Open Whisper Systems

Not to be confused with Whisper Systems, a company that was acquired by Twitter, or Whisper, a product of WhisperText LLC.
Open Whisper Systems
Abbreviation OWS
Formation January 21, 2013 (2013-01-21)[1]
Founder Moxie Marlinspike[2]
Type Nonprofit[3][2]
Purpose Software development[2]
Location
Products Signal, Signal Protocol
Fields Free and open-source software, Cryptography, Mobile software
Staff
3[4]
Website whispersystems.org

Open Whisper Systems (informally abbreviated OWS[5]) is a nonprofit software group that was founded by Moxie Marlinspike in 2013. Their main focus is the development of the Signal Protocol.[6] They also maintain an encrypted voice calling and instant messaging application called Signal. The group is funded by a combination of donations and grants, and all of its products are published as free and open-source software.

History

Background

Security researcher Moxie Marlinspike and roboticist Stuart Anderson co-founded a startup company called Whisper Systems in 2010.[7][8] The company produced proprietary enterprise mobile security software. Among these were an encrypted texting program called TextSecure and an encrypted voice calling app called RedPhone.[9] They also developed a firewall and tools for encrypting other forms of data.[7]

In November 2011, Whisper Systems announced that it had been acquired by Twitter. The financial terms of the deal were not disclosed by either company.[10] The acquisition was done "primarily so that Mr. Marlinspike could help the then-startup improve its security".[11] Shortly after the acquisition, Whisper Systems' RedPhone service was made unavailable.[12] Some criticized the removal, arguing that the software was "specifically targeted [to help] people under repressive regimes" and that it left people like the Egyptians in "a dangerous position" during the events of the 2011 Egyptian revolution.[13]

Twitter released TextSecure as free and open-source software under the GPLv3 license in December 2011.[7][14][15][16] RedPhone was also released under the same license in July 2012.[17] Marlinspike later left Twitter and founded Open Whisper Systems as a collaborative open source project for the continued development of TextSecure and RedPhone.[3][1]

2013–present

Marlinspike launched Open Whisper Systems' website in January 2013.[2][1]

In February 2014, Open Whisper Systems introduced the second version of their TextSecure Protocol (now Signal Protocol), which added end-to-end encrypted group chat and instant messaging capabilities to TextSecure.[18] Toward the end of July 2014, Open Whisper Systems announced plans to unify its RedPhone and TextSecure applications as Signal.[19] These announcements coincided with the initial release of Signal as a RedPhone counterpart for iOS. The developers said that their next steps would be to provide TextSecure instant messaging capabilities for iOS, unify the RedPhone and TextSecure applications on Android, and launch a web client.[20] Signal was the first iOS app to enable easy, strongly encrypted voice calls for free.[3][21] TextSecure compatibility was added to the iOS application in March 2015.[22][23]

On November 18, 2014, Open Whisper Systems announced a partnership with WhatsApp to provide end-to-end encryption by incorporating the Signal Protocol into each WhatsApp client platform.[24] Open Whisper Systems said that they had already incorporated the protocol into the latest WhatsApp client for Android and that support for other clients, group/media messages, and key verification would be coming soon after.[25] WhatsApp confirmed the partnership to reporters, but there was no announcement or documentation about the encryption feature on the official website, and further requests for comment were declined.[26] On April 5, 2016, WhatsApp and Open Whisper Systems announced that they had finished adding end-to-end encryption to "every form of communication" on WhatsApp, and that users could now verify each other's keys.[27][28] In September 2016, Google launched a new messaging app called Allo, which features an optional "incognito mode" that uses the Signal Protocol for end-to-end encryption.[29][30] In October 2016, Facebook deployed an optional mode called "secret conversations" in Facebook Messenger which provides end-to-end encryption using an implementation of the Signal Protocol.[31][32][33]

In November 2015, the TextSecure and RedPhone applications on Android were merged to become Signal for Android.[34] A month later, Open Whisper Systems announced Signal Desktop, a Chrome app that can link with a Signal client.[35] At launch, the app could only be linked with the Android version of Signal.[35] On September 26, 2016, Open Whisper Systems announced that Signal Desktop could now be linked with the iOS version of Signal as well.[36]

On October 4, 2016, the American Civil Liberties Union (ACLU) and Open Whisper Systems published a series of documents revealing that OWS had received a subpoena requiring them to provide information associated with two phone numbers for a federal grand jury investigation in the first half of 2016.[37][38][39] Only one of the two phone numbers was registered on Signal, and because of how the service is designed, OWS was only able to provide "the time the user’s account had been created and the last time it had connected to the service".[38][37] Along with the subpoena, OWS received a gag order requiring OWS not to tell anyone about the subpoena for one year.[37] OWS approached the ACLU, and they were able to lift part of the gag order after challenging it in court.[37] OWS said it was the first time they had received a subpoena, and that they were committed to treat "any future requests the same way".[39]

Funding

Open Whisper Systems is funded by a combination of donations and grants. As of October 2016, the project has received an unknown amount of donations from individual sponsors via the Freedom of the Press Foundation.[40] The following table lists organizations that Open Whisper Systems has received grants from:

Organization Time period Amount
Shuttleworth Foundation 2013–2014 $289,487.18[41]
Knight Foundation 2014–2015 $416,000.00[42]
Open Technology Fund 2013–2015 $2,255,000.00[43]

Open Whisper Systems uses a system called BitHub to distribute small donations appropriately among contributors. The system automatically pays a percentage of Bitcoin funds for every submission to one of Open Whisper Systems' GitHub repositories.[21][44]

Reception

Former NSA contractor Edward Snowden has endorsed Open Whisper Systems' applications on multiple occasions. In his keynote speech at SXSW in March 2014, he praised TextSecure and RedPhone for their ease-of-use.[45] During an interview with The New Yorker in October 2014, he recommended using "anything from Moxie Marlinspike and Open Whisper Systems".[46] During a remote appearance at an event hosted by Ryerson University and Canadian Journalists for Free Expression in March 2015, Snowden said that Signal is "very good" and that he knew the security model.[47] Asked about encrypted messaging apps during a Reddit AMA in May 2015, he recommended “Signal for iOS, Redphone/TextSecure for Android”.[48][49] In November 2015, Snowden tweeted that he used Signal "every day".[50]

In October 2014, the Electronic Frontier Foundation (EFF) included TextSecure, RedPhone, and Signal in their updated Surveillance Self-Defense (SSD) guide.[51] In November 2014, all three received top scores on the EFF's Secure Messaging Scorecard, along with Cryptocat, Silent Phone, and Silent Text.[52] They received points for having communications encrypted in transit, having communications encrypted with keys the providers don't have access to (end-to-end encryption), making it possible for users to independently verify their correspondent's identities, having past communications secure if the keys are stolen (forward secrecy), having their code open to independent review (open source), having their security designs well-documented, and having recent independent security audits.[52]

On December 28, 2014, Der Spiegel published slides from an internal NSA presentation dating to June 2012 in which the NSA deemed RedPhone on its own as a "major threat" to its mission, and when used in conjunction with other privacy tools such as Cspace, Tor, Tails, and TrueCrypt was ranked as "catastrophic," leading to a "near-total loss/lack of insight to target communications, presence..."[53][54]

Projects

Active

Open Whisper Systems' active projects include:[55]

BitHub
A service that will automatically pay a percentage of Bitcoin funds for every submission to a GitHub repository.[56][57]
Signal for iOS and Android, respectively.
Signal
An instant messaging and voice calling application for iOS and Android. It uses end-to-end encryption protocols to secure all communications to other Signal users.[23][52] Signal can be used to send end-to-end encrypted group messages, attachments and media messages to other Signal users. All calls are made over a Wi-Fi or data connection and are free of charge, including long distance and international.[21] Signal has built-in mechanisms for verifying that no man-in-the-middle attack has occurred. During a call, the app displays two words (selected from the PGP word list) on the screen. If the words match on both ends of the call, the call is secure.[21][58] Open Whisper Systems has set up dozens of servers to handle the encrypted calls in more than 10 countries around the world to minimize latency.[3] The clients are published under the GPLv3 license.[59][60][61]
Signal Desktop
A Chrome app that can link with a Signal client.[35] The software is published under the GPLv3 license.[61]
Signal Protocol
A non-federated cryptographic protocol that combines the Double Ratchet Algorithm, prekeys, and a 3-DH handshake.[62] Open Whisper Systems maintains the following Signal Protocol libraries:
  • libsignal-protocol-c: A library written in C and published under the GPLv3 license with additional permissions for Apple's App Store.[63]
  • libsignal-protocol-java: A library written in Java and published under the GPLv3 license.[64]
  • libsignal-protocol-javascript: A library written in JavaScript and published under the GPLv3 license.[65]
Signal-Server
The software is published under the AGPLv3 license.[66]

Discontinued

Open Whisper Systems' discontinued or merged projects include:

Flock
A service that synced calendar and contact information on Android devices. Users had the ability to host their own server. The developer cited technological choices that lead to high server costs as a reason for discontinuing the service.[67] Flock was discontinued October 1, 2015, but its source code is still available on GitHub under the GPLv3 license.[68]
RedPhone
RedPhone
A stand-alone application for encrypted voice calling on Android. RedPhone integrated with the system dialer to make calls, but used ZRTP to set up an end-to-end encrypted VoIP channel for the actual call. RedPhone was designed specifically for mobile devices, using audio codecs and buffer algorithms tuned to the characteristics of mobile networks, and used push notifications to preserve the user's device's battery life while still remaining responsive.[69] RedPhone was merged into TextSecure on November 2, 2015.[34] TextSecure was then renamed as Signal for Android.[34] RedPhone's source code was available under the GPLv3 license.[69]
TextSecure
A stand-alone application for encrypted messaging on Android.[70][71] TextSecure could be used to send and receive SMS, MMS, and instant messages.[72] It used end-to-end encryption with forward secrecy and deniable authentication to secure all instant messages to other TextSecure users.[52][71][73][74] TextSecure was merged with RedPhone to become Signal for Android.[34] The source code is available under the GPLv3 license.[70]

See also

References

  1. 1 2 3 "A New Home". Open Whisper Systems. 2013-01-21. Retrieved 2014-03-01.
  2. 1 2 3 4 Franceschi-Bicchierai, Lorenzo (18 November 2014). "WhatsApp messages now have Snowden-approved encryption on Android". Mashable. Retrieved 23 January 2015.
  3. 1 2 3 4 Andy Greenberg (29 July 2014). "Your iPhone Can Finally Make Free, Encrypted Calls". Wired. Retrieved 18 January 2015.
  4. 1 2 Lee, Micah (22 June 2016). "Battle of the Secure Messaging Apps: How Signal Beats WhatsApp". The Intercept. First Look Media. Retrieved 17 July 2016.
  5. ↑ Tung, Liam (8 April 2016). "Snowden's preferred messaging app Signal comes to the desktop with Chrome". ZDNet. CBS Interactive. Retrieved 9 April 2016.
  6. ↑ Perrin, Trevor (9 June 2015). TextSecure Protocol: Present and Future (Video). NorthSec. Event occurs at 0:21. Retrieved 24 September 2016.
  7. 1 2 3 Garling, Caleb (2011-12-20). "Twitter Open Sources Its Android Moxie | Wired Enterprise". Wired.com. Retrieved 2011-12-21.
  8. ↑ "Company Overview of Whisper Systems Inc.". Bloomberg Businessweek. Retrieved 2014-03-04.
  9. ↑ Andy Greenberg (2010-05-25). "Android App Aims to Allow Wiretap-Proof Cell Phone Calls". Forbes. Retrieved 2014-02-28.
  10. ↑ Tom Cheredar (November 28, 2011). "Twitter acquires Android security startup Whisper Systems". VentureBeat. Retrieved 2011-12-21.
  11. ↑ Yadron, Danny (9 July 2015). "Moxie Marlinspike: The Coder Who Encrypted Your Texts". The Wall Street Journal. Retrieved 10 July 2015.
  12. ↑ Andy Greenberg (2011-11-28). "Twitter Acquires Moxie Marlinspike's Encryption Startup Whisper Systems". Forbes. Retrieved 2011-12-21.
  13. ↑ Garling, Caleb (2011-11-28). "Twitter Buys Some Middle East Moxie | Wired Enterprise". Wired.com. Retrieved 2011-12-21.
  14. ↑ Chris Aniszczyk (20 December 2011). "The Whispers Are True". The Twitter Developer Blog. Twitter. Archived from the original on 24 October 2014. Retrieved 22 January 2015.
  15. ↑ "TextSecure is now Open Source!". Whisper Systems. 20 December 2011. Archived from the original on 6 January 2012. Retrieved 22 January 2015.
  16. ↑ Pete Pachal (2011-12-20). "Twitter Takes TextSecure, Texting App for Dissidents, Open Source". Mashable. Retrieved 2014-03-01.
  17. ↑ "RedPhone is now Open Source!". Whisper Systems. 18 July 2012. Archived from the original on 31 July 2012. Retrieved 22 January 2015.
  18. ↑ Donohue, Brian (24 February 2014). "TextSecure Sheds SMS in Latest Version". Threatpost. Retrieved 14 July 2016.
  19. ↑ "Free, Worldwide, Encrypted Phone Calls for iPhone". Open Whisper Systems. 29 July 2014.
  20. ↑ Michael Mimoso (29 July 2014). "New Signal App Brings Encrypted Calling to iPhone". Threatpost.
  21. 1 2 3 4 Jon Evans (29 July 2014). "Talk Private To Me: Free, Worldwide, Encrypted Voice Calls With Signal For iPhone". TechCrunch. AOL.
  22. ↑ Micah Lee (2015-03-02). "You Should Really Consider Installing Signal, an Encrypted Messaging App for iPhone". The Intercept. Retrieved 2015-03-03.
  23. 1 2 Megan Geuss (2015-03-03). "Now you can easily send (free!) encrypted messages between Android, iOS". Ars Technica. Retrieved 2015-03-04.
  24. ↑ Jon Evans (2014-11-18). "WhatsApp Partners With Open Whisper Systems To End-To-End Encrypt Billions Of Messages A Day". TechCrunch. Retrieved 2014-11-19.
  25. ↑ "Open Whisper Systems partners with WhatsApp to provide end-to-end encryption". Open Whisper Systems. November 18, 2014. Retrieved November 18, 2014.
  26. ↑ "Facebook's messaging service WhatsApp gets a security boost". Forbes. 18 Nov 2014. Retrieved 21 Nov 2014.
  27. ↑ Metz, Cade (5 April 2016). "Forget Apple vs. the FBI: WhatsApp Just Switched on Encryption for a Billion People". Wired. Condé Nast. Retrieved 5 April 2016.
  28. ↑ Lomas, Natasha (5 April 2016). "WhatsApp completes end-to-end encryption rollout". TechCrunch. AOL Inc. Retrieved 5 April 2016.
  29. ↑ Greenberg, Andy (18 May 2016). "With Allo and Duo, Google Finally Encrypts Conversations End-to-End". Wired. Condé Nast. Retrieved 14 July 2016.
  30. ↑ Gibbs, Samuel (21 September 2016). "Google launches WhatsApp competitor Allo – with Google Assistant". The Guardian. Retrieved 21 September 2016.
  31. ↑ Isaac, Mike (8 July 2016). "Facebook to Add 'Secret Conversations' to Messenger App". The New York Times. The New York Times Company. Retrieved 14 July 2016.
  32. ↑ Greenberg, Andy (8 July 2016). "'Secret Conversations:' End-to-End Encryption Comes to Facebook Messenger". Wired. Condé Nast. Retrieved 14 July 2016.
  33. ↑ Greenberg, Andy (4 October 2016). "You Can All Finally Encrypt Facebook Messenger, So Do It". Wired. Condé Nast. Retrieved 5 October 2016.
  34. 1 2 3 4 Greenberg, Andy (2 November 2015). "Signal, the Snowden-Approved Crypto App, Comes to Android". Wired. Condé Nast. Retrieved 22 March 2016.
  35. 1 2 3 Franceschi-Bicchierai, Lorenzo (2 December 2015). "Snowden's Favorite Chat App Is Coming to Your Computer". Motherboard. Vice Media LLC. Retrieved 4 December 2015.
  36. ↑ Marlinspike, Moxie (26 September 2016). "Desktop support comes to Signal for iPhone". Open Whisper Systems. Retrieved 26 September 2016.
  37. 1 2 3 4 Perlroth, Nicole; Benner, Katie (4 October 2016). "Subpoenas and Gag Orders Show Government Overreach, Tech Companies Argue". The New York Times. The New York Times Company. Retrieved 4 October 2016.
  38. 1 2 Kaufman, Brett Max (4 October 2016). "New Documents Reveal Government Effort to Impose Secrecy on Encryption Company" (Blog post). American Civil Liberties Union. Retrieved 4 October 2016.
  39. 1 2 "Grand jury subpoena for Signal user data, Eastern District of Virginia". Open Whisper Systems. 4 October 2016. Retrieved 4 October 2016.
  40. ↑ "Donate to Support Encryption Tools for Journalists". Freedom of the Press Foundation. Retrieved 17 October 2016.
  41. ↑ "Moxie Marlinspike". Shuttleworth Foundation. Retrieved 17 October 2016.
  42. ↑ "TextSecure". Knight Foundation. Retrieved 17 October 2016.
  43. ↑ "Open Whisper Systems". Open Technology Fund. Retrieved 17 October 2016.
