Open Whisper Systems Explained

Open Whisper Systems
Abbreviation:	OWS
Successor:	Signal Technology Foundation
Founder:	Moxie Marlinspike
Dissolved:	^[1]
Vat Id:	(for European organizations) -->
Purpose:	Software development
Location:	San Francisco, CA^[2]
Products:	Signal, Signal Protocol
Fields:	Free and open-source software, Cryptography, Mobile software
Owners:	-->
Staff:	2–6^[3]

Open Whisper Systems (abbreviated OWS^[4]) was a software development group that was founded by Moxie Marlinspike in 2013. The group picked up the open source development of TextSecure and RedPhone, and was later responsible for starting the development of the Signal Protocol^[5] and the Signal messaging app. In 2018, Signal Messenger was incorporated as an LLC by Moxie Marlinspike and Brian Acton and then rolled under the independent 501c3 non-profit Signal Technology Foundation. Today, the Signal app is developed by Signal Messenger LLC, which is funded by the Signal Technology Foundation.

History

2010–2013: Background

Security researcher Moxie Marlinspike and roboticist Stuart Anderson co-founded a startup company called Whisper Systems in 2010. The company produced proprietary enterprise mobile security software. Among these were an encrypted texting program called TextSecure and an encrypted voice calling app called RedPhone. They also developed a firewall and tools for encrypting other forms of data.

In November 2011, Whisper Systems announced that it had been acquired by Twitter. The financial terms of the deal were not disclosed by either company. The acquisition was done "primarily so that Mr. Marlinspike could help the then-startup improve its security".^[6] Shortly after the acquisition, Whisper Systems' RedPhone service was made unavailable. Some criticized the removal, arguing that the software was "specifically targeted [to help] people under repressive regimes" and that it left people like the Egyptians in "a dangerous position" during the events of the 2011 Egyptian revolution.

Twitter released TextSecure as free and open-source software under the GPLv3 license in December 2011. RedPhone was also released under the same license in July 2012. Marlinspike later left Twitter and founded Open Whisper Systems as a collaborative open source project for the continued development of TextSecure and RedPhone.

2013–2018: Open Whisper Systems

Marlinspike launched Open Whisper Systems' website in January 2013.

In February 2014, Open Whisper Systems introduced the second version of their TextSecure Protocol (now Signal Protocol), which added end-to-end encrypted group chat and instant messaging capabilities to TextSecure.^[7] Toward the end of July 2014, Open Whisper Systems announced plans to unify its RedPhone and TextSecure applications as Signal. These announcements coincided with the initial release of Signal as a RedPhone counterpart for iOS. The developers said that their next steps would be to provide TextSecure instant messaging capabilities for iOS, unify the RedPhone and TextSecure applications on Android, and launch a web client. Signal was the first iOS app to enable easy, strongly encrypted voice calls for free. TextSecure compatibility was added to the iOS application in March 2015.

On 18 November 2014, Open Whisper Systems announced a partnership with WhatsApp to provide end-to-end encryption by incorporating the Signal Protocol into each WhatsApp client platform. Open Whisper Systems said that they had already incorporated the protocol into the latest WhatsApp client for Android and that support for other clients, group/media messages, and key verification would be coming soon after. WhatsApp confirmed the partnership to reporters, but there was no announcement or documentation about the encryption feature on the official website, and further requests for comment were declined. On 5 April 2016, WhatsApp and Open Whisper Systems announced that they had finished adding end-to-end encryption to "every form of communication" on WhatsApp, and that users could now verify each other's keys.^{[8] [9]} In September 2016, Google launched a new messaging app called Allo, which features an optional "incognito mode" that uses the Signal Protocol for end-to-end encryption.^{[10] [11]} In October 2016, Facebook deployed an optional mode called "secret conversations" in Facebook Messenger mobile apps which provides end-to-end encryption using an implementation of the Signal Protocol.^{[12] [13] [14]}

In November 2015, the TextSecure and RedPhone applications on Android were merged to become Signal for Android.^[15] A month later, Open Whisper Systems announced Signal Desktop, a Chrome app that could link with a Signal client.^[16] At launch, the app could only be linked with the Android version of Signal. On 26 September 2016, Open Whisper Systems announced that Signal Desktop could now be linked with the iOS version of Signal as well.^[17] On 31 October 2017, Open Whisper Systems announced that the Chrome app was deprecated. At the same time, they announced the release of a standalone desktop client for certain Windows, MacOS and Linux distributions.^[18]

On 4 October 2016, the American Civil Liberties Union (ACLU) and Open Whisper Systems published a series of documents revealing that OWS had received a subpoena requiring them to provide information associated with two phone numbers for a federal grand jury investigation in the first half of 2016.^{[19] [20] [21]} Only one of the two phone numbers was registered on Signal, and because of how the service is designed, OWS was only able to provide "the time the user’s account had been created and the last time it had connected to the service".^{[20] [19]} Along with the subpoena, OWS received a gag order requiring OWS not to tell anyone about the subpoena for one year.^[19] OWS approached the ACLU, and they were able to lift part of the gag order after challenging it in court.^[19] OWS said it was the first time they had received a subpoena, and that they were committed to treat "any future requests the same way".^[21]

2018–present: Signal Foundation

See main article: Signal Foundation, Signal Protocol and Signal (messaging app).

On February 21, 2018, Moxie Marlinspike and WhatsApp co-founder Brian Acton announced the formation of the Signal Foundation, a 501(c)(3) non-profit organization whose mission is "to support, accelerate, and broaden Signal’s mission of making private communication accessible and ubiquitous."^[22] The foundation was started with an initial $50 million in funding from Acton, who had left WhatsApp's parent company Facebook in September 2017.^[23] According to the announcement, Acton is the foundation's executive chairman and Marlinspike continued as CEO of Signal Messenger.^[22] The Freedom of the Press Foundation agreed to continue accepting donations on behalf of Signal while the Signal Foundation's non-profit status was pending. The Signal Foundation became officially tax-exempt in February 2019.

Funding

In May 2014, Moxie Marlinspike said that "Open Whisper Systems is a project rather than a company, and the project's objective is not financial profit."^[24] News media outlets later described Open Whisper Systems as a "non-profit software group" while the project was not registered as a non-profit organization.^{[25] [22]} Between 2013 and 2016, Open Whisper Systems received grants from the Shuttleworth Foundation, the Knight Foundation, and the Open Technology Fund.

Signal Messenger was initially funded by donations through the Freedom of the Press Foundation,^{[25] [26]} which acted as Signal Messenger's fiscal sponsor while the Signal Foundation's non-profit status was pending.^[27] The Signal Foundation is officially tax-exempt as of February 2019.^[28]

In January 2021, the tech billionaire Elon Musk tweeted his support for the Signal app with two words "Use Signal", showing his favor for the app as an alternative to WhatsApp. Musk doubled down stating he had financially supported Signal in the past and that he will continue to do so.^[29] In addition to other platform mass migrations, Signal saw a large influx of new users and user donations.

Reception

Former NSA contractor Edward Snowden endorsed Open Whisper Systems applications, including during an interview with The New Yorker in October 2014, and during a remote appearance at an event hosted by Ryerson University and Canadian Journalists for Free Expression, in March 2015. Asked about encrypted messaging apps during a Reddit AMA in May 2015, he recommended "Signal for iOS, Redphone/TextSecure for Android". In November 2015, Snowden tweeted that he used Signal "every day".^[30]

In October 2014, the Electronic Frontier Foundation (EFF) included TextSecure, RedPhone, and Signal in their updated Surveillance Self-Defense (SSD) guide. In November 2014, all three received top scores on the EFF's Secure Messaging Scorecard, along with Cryptocat, Silent Phone, and Silent Text. They received points for having communications encrypted in transit, having communications encrypted with keys the providers don't have access to (end-to-end encryption), making it possible for users to independently verify their correspondent's identities, having past communications secure if the keys are stolen (forward secrecy), having their code open to independent review (open source), having their security designs well-documented, and having recent independent security audits.

