The Dark Mail Alliance is an organization dedicated to creating an email protocol and architecture with end-to-end encryption .
59-497: In October 2013, Silent Circle and Lavabit announced a project to create a more secure alternative to email and began a fundraising effort. The Dark Mail Alliance team originally consisted of Phil Zimmermann , Jon Callas , Mike Janke, and Ladar Levison . As of August 2023, the only original member of the team still listed on the Dark Mail Alliance website is Levison. Dark Internet Mail Environment ( DIME ) aims to be
118-508: A Chrome app that could link with a Signal mobile client. At launch, the app could only be linked with the Android version of Signal. On 26 September 2016, Open Whisper Systems announced that Signal Desktop could now be linked with the iOS version of Signal as well. On 31 October 2017, Open Whisper Systems announced that the Chrome app was deprecated . At the same time, they announced the release of
177-499: A Thunderbird fork with DIME support. Silent Circle (software) Silent Circle is an encrypted communications firm based in Washington DC . Silent Circle provides multi-platform secure communication services for mobile devices and desktops. Launched October 16, 2012, the company operates under a subscription business model . The encryption part of the software used is free software / open source and peer-reviewed. For
236-462: A centralized computing architecture and is cross-platform software . It is developed by the non-profit Signal Foundation and its subsidiary Signal Messenger LLC . Signal's software is free and open-source . Its mobile clients, desktop client, and server are all published under the AGPL-3.0-only license. The official Android app generally uses the proprietary Google Play Services , although it
295-539: A cryptocurrency wallet functionality for storing, sending and receiving in-app payments. Apart from certain regions and countries, the feature was enabled globally in November 2021. As of January 2022 , the only supported payment method is MobileCoin . In February 2024, Signal added a username feature to the beta version of the app. This is a privacy feature that allows users to communicate with others without having to share their telephone number. Signal requires that
354-545: A nonprofit . Between November 2019 and February 2020, Signal added iPad support, view-once images and videos, stickers , and reactions. They also announced plans for a new group messaging system and an "experimental method for storing encrypted contacts in the cloud." Signal was reportedly popularized in the United States during the George Floyd protests . Heightened awareness of police monitoring led protesters to use
413-400: A trust on first use mechanism in order to notify the user if a correspondent's key changes. After receiving and decrypting messages, the application stored them locally on each device in a SQLite database that is encrypted with SQLCipher. The cryptographic key for this database is also stored locally and can be accessed if the device is unlocked. In December 2020, Cellebrite published
472-601: A blog post announcing that one of their products could now access this key and use it to "decrypt the Signal app". Technology reporters later published articles about how Cellebrite had claimed to have the ability to "break into the Signal app" and "crack Signal's encryption". This latter interpretation was rejected by several experts, as well as representatives from Signal, who said the original post by Cellebrite had been about accessing data on "an unlocked Android phone in their physical possession" and that they "could have just opened
531-435: A firewall and tools for encrypting other forms of data. All of these were proprietary enterprise mobile security software and were only available for Android. In November 2011, Whisper Systems announced that it had been acquired by Twitter . Neither company disclosed the financial terms of the deal. The acquisition was done "primarily so that Mr. Marlinspike could help the then-startup improve its security". Shortly after
590-612: A form of two-factor authentication that requires the user to enter a PIN to register the phone number on a new device. When linking Signal Desktop to a mobile device, the conversations history will not be synced; only the new messages will be shown on Signal Desktop. In July 2016, the Internet Society published a user study that assessed the ability of Signal users to detect and deter man-in-the-middle attacks . The study concluded that 21 out of 28 participants failed to correctly compare public key fingerprints in order to verify
649-429: A purely theoretic attack against the group protocol of Signal: A user who knows the secret group ID of a group (due to having been a group member previously or stealing it from a member's device) can become a member of the group. Since the group ID cannot be guessed and such member changes are displayed to the remaining members, this attack is likely to be difficult to carry out without being detected. As of August 2018 ,
SECTION 10
#1732884257040708-588: A secure communication platform for asynchronous messaging across the Internet. It was presented by Ladar Levison and Stephen Watt at DEF CON on August 8, 2014. There have been multiple revisions for DIME specifications. The latest revision is presented as a preliminary draft. Magma is the reference MIME server implementation. It supports server side encryption, Simple Mail Transfer Protocol (SMTP), Post Office Protocol (POP), Internet Message Access Protocol (IMAP) and Hypertext Transfer Protocol (HTTP). Volcano,
767-578: A standalone desktop client (based on the Electron framework ) for Windows , macOS and certain Linux distributions . On 4 October 2016, the American Civil Liberties Union (ACLU) and Open Whisper Systems published a series of documents revealing that OWS had received a subpoena requiring them to provide information associated with two phone numbers for a federal grand jury investigation in
826-466: A surge in new user registrations, which temporarily overwhelmed Signal's capacity to deliver account verification messages. CNN and MacRumors linked the surge with a WhatsApp privacy policy change and a Signal endorsement by Elon Musk and Edward Snowden via Twitter. The surge was also tied to the attack on the United States Capitol . International newspapers reported similar trends in
885-453: A time. Account registration requires an iOS or Android device. This mandatory connection to a telephone number (a feature Signal shares with WhatsApp , KakaoTalk , and others) has been criticized as a "major issue" for privacy-conscious users who are not comfortable with giving out their private number. A workaround is to use a secondary phone number. The ability to choose a public, changeable username instead of sharing one's phone number
944-500: Is designed to be able to work without them. Signal is also distributed for iOS and desktop programs for Windows , macOS , and Linux . Registration for desktop use requires an iOS or Android device. Signal uses mobile telephone numbers to register and manage user accounts, though configurable usernames were added in March 2024 to allow users to hide their phone numbers from other users. After removing support for SMS on Android in 2023,
1003-531: The Twilio breach including user phone numbers and SMS verification codes. At least one journalist had his account re-registered to a device he did not control as a result of the attack. In September 2022 Signal Messaging LLC announced that AI researcher and noted critic of big tech Meredith Whittaker would fill the newly created position of President. Signal's userbase started in May 2010, when its predecessor TextSecure
1062-465: The United Arab Emirates . Reuters reported that more than 100,000 people had installed Signal between 7 and 8 January. Between 12 and 14 January 2021, the number of Signal installations listed on Google Play increased from over 10 million to over 50 million. On 15 January 2021, due to the surge of new users, Signal was overwhelmed with the new traffic and was down for all users. On
1121-601: The ZRTP key-agreement protocol, which was developed by Phil Zimmermann . In March 2017, Signal transitioned to a new WebRTC -based calling system that introduced the ability to make video calls. Signal's voice and video calling functionalities use the Signal Protocol channel for authentication instead of ZRTP. To verify that a correspondent is really the person that they claim to be, Signal users can compare key fingerprints (or scan QR codes) out-of-band . The platform employs
1180-755: The Signal Protocol (formerly known as the TextSecure Protocol). The protocol combines the Double Ratchet Algorithm , prekeys, and an Extended Triple Diffie–Hellman (X3DH) handshake. It uses Curve25519 , AES-256 , and HMAC-SHA256 as primitives . The protocol provides confidentiality, integrity, authentication , participant consistency, destination validation, forward secrecy , backward secrecy ( a.k.a. future secrecy), causality preservation, message unlinkability, message repudiation , participation repudiation, and asynchronicity . It does not provide anonymity preservation, and requires servers for
1239-474: The Signal Protocol has been implemented into WhatsApp , Facebook Messenger , Skype , and Google Allo , making it possible for the conversations of "more than a billion people worldwide" to be end-to-end encrypted. In Google Allo, Skype and Facebook Messenger, conversations are not encrypted with the Signal Protocol by default; they only offer end-to-end encryption in an optional mode. Up until March 2017, Signal's voice calls were encrypted with SRTP and
SECTION 20
#17328842570401298-572: The Signal Protocol. Among other findings, they presented an unknown key-share attack on the protocol, but in general, they found that it was secure. In October 2016, researchers from UK's University of Oxford , Queensland University of Technology in Australia, and Canada's McMaster University published a formal analysis of the protocol. They concluded that the protocol was cryptographically sound. In July 2017, researchers from Ruhr University Bochum found during another analysis of group messengers
1357-646: The acquisition, Whisper Systems' RedPhone service was made unavailable. Some criticized the removal, arguing that the software was "specifically targeted [to help] people under repressive regimes" and that it left people like the Egyptians in "a dangerous position" during the events of the Egyptian revolution of 2011 . Twitter released TextSecure as free and open-source software under the GPLv3 license in December 2011. RedPhone
1416-514: The afternoon of 16 January, Signal announced via Twitter that service had been restored. On 10 January 2022, Moxie Marlinspike announced that he was stepping down from his role as CEO of Signal Messenger. He continues to remain on the Signal Foundation's board of directors and Brian Acton has volunteered to serve as interim CEO during the search for a new CEO. In August 2022, Signal notified 1900 users that their data had been affected by
1475-542: The app now secures all communications with end-to-end encryption . The client software includes mechanisms by which users can independently verify the identity of their contacts and the integrity of the data channel. The non-profit Signal Foundation was launched in February 2018 with initial funding of $ 50 million from WhatsApp co-founder Brian Acton . As of January 2022 , the platform had approximately 40 million monthly active users. As of May 2021 , it
1534-445: The app to look at the messages". Similar extraction tools also exist for iOS devices and Signal Desktop. Signal relies on centralized servers that are maintained by Signal Messenger. In addition to routing Signal's messages, the servers also facilitate the discovery of contacts who are also registered Signal users and the automatic exchange of users' public keys . By default, Signal's voice and video calls are peer-to-peer . If
1593-433: The caller is not in the receiver's address book, the call is routed through a server in order to hide the users' IP addresses . The servers store registered users' phone numbers, public key material and push tokens which are necessary for setting up calls and transmitting messages. In order to determine which contacts are also Signal users, cryptographic hashes of the user's contact numbers are periodically transmitted to
1652-586: The current cost estimated around $ 40 million. Signal provides one-to-one and group voice and video calls with up to forty participants on iOS, Android, and desktop platforms. The calls are carried via the devices' wired or wireless (carrier or WiFi ) data connections. The application can send text messages, documents files, voice notes, pictures, stickers , GIFs , and video messages. The platform also supports group messaging. All communication sessions between Signal users are automatically end-to-end encrypted (the encryption keys are generated and stored on
1711-553: The data channel. Reasons for this included security flaws of SMS/MMS and problems with the key exchange . Open Whisper Systems' abandonment of SMS/MMS encryption prompted some users to create a fork named Silence (initially called SMSSecure ) that is meant solely for the exchange of encrypted SMS and MMS messages. In November 2015, the TextSecure and RedPhone applications on Android were merged to become Signal for Android. A month later, Open Whisper Systems announced Signal Desktop,
1770-461: The devices, and not on servers). To verify that a correspondent is really the person that they claim to be, Signal users can compare key fingerprints (or scan QR codes) out-of-band . The platform employs a trust-on-first-use mechanism to notify the user if a correspondent's key changes. Until 2023, on Android users could opt into making Signal the default SMS/MMS application, allowing them to send and receive unencrypted SMS messages in addition to
1829-462: The end of July 2014, they announced plans to merge the RedPhone and TextSecure applications as Signal. This announcement coincided with the initial release of Signal as a RedPhone counterpart for iOS . The developers said that their next steps would be to provide TextSecure instant messaging capabilities for iOS, unify the RedPhone and TextSecure applications on Android, and launch a web client . Signal
Dark Mail Alliance - Misplaced Pages Continue
1888-485: The first half of 2016. Only one of the two phone numbers was registered on Signal, and because of how the service is designed, OWS was only able to provide "the time the user's account had been created and the last time it had connected to the service". Along with the subpoena, OWS received a gag order requiring OWS not to tell anyone about the subpoena for one year. OWS approached the ACLU, and they were able to lift part of
1947-630: The formation of the Signal Technology Foundation , a 501(c)(3) nonprofit organization whose mission is "to support, accelerate, and broaden Signal's mission of making private communication accessible and ubiquitous". Acton started the foundation with $ 50 million in funding and became the foundation's executive chairman after leaving WhatsApp's parent company Facebook in September 2017. Marlinspike continued as Signal Messenger's first CEO . As of 2020 , Signal ran entirely on donations, as
2006-527: The founding team was established. The company was founded in the Caribbean island of Nevis , but moved its headquarters to Le Grand-Saconnex near Geneva, Switzerland in 2014 in search of a country with "stronger privacy laws to protect its customers' information." On August 9, 2013, through their website, Silent Circle announced that the Silent Mail service would be shut down, because the company could "see
2065-448: The gag order after challenging it in court. OWS said it was the first time they had received a subpoena, and that they were "committed to treating any future requests the same way". In March 2017, Open Whisper Systems transitioned Signal's calling system from RedPhone to WebRTC , also adding the ability to make video calls with the mobile apps. On 21 February 2018, Moxie Marlinspike and WhatsApp co-founder Brian Acton announced
2124-519: The identity of other Signal users, and that most of these users believed they had succeeded, while they had actually failed. Four months later, Signal's user interface was updated to make verifying the identity of other Signal users simpler. In 2023, the French government is pushing for the adoption of a European encrypted messaging alternative to Signal and WhatsApp named Olvid as their secured platform for communications. Signal messages are encrypted with
2183-404: The messages from both the sender's and the receivers' devices. The time period for keeping the message may be between five seconds and one week, and begins for each recipient once they have read their copy of the message. The developers stressed that this is meant to be "a collaborative feature for conversations where all participants want to automate minimal data hygiene, not for situations where
2242-417: The page for the secure messaging scorecard states that it is out of date and should not be used in privacy- and security-related decision-making. The company's products enable encrypted mobile phone calls, text messaging, and video chat. Its current products include the following: Its discontinued products include the following: Silent Circle Instant Message Protocol (SCIMP) was an encryption scheme that
2301-473: The platform to communicate. Black Lives Matter organizers had used the platform "for several years". During the first week of June, the encrypted messaging app was downloaded over five times more than it had been during the week prior to the murder of George Floyd . In June 2020, Signal Foundation announced a new feature that enables users to blur faces in photos, in response to increased federal efforts to monitor protesters. On 7 January 2021, Signal saw
2360-618: The project received grants from the Knight Foundation , the Shuttleworth Foundation , and almost $ 3 million from the US government–sponsored Open Technology Fund . Signal is now developed by Signal Messenger LLC, a software company founded by Moxie Marlinspike and Brian Acton in 2018, which is wholly owned by a tax-exempt nonprofit corporation called the Signal Technology Foundation , also created by them in 2018. The Foundation
2419-413: The providers don't have access to ( end-to-end encryption ), making it possible for users to independently verify their correspondent's identities, having past communications secure if the keys are stolen ( forward secrecy ), having their code open to independent review ( open source ), having their security designs well-documented, and having recent independent security audits. However, as of August 2020,
Dark Mail Alliance - Misplaced Pages Continue
2478-479: The recipient is an adversary". Signal's app icon may be changed from with a variety of colour themes for customization and to hide the app. The application name can also be customized. Messages can have effects like spoilers and italics, and users can add each other via QR code. Signal excludes users' messages from non-encrypted cloud backups by default. Signal allows users to automatically blur faces of people in photos to protect identities. Signal includes
2537-602: The relaying of messages and storing of public key material. The Signal Protocol also supports end-to-end encrypted group chats. The group chat protocol is a combination of a pairwise double ratchet and multicast encryption . In addition to the properties provided by the one-to-one protocol, the group chat protocol provides speaker consistency, out-of-order resilience, dropped message resilience, computational equality, trust equality, subgroup messaging, as well as contractible and expandable membership. In October 2014, researchers from Ruhr University Bochum published an analysis of
2596-426: The remaining parts of Silent Phone and Silent Text, the source code is available on GitHub , but under proprietary software licenses. In November 2011, Mike Janke called Phil Zimmermann with an idea for a new kind of private, secure version of Skype . Zimmermann agreed to the project and called Jon Callas , co-founder of PGP Corporation and Vincent Moscaritolo. Janke brought in security expert Vic Hyder, and
2655-570: The same time, Silent Circle transitioned to using a protocol that uses the Double Ratchet Algorithm instead of SCIMP. The company is privately funded and operates under a subscription business model . Signal (messaging app) Signal is an open-source , encrypted messaging service for instant messaging , voice calls , and video calls . The instant messaging function includes sending text, voice notes, images, videos, and other files. Communication may be one-to-one between users or may involve group messaging. The application uses
2714-502: The server. The server then checks to see if those match any of the SHA256 hashes of registered users and tells the client if any matches are found. The hashed numbers are thereafter discarded from the server. In 2014, Moxie Marlinspike wrote that it is easy to calculate a map of all possible hash inputs to hash outputs and reverse the mapping because of the limited preimage space (the set of all possible hash inputs) of phone numbers, and that
2773-410: The standard end-to-end encrypted Signal messages. Users could then use the same application to communicate with contacts who do not have Signal. As of October 2022, this feature has been deprecated due to safety and security concerns, and was removed in 2023. TextSecure allowed the user to set a passphrase that encrypted the local message database and the user's encryption keys. This did not encrypt
