Open Whisper Systems

From Infogalactic: the planetary knowledge core
Jump to: navigation, search

<templatestyles src="Module:Hatnote/styles.css"></templatestyles>

Not to be confused with Whisper Systems, a company that was acquired by Twitter, or Whisper, a product of WhisperText LLC.
Open Whisper Systems
100px
Mission statement Making private communication simple.[1]
Commercial? No[2][3]
Type of project Free and open-source software, Encryption software, Mobile software
Products Signal
Location San Francisco, CA
Founder Moxie Marlinspike[3]
Key people Moxie Marlinspike, Tyler Reinhard, Lilia Kai, Riya Abraham[1]
Established 21 January 2013 (2013-01-21)
Funding Grants and donations[2]
Website whispersystems.org

Open Whisper Systems (informally abbreviated OWS[4]) is a nonprofit software group that was founded by Moxie Marlinspike in 2013. It is primarily responsible for maintaining an encrypted voice calling and instant messaging application called Signal. The group is funded by a combination of donations and grants, and all of its products are published as free and open-source software.

History

Background

Security researcher Moxie Marlinspike and roboticist Stuart Anderson co-founded a startup company called Whisper Systems in 2010.[5][6] The company produced proprietary enterprise mobile security software. Among these were an encrypted texting program called TextSecure and an encrypted voice calling app called RedPhone.[7] They also developed a firewall and tools for encrypting other forms of data.[5]

In November 2011, Whisper Systems announced that it had been acquired by Twitter. The financial terms of the deal were not disclosed by either company.[8] The acquisition was done "primarily so that Mr. Marlinspike could help the then-startup improve its security".[9] Shortly after the acquisition, Whisper Systems' RedPhone service was made unavailable.[10] Some criticized the removal, arguing that the software was "specifically targeted [to help] people under repressive regimes" and that it left people like the Egyptians in "a dangerous position" during the events of the 2011 Egyptian revolution.[11]

Twitter released TextSecure as free and open-source software under the GPLv3 license in December 2011.[5][12][13][14] RedPhone was also released under the same license in July 2012.[15] Marlinspike later left Twitter and founded Open Whisper Systems as a collaborative open source project for the continued development of TextSecure and RedPhone.[2][16]

2013–present

Marlinspike launched Open Whisper Systems' website in January 2013.[16][3]

Toward the end of July 2014, Open Whisper Systems announced plans to unify its RedPhone and TextSecure applications as Signal.[17] These announcements coincided with the initial release of Signal as a RedPhone counterpart for iOS. The developers said that their next steps would be to provide TextSecure instant messaging capabilities for iOS, unify the RedPhone and TextSecure applications on Android, and launch a web client.[18] Signal was the first iOS app to enable easy, strongly encrypted voice calls for free.[2][19]

On November 18, 2014, Open Whisper Systems announced a partnership with WhatsApp to provide end-to-end encryption by incorporating the protocol used in TextSecure into each WhatsApp client platform.[20] Open Whisper Systems said that they had already incorporated the protocol into the latest WhatsApp client for Android and that support for other clients, group/media messages, and key verification would be coming soon after.[21] WhatsApp confirmed the partnership to reporters, but there was no announcement or documentation about the encryption feature on the official website, and further requests for comment were declined.[22] On April 5, 2016, WhatsApp and Open Whisper Systems announced that they had finished adding end-to-end encryption to "every form of communication" on WhatsApp, and that users could now verify each others' keys.[23][24]

In March 2015, Open Whisper Systems released Signal 2.0 with support for TextSecure private messaging on iOS.[25][26] In November 2015, the TextSecure and RedPhone applications on Android were merged to become Signal for Android.[27] A month later, Open Whisper Systems announced Signal Desktop, a Chrome app that can link with a Signal client.[28] As of December 2, 2015, the app is in beta and can only be linked with the Android version of Signal.[28]

Funding

Open Whisper Systems is funded by a combination of donations and grants. The project has received financial support from, among others, the Freedom of the Press Foundation,[29] the Knight Foundation,[30] the Shuttleworth Foundation,[31] and the Open Technology Fund,[32] a U.S. government funded program that has also supported other privacy projects like the anonymity software Tor and the encrypted instant messaging website Cryptocat.

Open Whisper Systems uses a system called BitHub to distribute small donations appropriately among contributors. The system automatically pays a percentage of Bitcoin funds for every submission to one of Open Whisper Systems' GitHub repositories.[19][33]

Reception

Former NSA contractor Edward Snowden has endorsed Open Whisper Systems' applications on multiple occasions. In his keynote speech at SXSW in March 2014, he praised TextSecure and RedPhone for their ease-of-use.[34] During an interview with The New Yorker in October 2014, he recommended using "anything from Moxie Marlinspike and Open Whisper Systems".[35] During a remote appearance at an event hosted by Ryerson University and Canadian Journalists for Free Expression in March 2015, Snowden said that Signal is "very good" and that he knew the security model.[36] Asked about encrypted messaging apps during a Reddit AMA in May 2015, he recommended “Signal for iOS, Redphone/TextSecure for Android”.[37][38] In November 2015, Snowden tweeted that he used Signal "every day".[39]

In October 2014, the Electronic Frontier Foundation (EFF) included TextSecure, RedPhone, and Signal in their updated Surveillance Self-Defense (SSD) guide.[40] In November 2014, all three received top scores on the EFF's Secure Messaging Scorecard, along with Cryptocat, Silent Phone, and Silent Text.[41] They received points for having communications encrypted in transit, having communications encrypted with keys the providers don't have access to (end-to-end encryption), making it possible for users to independently verify their correspondent's identities, having past communications secure if the keys are stolen (forward secrecy), having their code open to independent review (open source), having their security designs well-documented, and having recent independent security audits.[41]

On December 28, 2014, Der Spiegel published slides from an internal NSA presentation dating to June 2012 in which the NSA deemed RedPhone on its own as a "major threat" to its mission, and when used in conjunction with other privacy tools such as Cspace, Tor, Tails, and TrueCrypt was ranked as "catastrophic," leading to a "near-total loss/lack of insight to target communications, presence..."[42][43]

Projects

Active

Open Whisper Systems' active projects include:[44]

  • BitHub: A service that will automatically pay a percentage of Bitcoin funds for every submission to a GitHub repository.[45][46]
100px
100px
Signal for iOS and Android, respectively.
  • Signal: A free and open-source encrypted voice calling and instant messaging application for iOS and Android. It uses end-to-end encryption protocols to secure all communications to other Signal users.[26][41] Signal can be used to send end-to-end encrypted group messages, attachments and media messages to other Signal users. All calls are made over a Wi-Fi or data connection and are free of charge, including long distance and international.[19] Signal has a built-in mechanism for verifying that no man-in-the-middle attack has occurred. During a call, the app displays two words (selected from the PGP word list) on the screen. If the words match on both ends of the call, the call is secure.[19][47] Open Whisper Systems has set up dozens of servers to handle the encrypted calls in more than 10 countries around the world to minimize latency.[2] The software is published under the GPLv3 license.[48]
  • Signal Desktop: A Chrome app that can link with a Signal client.[28] As of December 2, 2015, the app is in beta and can only be linked with the Android version of Signal.[28] The software is published under the GPLv3 license.[49]
  • Signal Protocol: An encryption protocol that combines the Double Ratchet Algorithm, prekeys, and a 3-DH handshake.[50] Implementations:
    • SignalProtocolKit: A library written in Objective-C and published under the GPLv2 license.[51]
    • libsignal-protocol-java: A library written in Java and published under the GPLv3 license.[52]
  • TextSecure-Server: The software that handles message routing for the Signal data channel. Client-server communication is protected by TLS.[53] Communication is handled by a REST API and push messaging (both GCM and APN).[54] The software is published under the AGPLv3 license.[54]