On 28 December 2014, Der Spiegel published slides from an internal NSA presentation dating to June 2012 in which the NSA deemed RedPhone on its own as a "major threat" to its mission, and when used in conjunction with other privacy tools such as Cspace, Tor, Tails, and TrueCrypt was ranked as "catastrophic," leading to a "near-total loss/lack of insight to target communications, presence..."

Projects

Over its five-year existence from 2013 to 2018, the Open Whisper Systems group managed multiple projects, which included:^[31]

• Signal: An instant messaging, voice calling and video calling^[32] application for Android, iOS and desktop.^[33] It uses end-to-end encryption protocols to secure all communications to other Signal users. Signal can be used to send end-to-end encrypted group messages, attachments and media messages to other Signal users. The app uses 4 encryption algorithms to encrypt all text and media sent to and from the app: XEdDSA and VXEdDSA, Double Ratchet, X3DH, and Sesame. All calls are made over a Wi-Fi or data connection and are free of charge, including long distance and international. Signal has a built-in mechanism for verifying that no man-in-the-middle attack has occurred. Signal Messenger has set up dozens of servers to handle the encrypted calls in more than 10 countries around the world to minimize latency. The clients are published under the GPLv3 license.
• Signal Protocol: A non-federated cryptographic protocol that can be used to provide end-to-end encryption. It combines the Double Ratchet algorithm, prekeys, and a 3-DH handshake. Signal Messenger maintains several open source Signal Protocol libraries on GitHub.^{[34] [35] [36] [37]}
• Signal Server: The software is published under the AGPLv3 license.
• Contact Discovery Service: A microservice that "allows clients to discover which of their contacts are registered users, but does not reveal their contacts to the service operator or any party that may have compromised the service." The software is published under the AGPLv3 license.^[38], the service is in beta.^{[39] [40]}

Some of these projects were discontinued or merged into other projects:

• BitHub: A service that would automatically pay a percentage of Bitcoin funds for every submission to a GitHub repository.^{[41] [42]}
• Flock: A service that synced calendar and contact information on Android devices. Users had the ability to host their own server. The developer cited technological choices that led to high server costs as a reason for discontinuing the service.^[43] Flock was discontinued 1 October 2015, but its source code is still available on GitHub under the GPLv3 license.

• RedPhone: A stand-alone application for encrypted voice calling on Android. RedPhone integrated with the system dialler to make calls, but used ZRTP to set up an end-to-end encrypted VoIP channel for the actual call. RedPhone was designed specifically for mobile devices, using audio codecs and buffer algorithms tuned to the characteristics of mobile networks, and used push notifications to preserve the user's device's battery life while still remaining responsive. RedPhone was merged into TextSecure on 2 November 2015.^[15] TextSecure was then renamed as Signal for Android.^[15] RedPhone's source code was available under the GPLv3 license.

• TextSecure: A stand-alone application for encrypted messaging on Android. TextSecure could be used to send and receive SMS, MMS, and instant messages. It used end-to-end encryption with forward secrecy and deniable authentication to secure all instant messages to other TextSecure users. TextSecure was merged with RedPhone to become Signal for Android,^[15] but lost its ability to encrypt SMS. The source code is available under the GPLv3 license.

See also

• Comparison of instant messaging clients
• Comparison of VoIP software
• Internet privacy
• List of free and open-source software organizations
• Secure communication

Literature

• Nik . Unger . Sergej . Dechand . Joseph . Bonneau . Sascha . Fahl . Henning . Perl . Ian Avrum . Goldberg . Matthew . Smith . SoK: Secure Messaging . IEEE Computer Society's Technical Committee on Security and Privacy . Proceedings of the 2015 IEEE Symposium on Security and Privacy . 2015 . 232–249 . 10.1109/SP.2015.22 .

