a call stack = big new attack surface. In the context of X's gutted security teams, you have a recipe for trouble. There's a reason device-to-device call apps are heavily targeted by sophisticated attackers. Story @iblametom https://www.forbes.com/... [im…
PRIVACY ISSUE! I actually can't believe this is real but X has made it so people can call you via your account. Doing so reveals your IP address. To turn this off, go to your DMs, hit the settings cough and then toggle the option off: [image]
PROTECT YOUR PRIVACY: turn off Twitter calls. The feature was just enabled for everyone. Cue spam, harassment & privacy risks. Troublingly, the feature exposes your IP address in calls. PICS: instructions on how to turn it off. Via: https://www.tomsguide.com/... [image]