Discontinued

Open Whisper Systems' discontinued projects include:

  • Flock: A service that synced calendar and contact information on Android devices. Users had the ability to host their own server. The developer cited technological choices that lead to high server costs as a reason for discontinuing the service.[55] Flock was discontinued October 1, 2015, but its source code is still available on GitHub under the GPLv3 license.[56]
File:RedPhone icon 2014.svg
RedPhone
  • RedPhone: A stand-alone application for encrypted voice calling on Android. RedPhone integrated with the system dialer to make calls, but used ZRTP to set up an end-to-end encrypted VoIP channel for the actual call. RedPhone was designed specifically for mobile devices, using audio codecs and buffer algorithms tuned to the characteristics of mobile networks, and used push notifications to preserve the user's device's battery life while still remaining responsive.[57] RedPhone was merged into TextSecure on November 2, 2015.[27] TextSecure was then renamed as Signal for Android.[27] RedPhone's source code was available under the GPLv3 license.[57]
  • TextSecure: A stand-alone application for encrypted messaging on Android.[58][59] TextSecure could be used to send and receive SMS, MMS, and instant messages.[60] It used end-to-end encryption with forward secrecy and deniable authentication to secure all instant messages to other TextSecure users.[41][59][61][62] TextSecure was merged with RedPhone to become Signal for Android.[27] The source code is available under the GPLv3 license.[58]

See also

Literature

  • Lua error in package.lua at line 80: module 'strict' not found.

References

  1. ↑ 1.0 1.1 Lua error in package.lua at line 80: module 'strict' not found.
  2. ↑ 2.0 2.1 2.2 2.3 2.4 Lua error in package.lua at line 80: module 'strict' not found.
  3. ↑ 3.0 3.1 3.2 Lua error in package.lua at line 80: module 'strict' not found.
  4. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  5. ↑ 5.0 5.1 5.2 Lua error in package.lua at line 80: module 'strict' not found.
  6. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  7. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  8. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  9. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  10. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  11. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  12. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  13. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  14. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  15. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  16. ↑ 16.0 16.1 Lua error in package.lua at line 80: module 'strict' not found.
  17. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  18. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  19. ↑ 19.0 19.1 19.2 19.3 Lua error in package.lua at line 80: module 'strict' not found.
  20. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  21. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  22. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  23. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  24. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  25. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  26. ↑ 26.0 26.1 Lua error in package.lua at line 80: module 'strict' not found.
  27. ↑ 27.0 27.1 27.2 27.3 Lua error in package.lua at line 80: module 'strict' not found.
  28. ↑ 28.0 28.1 28.2 28.3 Lua error in package.lua at line 80: module 'strict' not found.
  29. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  30. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  31. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  32. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  33. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  34. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  35. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  36. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  37. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  38. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  39. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  40. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  41. ↑ 41.0 41.1 41.2 41.3 Lua error in package.lua at line 80: module 'strict' not found.
  42. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  43. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  44. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  45. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  46. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  47. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  48. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  49. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  50. ↑ Unger et al. 2015, p. 241
  51. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  52. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  53. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  54. ↑ 54.0 54.1 Lua error in package.lua at line 80: module 'strict' not found.
  55. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  56. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  57. ↑ 57.0 57.1 Lua error in package.lua at line 80: module 'strict' not found.
  58. ↑ 58.0 58.1 Lua error in package.lua at line 80: module 'strict' not found.
  59. ↑ 59.0 59.1 Lua error in package.lua at line 80: module 'strict' not found.
  60. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  61. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  62. ↑ Lua error in package.lua at line 80: module 'strict' not found.

External links

Retrieved from "https://infogalactic.com/w/index.php?title=Open_Whisper_Systems&oldid=718532598"