Notes and References

1. Web site: Signal Technology Foundation . OpenCorporates . Delaware Department of State: Division of Corporations . 13 February 2019 . 15 July 2018.
2. Web site: Lee. Micah. Battle of the Secure Messaging Apps: How Signal Beats WhatsApp. The Intercept. First Look Media. 17 July 2016. 22 June 2016.
3. Marlinspike . Moxie . Devin Coldewey . Moxie Marlinspike: Trust No One . 3:50 . Oath Inc. . San Francisco, CA . 18 September 2017 . TechCrunch Disrupt SF 2017 . 19 September 2017.
4. Web site: Signal Privacy Policy. Open Whisper Systems. 31 January 2018. 31 January 2018. https://web.archive.org/web/20180131182045/https://signal.org/signal/privacy/. dead.
5. TextSecure Protocol: Present and Future. 9 June 2015. Perrin, Trevor. NorthSec. 0:21. 24 September 2016. Video.
6. News: Yadron. Danny. Moxie Marlinspike: The Coder Who Encrypted Your Texts. 10 July 2015. The Wall Street Journal. 9 July 2015. 12 July 2015. https://web.archive.org/web/20150712035634/https://www.wsj.com/articles/moxie-marlinspike-the-coder-who-encrypted-your-texts-1436486274. live.
7. Web site: 24 February 2014 . Brian . Donohue . TextSecure Sheds SMS in Latest Version . Threatpost . 14 July 2016 . 15 February 2017 . https://web.archive.org/web/20170215020451/https://threatpost.com/textsecure-sheds-sms-in-latest-version/104456/ . live .
8. Metz. Cade. Forget Apple vs. the FBI: WhatsApp Just Switched on Encryption for a Billion People. Wired. Condé Nast. 5 April 2016. 5 April 2016. 5 April 2016. https://web.archive.org/web/20160405164942/http://www.wired.com/2016/04/forget-apple-vs-fbi-whatsapp-just-switched-encryption-billion-people/. live.
9. Web site: Lomas. Natasha. WhatsApp completes end-to-end encryption rollout. TechCrunch. AOL Inc.. 5 April 2016. 5 April 2016. 6 April 2016. https://web.archive.org/web/20160406010346/http://techcrunch.com/2016/04/05/whatsapp-completes-end-to-end-encryption-rollout/. live.
10. Greenberg. Andy. With Allo and Duo, Google Finally Encrypts Conversations End-to-End. Wired. Condé Nast. 18 May 2016. 14 July 2016. 2 February 2017. https://web.archive.org/web/20170202161556/https://www.wired.com/2016/05/allo-duo-google-finally-encrypts-conversations-end-end/. live.
11. Web site: Gibbs. Samuel. Google launches WhatsApp competitor Allo – with Google Assistant. The Guardian. 21 September 2016. 21 September 2016. 7 January 2019. https://web.archive.org/web/20190107054254/https://www.theguardian.com/technology/2016/sep/21/google-whatsapp-allo-google-assistant. live.
12. Web site: Isaac. Mike. Facebook to Add 'Secret Conversations' to Messenger App. The New York Times. 14 July 2016. 8 July 2016. 12 July 2016. https://web.archive.org/web/20160712043038/http://www.nytimes.com/2016/07/09/technology/facebook-messenger-app-encryption.html. live.
13. Greenberg. Andy. 'Secret Conversations:' End-to-End Encryption Comes to Facebook Messenger. Wired. Condé Nast. 14 July 2016. 8 July 2016. 11 July 2016. https://web.archive.org/web/20160711073318/https://www.wired.com/2016/07/secret-conversations-end-end-encryption-facebook-messenger-arrived/. live.
14. Greenberg. Andy. You Can All Finally Encrypt Facebook Messenger, So Do It. Wired. Condé Nast. 5 October 2016. 4 October 2016. 15 April 2017. https://web.archive.org/web/20170415004558/https://www.wired.com/2016/10/facebook-completely-encrypted-messenger-update-now. live.
15. Greenberg. Andy. Signal, the Snowden-Approved Crypto App, Comes to Android. Wired. Condé Nast. 22 March 2016. 2 November 2015. 26 January 2018. https://web.archive.org/web/20180126050207/https://www.wired.com/2015/11/signals-snowden-approved-phone-crypto-app-comes-to-android/. live.
16. Web site: Franceschi-Bicchierai. Lorenzo. Snowden's Favorite Chat App Is Coming to Your Computer. Motherboard. Vice Media LLC. 4 December 2015. 2 December 2015. 5 December 2015. https://web.archive.org/web/20151205073848/http://motherboard.vice.com/read/signal-snowdens-favorite-chat-app-is-coming-to-your-computer. live.
17. Web site: Marlinspike. Moxie. Desktop support comes to Signal for iPhone. Open Whisper Systems. 26 September 2016. 26 September 2016. 7 July 2017. https://web.archive.org/web/20170707095128/https://whispersystems.org/blog/signal-desktop-ios/. live.
18. Web site: Nonnenberg. Scott. Standalone Signal Desktop. Open Whisper Systems. 31 October 2017. 31 October 2017. 15 February 2020. https://web.archive.org/web/20200215121725/https://signal.org/blog/standalone-signal-desktop/. live.
19. Web site: Perlroth. Nicole. Benner. Katie. Subpoenas and Gag Orders Show Government Overreach, Tech Companies Argue. The New York Times. 4 October 2016. 4 October 2016. 24 January 2020. https://web.archive.org/web/20200124010809/https://www.nytimes.com/2016/10/05/technology/subpoenas-and-gag-orders-show-government-overreach-tech-companies-argue.html. live.
20. Web site: Kaufman. Brett Max. New Documents Reveal Government Effort to Impose Secrecy on Encryption Company. American Civil Liberties Union. Blog post. 4 October 2016. 4 October 2016. 25 July 2017. https://web.archive.org/web/20170725085001/https://www.aclu.org/blog/free-future/new-documents-reveal-government-effort-impose-secrecy-encryption-company. live.
21. Web site: Grand jury subpoena for Signal user data, Eastern District of Virginia. Open Whisper Systems. 4 October 2016. 4 October 2016. 29 August 2017. https://web.archive.org/web/20170829091039/https://whispersystems.org/bigbrother/eastern-virginia-grand-jury/. live.
22. Web site: Marlinspike. Moxie. Acton. Brian. Signal Foundation. Signal.org. 21 February 2018. 21 February 2018. 16 February 2020. https://web.archive.org/web/20200216021349/https://signal.org/blog/signal-foundation/. live.
23. Greenberg. Andy. WhatsApp Co-Founder Puts $50M Into Signal To Supercharge Encrypted Messaging. Wired. Condé Nast. 21 February 2018. 21 February 2018. 22 February 2018. https://web.archive.org/web/20180222022309/https://www.wired.com/story/signal-foundation-whatsapp-brian-acton/. live.
24. Web site: Marlinspike. Moxie. What is TextSecure's business model?. Hacker News. 4 February 2017. 6 May 2014. 5 February 2017. https://web.archive.org/web/20170205095539/https://news.ycombinator.com/item?id=7701666. live.
25. Web site: O'Neill. Patrick. How Tor and Signal can maintain the fight for freedom in Trump's America. CyberScoop. Scoop News Group. 25 January 2017. 3 January 2017. 17 September 2017. https://web.archive.org/web/20170917033354/https://www.cyberscoop.com/tor-signal-funding-donald-trump-steve-bannon-encryption/. live.
26. Web site: Kolenkina. Masha. How can I donate?. Signal Support Center. Open Whisper Systems. 31 January 2018. 30 January 2018. https://web.archive.org/web/20180130032505/https://support.signal.org/hc/en-us/articles/212940158-How-can-I-donate-. dead.
27. Web site: Timm. Trevor. Freedom of the Press Foundation's new look, and our plans to protect press freedom for 2017. Freedom of the Press Foundation. 25 January 2017. 8 December 2016. 2 February 2017. https://web.archive.org/web/20170202042832/https://freedom.press/news/freedom-press-foundations-new-look-and-our-plans-protect-press-freedom-2017/. live.
28. Web site: Signal Technology Foundation . Nonprofit Explorer . 9 May 2013 . Pro Publica Inc. . 7 June 2019 . 9 January 2021 . https://web.archive.org/web/20210109161310/https://projects.propublica.org/nonprofits/organizations/824506840 . live .
29. News: Robles. CJ. January 12, 2021. Elon Musk Promises to 'Donate More' Funds to Signal App After Last Week's Stocks Fiasco. Tech Times. January 29, 2021.
30. Barrett. Brian. Apple Hires Lead Dev of Snowden's Favorite Messaging App. Wired. Condé Nast. 2 March 2016. 25 February 2016. 29 February 2016. https://web.archive.org/web/20160229021922/http://www.wired.com/2016/02/apple-hires-lead-dev-snowdens-favorite-messaging-app/. live.
31. Web site: Signal . GitHub . 13 February 2019 . 2 February 2019 . https://web.archive.org/web/20190202034433/https://github.com/signalapp . live .
32. Web site: Mott. Nathaniel. Signal's Encrypted Video Calling For iOS, Android Leaves Beta. Tom's Hardware. Purch Group, Inc.. 14 March 2017. 14 March 2017.
33. Web site: Coldewey. Devin. Signal escapes the confines of the browser with a standalone desktop app. TechCrunch. Oath Tech Network. 31 October 2017. 31 October 2017. 14 May 2019. https://web.archive.org/web/20190514155929/https://techcrunch.com/2017/10/31/signal-escapes-the-confines-of-the-browser-with-a-standalone-desktop-app/. live.
34. Web site: libsignal-protocol-c . Signal Messenger LLC . GitHub . 13 February 2019 . 12 November 2020 . https://web.archive.org/web/20201112000826/https://github.com/signalapp/libsignal-protocol-c . live .
35. Web site: libsignal-protocol-java. GitHub. Signal Messenger LLC. 13 February 2019. 21 November 2020. https://web.archive.org/web/20201121073134/https://github.com/signalapp/libsignal-protocol-java. live.
36. Web site: libsignal-protocol-javascript. GitHub. Signal Messenger LLC. 25 September 2016. 12 November 2020. https://web.archive.org/web/20201112015236/https://github.com/signalapp/libsignal-protocol-javascript. live.
37. Web site: libsignal-client . GitHub . Signal Messenger LLC . 24 December 2020 . 8 January 2021 . https://web.archive.org/web/20210108104702/https://github.com/signalapp/libsignal-client . live .
38. Web site: Contact Discovery Service. GitHub. Open Whisper Systems. 28 September 2017. 26 June 2018. https://web.archive.org/web/20180626223429/https://github.com/signalapp/ContactDiscoveryService. live.
39. Web site: Marlinspike. Moxie. Technology preview: Private contact discovery for Signal. Open Whisper Systems. 28 September 2017. 26 September 2017. 28 September 2017. https://web.archive.org/web/20170928043707/https://signal.org/blog/private-contact-discovery/. live.
40. Greenberg. Andy. Signal Has a Fix for Apps' Contact-Leaking Problem. Wired. Condé Nast. 28 September 2017. 26 September 2017. 27 September 2017. https://web.archive.org/web/20170927143335/https://www.wired.com/story/signal-contact-lists-private-secure-enclave. live.
41. Finley. Klint. Love Child of Bitcoin and GitHub Pays Cash for Code. Wired. Condé Nast. 22 September 2015. 17 December 2013. 18 September 2015. https://web.archive.org/web/20150918073105/http://www.wired.com/2013/12/bithub. live.
42. Web site: Marlinspike. Moxie. Rizzio. Nicholas. Remove the last references to BitHub and Coinbase. GitHub. 31 January 2018. 11 November 2017. 9 January 2021. https://web.archive.org/web/20210109161433/https://github.com/signalapp/Signal-Android/commit/99ea6f98126ed502915ab377c13af422647915de. live.
43. Web site: RE: Flock shutting down. GitHub Gist. rhodey. 16 July 2015. 8 September 2015. 29 September 2015. https://web.archive.org/web/20150929130810/https://gist.github.com/rhodey/873ae9d527d8d2a38213. live.