  44. ↑ Marlinspike, Moxie (16 December 2013). "BitHub = Bitcoin + GitHub. An experiment in funding privacy OSS.". Open Whisper Systems. Retrieved 23 January 2015.
  45. ↑ Max Eddy (11 March 2014). "Snowden to SXSW: Here's How To Keep The NSA Out Of Your Stuff". PC Magazine: SecurityWatch. Retrieved 2014-03-16.
  46. ↑ "The Virtual Interview: Edward Snowden - The New Yorker Festival". YouTube. The New Yorker. Oct 11, 2014. Retrieved May 24, 2015.
  47. ↑ Dell Cameron (Mar 6, 2015). "Edward Snowden tells you what encrypted messaging apps you should use". The Daily Dot. Retrieved May 24, 2015.
  48. ↑ Alan Yuhas (May 21, 2015). "NSA surveillance powers on the brink as pressure mounts on Senate bill – as it happened". The Guardian. Retrieved May 24, 2015.
  49. ↑ Zack Beauchamp (May 21, 2015). "The 9 best moments from Edward Snowden's Reddit Q&A". Vox Media. Retrieved May 24, 2015.
  50. ↑ Barrett, Brian (25 February 2016). "Apple Hires Lead Dev of Snowden's Favorite Messaging App". Wired. Condé Nast. Retrieved 2 March 2016.
  51. ↑ "Surveillance Self-Defense. Communicating with Others". Electronic Frontier Foundation. 2014-10-23.
  52. 1 2 3 4 "Secure Messaging Scorecard. Which apps and tools actually keep your messages safe?". Electronic Frontier Foundation. 2014-11-04.
  53. ↑ SPIEGEL Staff (28 December 2014). "Prying Eyes: Inside the NSA's War on Internet Security". Der Spiegel. Retrieved 23 January 2015.
  54. ↑ "Presentation from the SIGDEV Conference 2012 explaining which encryption protocols and techniques can be attacked and which not" (PDF). Der Spiegel. 28 December 2014. Retrieved 23 January 2015.
  55. ↑ Open Whisper Systems. "Open Whisper Systems". GitHub. Retrieved 2 December 2015.
  56. ↑ Open Whisper Systems. "BitHub". GitHub. Retrieved 14 January 2015.
  57. ↑ Finley, Klint (17 December 2013). "Love Child of Bitcoin and GitHub Pays Cash for Code". Wired. Condé Nast. Retrieved 22 September 2015.
  58. ↑ "Exactly how does Zfone and ZRTP protect against a man-in-the-middle (MiTM) attack?". The Zfone Project. Retrieved 25 January 2015.
  59. ↑ Open Whisper Systems. "Signal-iOS". GitHub. Retrieved 14 January 2015.
  60. ↑ Open Whisper Systems. "Signal-Android". GitHub. Retrieved 8 July 2016.
  61. 1 2 Open Whisper Systems. "Signal-Desktop". GitHub. Retrieved 8 July 2016.
  62. ↑ Unger et al. 2015, p. 241
  63. ↑ Open Whisper Systems. "libsignal-protocol-c". GitHub. Retrieved 13 June 2016.
  64. ↑ Open Whisper Systems. "libsignal-protocol-java". GitHub. Retrieved 6 April 2016.
  65. ↑ Open Whisper Systems. "libsignal-protocol-javascript". GitHub. Retrieved 25 September 2016.
  66. ↑ Open Whisper Systems. "Signal-Server". GitHub. Retrieved 21 November 2016.
  67. ↑ rhodey (16 July 2015). "RE: Flock shutting down". GitHub Gist. Retrieved 8 September 2015.
  68. ↑ Open Whisper Systems. "Flock". GitHub. Retrieved 4 October 2015.
  69. 1 2 Open Whisper Systems. "RedPhone". GitHub. Archived from the original on 5 September 2015. Retrieved 11 November 2015.
  70. 1 2 Open Whisper Systems. "TextSecure". GitHub. Retrieved 26 February 2014.
  71. 1 2 Molly Wood (19 February 2014). "Privacy Please: Tools to Shield Your Smartphone". The New York Times. Retrieved 26 February 2014.
  72. ↑ DJ Pangburn (3 March 2014). "TextSecure Is the Easiest Encryption App To Use (So Far)". Motherboard. Retrieved 14 March 2014.
  73. ↑ Moxie Marlinspike (24 February 2014). "The New TextSecure: Privacy Beyond SMS". Open Whisper Systems. Retrieved 26 February 2014.
  74. ↑ Martin Brinkmann (24 February 2014). "TextSecure is an open source messaging app with strong security features". Ghacks Technology News. Retrieved 26 February 2014.

Literature

Wikimedia Commons has media related to Open Whisper Systems.
This article is issued from Wikipedia - version of the 11/21/2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.