2832-426: The user provide a telephone number for verification, eliminating the need for user names or passwords and facilitating contact discovery (see below). The number does not have to be the same as on the device's SIM card; it can also be a VoIP number or a landline as long as the user can receive the verification code and have a separate device to set up the software. A number can only be registered on one mobile device at
2891-506: The user's contact database or message timestamps. The Signal applications on Android and iOS can be locked with the phone's pin, passphrase, or biometric authentication. The user can define a "screen lock timeout" interval, where Signal will re-encrypt the messages after a certain amount of time, providing an additional protection mechanism in case the phone is lost or stolen. Signal has a feature for scheduling messages. In addition, timers may be attached to messages to automatically delete
2950-453: The vulnerability shortly after it had been disclosed. In March 2015 there was a controversy when Information Security specialist and hacker Khalil Sehnaoui identified that Silent Circle's warrant canary had been removed from their site. In January 2017 Gregg Smith was named CEO with a renewed focus on serving the large business space as well as Government entities. At the same time Tony Cole, VP and Global Government CTO of FireEye ,
3009-513: The writing on the wall" and felt it was not possible to sufficiently secure email data with the looming threat of government compulsion and precedent set by the Lavabit shutdown the day before. In January 2015, Silent Text had a serious vulnerability that allowed an attacker to remotely take control of a Blackphone device. A potential attacker only needed to know the target’s Silent Circle ID number or phone number. Blackphone and Silent Circle patched
SECTION 50
#17328842570403068-568: Was a widely-requested feature. This feature was added to the beta version of Signal in February 2024. Using phone numbers as identifiers may also create security risks that arise from the possibility of an attacker taking over a phone number. A similar vulnerability was used to attack at least one user in August 2022, though the attack was performed via the provider of Signal's SMS services, not any user's provider. The threat of this attack can be mitigated by enabling Signal's Registration Lock feature,
3127-605: Was also released under the same license in July 2012. Marlinspike later left Twitter and founded Open Whisper Systems as a collaborative Open Source project for the continued development of TextSecure and RedPhone. Open Whisper Systems' website was launched in January 2013. In February 2014, Open Whisper Systems introduced the second version of their TextSecure Protocol (now Signal Protocol ), which added end-to-end encrypted group chat and instant messaging capabilities to TextSecure. Toward
3186-522: Was developed by Vincent Moscaritolo. It enabled private conversation over instant message transports such as XMPP (Jabber). SCIMP provided encryption, perfect forward secrecy and message authentication. It also handled negotiating the shared secret keys. The protocol was used in Silent Text. Silent Text was discontinued on September 28, 2015, when its features were merged into Silent Circle's encrypted voice calling application called Silent Phone. At
3245-453: Was downloaded more than 105 million times. Signal is the successor of the RedPhone encrypted voice calling app and the TextSecure encrypted texting program. The beta versions of RedPhone and TextSecure were first launched in May 2010 by Whisper Systems , a startup company co-founded by security researcher Moxie Marlinspike and roboticist Stuart Anderson. Whisper Systems also produced
3304-400: Was funded with an initial loan of $ 50 million from Acton, "to support, accelerate, and broaden Signal's mission of making private communication accessible and ubiquitous". All of the organization's products are published as free and open-source software . In November 2023, Meredith Whittaker revealed that she expected the annual cost of running Signal to reach $ 50 million in 2025, with
3363-587: Was launched by Whisper Systems . According to App Annie, Signal had approximately 20 million monthly active users at the end of December 2020. In January 2022, the BBC reported that Signal was used by over 40 million people. The development of Signal and its predecessors at Open Whisper Systems was funded by a combination of consulting contracts, donations and grants . The Freedom of the Press Foundation acted as Signal's fiscal sponsor . Between 2013 and 2016,
3422-595: Was named to the Board of Directors. Shortly after Smith became CEO, the company moved back from Switzerland to the United States. In November 2014, Silent Phone and Silent Text received top scores on the Electronic Frontier Foundation 's secure messaging scorecard, along with " ChatSecure + Orbot ", Cryptocat , TextSecure , and " Signal / RedPhone ". They received points for having communications encrypted in transit, having communications encrypted with keys
3481-419: Was the first iOS app to enable end-to-end encrypted voice calls for free. TextSecure compatibility was added to the iOS application in March 2015. From its launch in May 2010 until March 2015, the Android version of Signal (then called TextSecure) included support for encrypted SMS/ MMS messaging. From version 2.7.0 onward, the Android application only supported sending and receiving encrypted messages via
#39960