Signal

• Open Whisper Systems, Moxie Marlinspike, Signal (software), Signal Foundation
• WhisperSystems > Signal, Support, Foundation, @SignalApp, @WhisperSystems, Fbook page, LinkedIn page, Blog, GitHub

Signal is an encrypted communications app for Android and iOS. A desktop version is also available for Linux, Windows, and macOS. It uses the Internet to send one-to-one and group messages, which can include files, voice notes, images and videos, and make one-to-one voice and video calls.

Your data: In addition to the end-to-end encryption that protects every Signal message, the Signal service is designed to minimize the data that is retained about users. It does not store a record of your contacts, social graph, conversation list, location, user avatar, user profile name, group memberships, group titles, or group avatars.ref

Signal uses standard cellular mobile numbers as identifiers, and uses automatic end-to-end encryption to secure all communications to other Signal users. The applications include mechanisms by which users can independently verify the identity of their messaging correspondents and the integrity of the data channel. The keys that are used to encrypt the user's communications are generated and stored at the endpoints (ie. by users, not by servers).

How Signal works: Wired has an excellent explanation here.

Cost: Signal allows users to make voice and video calls to other Signal users. All calls are made over a Wi-Fi or data connection and (with the exception of data fees) are free of charge, including long distance and international. Signal also allows users to send text messages, files, voice notes, pictures, and video messages to other Signal users. The apps also support group messaging.

Signal requires that the user provides a phone number for verification, eliminating the need for user names or passwords. This mandatory connection to a phone number (a feature Signal shares with Whatsapp) has been criticized as a "major issue" for privacy-conscious users who are not comfortable with giving out their private phone number, and as creating security risks that arise from the possibility of an attacker taking over a phone number. The option to register with an email address instead of a phone number is a widely requested feature, which as of early 2018 has not yet been implemented.
One workaround is to use a secondary phone number, which does not have to be the same as on the device's SIM card. It can also be a VoIP or a landline number, as long as the user can receive the verification code and have a separate device to set up the software. Others have suggested using a dummy SIM card.ref

Where to get it: Signal is officially distributed through the Google Play store, Apple's App Store, and Open Whisper Systems' official website. The apps are signed by the application's developer, and the operating system checks that updates are signed with the same key, preventing others from distributing unsigned updates.

Funding

Open Whisper Systems licences the Signal Protocol to other companies, including Google for Allo, Facebook for WhatsApp and Messenger, and Micro$oft for Skype. This gives those companies some security/privacy credentials, and gives Signal an income to maintain their code and infrastructure. Note that even though WhatsApp uses Signal's crypto, that doesn't mean it's privacy-friendly or open source.

Between Dec.2013—Nov.2017, Open Whisper Systems used BitHub to distribute small donations among contributors. The system automatically paid a percentage of Bitcoin funds for every submission to one of Open Whisper Systems' GitHub repositories.

In Feb.2018, Moxie Marlinspike and WhatsApp co-founder Brian Acton announced the formation of the Signal Foundation. Instead of taking the for-profit startup route, Open Whisper Systems will instead by funded by a combination of donations and govt grants. Marlinspike says the project has received money from the free-software-focused Shuttleworth Foundation and the Open Technology Fund, a US govt program that has funded other privacy projects such as Tor and Cryptocat.

Signal Foundation

The Signal Foundation is a non-profit organisation founded in Feb.2018 by Moxie Marlinspike and Brian Acton. Its mission is "to develop open source privacy technology that protects free expression and enables secure global communication".

The foundation was started with an initial $50m in funding from Acton, who left WhatsApp's parent company Facebook in Sept.2017.ref The Freedom of the Press Foundation has served as Signal's fiscal sponsor since Dec.2016, and will continue to accept donations while the Signal Foundation's non-profit status is pending. Acton is serving as the Foundation's Executive Chairman, and Marlinspike continues as CEO.

You can donate to Signal development through the Freedom of the Press Foundation page.

Open Whisper Systems

Whisper Systems was a company focused on the development of mobile security software, which was acquired by Twitter in Nov.2011. Twitter very generously made some of the Whisper Systems software available under an Open Source license (GPL v3), which has since been under open development by the community. The software has seen a number of new releases based on that open development, and the developers have been calling the project for this continued work "Open Whisper Systems". "This is where we will be promoting, distributing, and coordinating the continued development of mobile security and privacy software. In an environment of increasingly pervasive surveillance, we want to make it as easy as possible for anyone to be able to organize and communicate securely. We hope you’ll join us."

ToDo †{{{1}}}

Timeline

May.2018	Domain Fronting via Amazon: Amazon refused permission for Signal to use domain fronting on any domains it owns. Furthermore, Amazon instigated a set of changes designed to prevent domain fronting from working across the entirety of CloudFront.ref
Feb.2018	Signal Foundation: Moxie Marlinspike and Brian Acton announced the formation of the Signal Foundation.ref Brian Acton donated an initial $50m in funding.ref
Jan.2018	Skype: Micro$oft introduced a "Private Conversations" feature in Skype, powered by the Signal Protocol.
Jan.2018	Iran blocked Telegram and Instagram - but not WhatsApp. Signal was also blocked, due to its reliance on the Google App Engine to disguise its traffic through a process called "domain fronting". ref This does not work in Iran because Google has blocked Iranian access to Google App Engine in order to comply with USA sanctions.ref
Oct.2017	Signal for Desktop: OWS announced the release of a standalone desktop client for certain Windows, MacOS and Linux distributions.ref,ref. The Chrome app was deprecated, but users could export their data into the new app as part of the setup process.ref
Sept.2017	Brian Acton (of WhatsApp) left Facebook, also leaving ~$850m in stock by not staying for a few more months. Acton has played a major role in creating Signal. He is now executive chairman of the Signal Foundation.ref
Dec.2016	Egypt blocked access to Signal.ref In response, Open Whisper Systems added domain fronting to their service.[1] This allows Signal users in a specific country to circumvent censorship by making it look like they are connecting to a different Internet-based service.ref
Oct.2016	Gag Order: The US Govt had subpoenaed Open Whisper Systems earlier in the year, requiring them to provide information associated with two phone numbers for a federal grand jury investigation - plus a one-year gag order demanding complete silence on the matter. Because of how Signal is designed, OWS was only able to provide "the time the user’s account had been created and the last time it had connected to the service". OWS went to the American Civil Liberties Union for help, and they were able to lift part of the gag order after challenging it in court.ref
Oct.2016	Facebook Messenger: Facebook deployed an optional mode called "secret conversations" in Messenger which provides end-to-end encryption using an implementation of the Signal Protocol.ref
Sept.2016	Signal Desktop could now be linked with the iOS version of Signal as well.ref
Sept.2016	Allo was launched by Google, a messaging app with an optional "incognito mode" that uses the Signal Protocol for end-to-end encryption.refref
Apr.2016	Open Whisper Systems and WhatsApp announced they had finished adding end-to-end encryption to "every form of communication" on WhatsApp, and that users could now verify each other's keys.ref
Dec.2015	Signal Desktop was launched as a Chrome app that could link with an Android Signal client.ref
Nov.2015	Signal: RedPhone was merged into TextSecure, to become Signal for Android.ref
Jul.2015	David Cameron threatened to ban Whatsapp, based on its use of TextSecure. ref
Mar.2015	TextSecure compatibility was added to the iOS application.ref
Nov.2014	WhatsApp: OWS announced a partnership with WhatsApp to provide end-to-end encryption by incorporating the Signal Protocol into each WhatsApp client platform.ref They said the protocol had already been incorporated into the latest WhatsApp client for Android, and support for other clients, group/media messages, and key verification would be coming soon. WhatsApp was oddly shy; it confirmed the partnership to reporters, but there was no official announcement, and requests for comment were declined.ref
Oct.2014	The Electronic Frontier Foundation included Signal, TextSecure and RedPhone in their updated Surveillance Self-Defense (SSD) guide.ref Snapchat, Whatsapp, Facebook chat, Google Hangouts, Skype, and more, all failed EFF's simple security tests. Providers can read users' messages because the apps use the providers' encryption keys instead of user-created keys.ref
Sept.2014	Redphone returned as an open-source project, for Android.ref
Jul.2014	Signal was released as a RedPhone counterpart for iOS. The developers said that their next steps would be to provide TextSecure instant messaging capabilities for iOS, unify the RedPhone and TextSecure applications on Android, and launch a web client.ref,ref
Feb.2014	TextSecure Protocol version 2 was released, which added end-to-end encrypted group chat and instant messaging capabilities.ref,ref
Jan.2013	Open Whisper Systems: Marlinspike left Twitter,ref even though his contract stipulated a minimum stay of 4 years, otherwise he would forfeit over $1m in stock options. He quit anyway, and founded Open Whisper Systems with Brian Acton and Jan Koum, as a collaborative open source project for the continued development of TextSecure and RedPhone.ref
Jul.2012	RedPhone was released under the GPL v3.ref
Jun.2012	National Security Agency: Slides from an internal NSA presentation were published by Der Spiegel, in which the NSA deemed RedPhone on its own as a "major threat" to its mission and, when used in conjunction with other privacy tools such as Cspace, Tor, Tails, and TrueCrypt, was ranked as "catastrophic," leading to a "near-total loss/lack of insight to target communications, presence..." ref
Dec.2011	TextSecure was released by Twitter as free, open-source software under the Gnu General Public Licence v3 (GPLv3).ref
Nov.2011	Twitter acquired Whisper Systems,ref with Marlinspike becoming Twitter's director of product security. Shortly afterward, Whisper Systems' RedPhone service was made unavailable.ref
May.2010	RedPhone + TextSecure: The company's first two apps were released in beta; TextSecure for encrypted texting, and RedPhone for encrypted voice-calling.ref, ref
Apr.2010	Whisper Systems was co-founded by Moxie Marlinspike and Stuart Anderson.ref The company made proprietary closed-source security software for Android mobiles and tablets.ref

Articles

• May.01.2018: Amazon threatens to suspend Signal's AWS account over censorship circumvention. Direct access to Signal has been censored in Egypt, Oman, Qatar, and UAE for the past 1.5 years. These countries attempt to block Signal by blocking connections to Signal servers from all ISPs. ...We responded by deploying domain fronting in those countries through Google App Engine. Direct access to Signal has also been blocked in Iran for the past 3+ years, but it was not possible to use the same domain fronting technique there. In an apparently unique interpretation of US sanction law, Google does not allow any requests from Iran to be processed by Google App Engine. In early 2018, a number of policy organisations increased pressure on Google to change their position on how they were interpreting US sanction law so that domain fronting would be possible from Iran. Sadly, these lobbying efforts seem to have had the opposite effect. When Google’s leadership became more aware of domain fronting, it generated internal conversations about whether they wanted to put themselves in the situation of providing cover for sites that entire countries wished to block. A month later, we received a 30-day advance notice from Google that they would be making internal changes to stop domain fronting from working entirely. With Google no longer an option, we decided to look for popular domains in censored regions that were on Amazon's CloudFront instead. There were a few sites that used CloudFront in the Alexa top 50 or 100. We're an open source project, so the commit switching from GAE to CloudFront was public. Someone saw the commit and submitted it to HN. That post became popular, and apparently people inside Amazon saw it too. That’s how we got to the above email. A few days ago Amazon also announced what they are calling Enhanced Domain Protections for CloudFront requests. It is a set of changes designed to prevent domain fronting from working entirely, across all of CloudFront. With Google Cloud and AWS out of the picture, it seems that domain fronting as a censorship circumvention technique is now largely non-viable in the countries where Signal had enabled this feature. The idea behind domain fronting was that to block a single site, you’d have to block the rest of the internet as well. In the end, the rest of the internet didn’t like that plan. We are considering ideas for a more robust system, and developing new techniques will take time. Moreover, if recent changes by large cloud providers indicate a commitment to providing network-level visibility into the final destination of encrypted traffic flows, then the range of potential solutions becomes severely limited. In the meantime, the censors in these countries will have (at least temporarily) achieved their goals. Sadly, they didn’t have to do anything but wait. Signal Foundation.

• May.11.2017: Ditch All Those Other Messaging Apps: Here's Why You Should Use Signal. It's time to pick one messaging app; there are just too many, and we should all be using Signal. It has strong encryption, it's free, it works on every mobile platform, and the developers are committed to keeping it simple and fast by not mucking up the experience with ads, web-tracking, stickers, or animated poop emoji. What makes Signal superior is that it's easy to ensure that the contents of every chat remain private and unable to be read by anyone else. When both parties use it, every message is encrypted. WhatsApp raises a few concerns: it's owned by Facebook Inc, whose primary interest is in collecting information about you to sell you ads. Although the content of your WhatsApp messages are encrypted, Facebook still extracts metadata, eg. who you're talking to and how frequently. Facebook's Messenger app isn't a safe place to keep your conversations, because you have to encrypt each conversation by flipping on the "Secret Conversations" option (good luck remembering to do that), and anyone with a Facebook profile can just search for your name and message you. iMessage may seem like a solid remedy, but it's tucked behind Apple's walled iOS garden, so you can't chat with Android users. Plus, if you switch platforms, it's bye-bye to your chat history. Let's all switch to Signal, keep our messages private, and put an end to the untenable multi-app shuffle that's gone on far too long. Jordan McMahon, Wired.

• Jul.31.2016: Meet Moxie Marlinspike, the anarchist bringing encryption to all of us. Michael Friberg, Wired.