Surespot

» see surespot.me as it lived, on the wayback machine

~ the obituary ~

surespot never reached turkey at meaningful scale. it was a niche post-snowden privacy-messenger from a two-person colorado shop, and the cohort that would have used it here was already on signal or telegram by the time the english-speaking privacy press wrote about it. i was on whatsapp and telegram by then, with the occasional signal install on a work phone for the form of it. the encrypted-messenger conversation that mattered to me ran on bigger products with bigger threat models, so surespot stayed in the part of crypto-twitter i scrolled past without clicking through.

the facts are pretty clean. adam patacchiola and cherie berdovich ran a small company called 2fours out of boulder, colorado, and shipped surespot in 2013 as a free open-source messenger for android and ios. encryption was 256-bit aes-gcm with 512-bit ecdh key exchange, enabled by default. you picked a username, no phone number or email tied to the install. text and photos moved through the same encrypted pipe, plus short audio clips later on. the eff flagged in 2014 that it lacked forward secrecy and did not support group chat, and that flag stayed unaddressed for the rest of the app's life.

2015 was the strange year. channel 4 news ran a piece about isis-linked accounts allegedly using surespot, and around the same time the developers stopped answering questions about whether the us government had served any data requests. a blog post by a user that june, picked up by the cato institute and the christian science monitor, asked whether surespot had become a quiet cryptowar casualty. nobody at 2fours ever gave a clear public answer.

~ the case file ~

~ the long maintenance fade ~

the app did not die in 2015. it just stopped being maintained at the pace of the rest of the category. the last ios build shipped on 29 november 2018 as version 21, and the last android build on 27 april 2019 as version 81. for the next three and a half years surespot kept running on those frozen binaries while every other messenger in the category was shipping monthly updates with new ratchet protocols and metadata-shielding designs. the gap widened. by 2021 the comparison points were signal, threema, wire, session, and surespot was an artifact from a different era of the privacy-messenger conversation.

the small-team math worked against it. there was never a paid tier or an enterprise pitch, and patacchiola had been the only steady developer from the start. nine years of running infrastructure for a free service with no revenue is a long shift for two people.

~ the day it died ~

the final server shutdown was 31 july 2022. no farewell post on the project blog, no long retrospective. the app stayed installable on devices but stopped talking to the backend, and that was the end of it. the open-source repos were still on github for anyone who wanted to read the code or fork the protocol, but the hosted surespot was done. nine-year run, ended on a sunday in late july.

~ what carried over ~

the artifact is the proof that a two-person shop could run a functioning encrypted messenger for the better part of a decade on essentially zero revenue. that was true for hike messenger at a much larger scale and for several smaller indie messengers across the same window, and surespot was one of the cleanest examples of the pattern in the english-speaking crypto-app niche. the answer to whether the developers ever received and complied with government data requests in 2014 or 2015 was never made public, and the shutdown closed off any chance of a clean accounting.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »