TextSecure

» see whispersystems.org as it lived, on the wayback machine

~ the eulogy ~

TextSecure solved a problem I had, but in a form I did not have it. It encrypted SMS on Android, and SMS in Turkey around 2011 was something you paid for by the message and rationed accordingly. What everyone around me did instead was move to WhatsApp the moment it worked, precisely because it was not SMS. The threat model TextSecure was built for, somebody reading your messages in transit, was not absent here. It was simply not the thing that made anyone change apps.

It started as a beta on 25 May 2010 out of Whisper Systems, a startup Moxie Marlinspike had cofounded with the roboticist Stuart Anderson. The company made two things, TextSecure for messages and RedPhone for calls. In November 2011 Twitter bought Whisper Systems, which usually means a product vanishes into an acquirer and is never seen again. Instead Twitter released the code under GPLv3 in December 2011 and let it walk.

Marlinspike left and set up Open Whisper Systems as a collaborative project, with a website that went live in January 2013. That is the stretch where TextSecure stopped being an SMS tool and became something more ambitious. It grew its own transport over the data channel, and underneath that transport sat a key ratchet Marlinspike had designed with Trevor Perrin, then called Axolotl.

~ the dossier ~

~ how it landed ~

The install numbers were never large. By October 2015 TextSecure had passed a million installs on Google Play, which for a five-year-old app in an era of WhatsApp counting users in the hundreds of millions is a rounding error. The people using it were mostly journalists and security researchers, plus the Android users who install things because the source is readable.

The decision that dated it came in March 2015, when Open Whisper Systems dropped encrypted SMS and MMS on Android entirely. That broke the original premise and annoyed the users who had arrived for exactly that feature. The reasoning was that SMS leaks metadata no matter what you do to the body of the message, and that pretending otherwise was worse than not offering it at all.

~ the next chapter ~

On 2 November 2015 RedPhone was folded in and the combined app was renamed Signal for Android. The name TextSecure stopped existing that day, which is a strange sort of death, because no code died and no user left. What went away was a brand and a premise, the premise being that the thing worth encrypting was your phone's text messages.

The protocol had a much larger afterlife than the app. WhatsApp finished rolling the Signal Protocol out to its entire userbase in April 2016, taking end-to-end encryption from a million installs to a billion in one update, without asking anybody to change apps. Facebook Messenger and Google Allo shipped it as an option you had to find. The thing Marlinspike built for an app almost nobody used is now the default for most private messages sent on earth, and almost none of those people have heard the name TextSecure.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »