8 ms·

I'm a big fan of TextSecure and recommended it to all my friends, both those in IT and 'normal' people. Usually, I managed to convince them that the open source

I'm a big fan of TextSecure and recommended it to all my friends, both those in IT and 'normal' people. Usually, I managed to convince them that the open source nature of TextSecure and the crypto experts behind it (e.g. Moxie) make it more secure than Threema/... . However, the more sceptical ones among my friends always asked two questions, which I didn't have a good answer for: 1. What is TextSecure's business model? Who pays for the server infrastructure? 2. Doesn't WhisperSystems belong to Twitter? Twitter is a US-company (and also part of the NSA stuff), so why should I use that kind of software? [Edit for clarification: I'm from Germany, where the US/Twitter affiliation is seen as a downside by some people]. It would be great if TextSecure/Open Whispersystems publicly addressed these points. I have seen that there's a reply from Moxie here: http://support.whispersystems.org/customer/portal/questions/5836104-how-is-openwhispersystems-paying-for-the-its-server-costs- http://support.whispersystems.org/customer/portal/questions/... but these two questions are so central that they deserve more attention than a reply in the support forum. From a technological point of view, TextSecure wins hands down. Now it's time to convince those who are still skeptical because of other reasons. Just to be clear: I want TextSecure to become successful. I'm a big fan. That's why I'm mentioning this: in order to help spread the word.

phaer 12y ago
Afaik TextSecures server infrastructure consists mainly of Google Play Services which comes at no financial costs for them but with the downside of depending on Google to temporary store encrypted text.
- makomk 12y ago
  Yeah. The more substantial downside is that Google effectively has remote root access to every device which holds decryption keys for that text. That's not exactly ideal.
  - xyzzy123 12y ago
    I would be interested in your thoughts on alternative platforms / firmware /ecosystems which get around this?
    - jevinskie 12y ago
      Perhaps using Paranoid Android (if supported on your phone) would be a start.
- dublinben 12y ago
  I would rather pay a nominal fee to support their infrastructure than have to rely on Google Play Services for a supposedly "secure" messaging service.
  - phaer 12y ago
    I see you point but it should not weaken the security because encryption happens at the client, Google "only" gets metadata which at least authorities will get anyway. Besides, TextSecure is free software so it might possible to run your own server at least in the future.
    - higherpurpose 12y ago
      Google gets the metadata? That's news to me. I thought the metadata was encrypted by the TextSecure server?
      - phaer 12y ago
        I don't know, but I would have guessed that Google needs to know when it should deliver a message and where it should go, no? That is metadata in my definition.
        jlund 12y ago
        GCM payloads are fully encrypted. Google would be able to tell that you are a TextSecure user who is receiving a message, but they cannot tell who the message is coming from nor can they look at its contents (obviously).
        avn2109 12y ago
        But crucially, this will still be vulnerable to timing attacks, if I'm not mistaken.
        tptacek 12y ago
- jlund 12y ago
  This isn't entirely true. A detailed explanation is available in the Open WhisperSystems Support Center [1] and several solutions are in the works. Google's GCM push messaging framework is used only for message delivery; the TextSecure server itself is open source [2]. [1] http://support.whispersystems.org/customer/portal/articles/1476204-why-do-i-need-google-play-installed-to-use-textsecure-on-android- http://support.whispersystems.org/customer/portal/articles/1... [2] https://github.com/WhisperSystems/TextSecure-Server https://github.com/WhisperSystems/TextSecure-Server
  - acqq 12y ago
    It's true currently. At the support page you link first it is promised that it will be eventually changed but now: "Outside of Google's GCM, the fact is that there are no alternative push messaging frameworks for Android that can scale to the millions of users that TextSecure has. GCM requires Google Play." Note, the page confirms: Google Play still has to be installed to use TextSecure on Android. That is the current state. Google has practically the root access to the every Android device which runs TextSecure.
    - jlund 12y ago
      Full disclosure: I wrote that Support Center article. The comment I was replying to made it sound as though TextSecure's infrastructure is almost entirely Google-based. It is not, and that's what I meant when I said "This isn't entirely true." The server is open source and it already includes preliminary support for WebSockets and Apple's APN push messaging network. Google's GCM is merely one component, and alternatives are being worked on. Apple also has root access to all iOS devices via their over-the-air update framework. Opaque basebands and graphics chips with closed source drivers are difficult to trust too. None of these scenarios mean that software which offers serious improvements over the status quo should be casually dismissed. TextSecure can (and does) provide significant protection from mass surveillance and targeted surveillance. Security nihilism is corrosive.
      - acqq 12y ago
        So it's still true that currently the sever side uses only Google servers. It's nice to hear that there's work on the alternatives. What you call "nihilism" is simply the observation of the current state. At the moment Google has root access and all the metadata of all TextSecure users, and currently the user can't configure TextSecure to use some other servers even if he'd prefer to do so. Still I'm glad that I've seen that some server-side code is now open source.
Lx1oG-AWb6h_ZG0 12y ago
I'd like a good answer to the first question as well (it would be ideal if there was an easy way we could host it ourselves), at least OpenWhisperSystems does not belong to Twitter [0]: > Whisper Systems was a company focused on the development of mobile security software, which was acquired by Twitter in late 2011. Twitter very generously made some of the Whisper Systems software available under an Open Source license (GPLv3), which has since been under open development by the community. The software has seen a number of new releases based on that open development, and we’ve been calling the project for this continued work “Open Whisper Systems.” Welcome to the project’s new home. https://whispersystems.org/blog/welcome/ https://whispersystems.org/blog/welcome/
nmb 12y ago
https://twitter.com/moxie/status/437030748965449728 https://twitter.com/moxie/status/437030748965449728
deleted 12y ago
[deleted]
moxie 12y ago
> 1. What is TextSecure's business model? Who pays for the server infrastructure? It's a good question. TextSecure is not a business, so we don't really have a business model in the traditional sense. Open Whisper Systems is a collective project made up of volunteers and a growing number of contributors, who are sometimes paid by donations (https://whispersystems.org/blog/bithub/ https://whispersystems.org/blog/bithub/) and grants. Thus far, we've been able to smoothly fund the server infrastructure through grants and donations as well. I think we'll probably be able to continue that way indefinitely, but if that ever changed for any reason, we would consider charging small amounts for premium or high cost features like extremely large attachments. But in general, Open Whisper Systems is a project rather than a company, and the project's objective is not financial profit. I know that's a difficult thing to explain. > 2. Doesn't WhisperSystems belong to Twitter? Twitter is a US-company (and also part of the NSA stuff), so why should I use that kind of software? This is also confusing, but Open Whisper Systems is not Whisper Systems. Open Whisper Systems has no relationship with Twitter at all, and is a different organization that came together to facilitate development of the Whisper Systems software which was released under GPLv3. Twitter has never contributed money or resources to Open Whisper Systems, and is not in control of any of the infrastructure.
- ghughes 12y ago
  That is indeed confusing. Because the names are so similar, there is an implied close relationship between these two entities. Have you considered renaming the project?
- evmar 12y ago
  Hey moxie, I recently myself switched to using TextSecure (mostly was just looking from an SMS app from reputable people, but the crypto parts are a nice bonus). The above question about the business model was also my first question after my initial evaluation. It would be awesome if you could put this info somewhere on the website (maybe I missed it?).
- higherpurpose 12y ago
  What's the relation between the server and the SMS verification when setting up the app? I haven't tried TextSecure in a while, but when I tried right after you announced TextSecure v2, I kept getting failure to send me the SMS, and I had to receive the robo-call. I had a friend from another country who experienced the same. Is that still a problem?

phaer 12y ago

Afaik TextSecures server infrastructure consists mainly of Google Play Services which comes at no financial costs for them but with the downside of depending on Google to temporary store encrypted text.

makomk 12y ago
Yeah. The more substantial downside is that Google effectively has remote root access to every device which holds decryption keys for that text. That's not exactly ideal.
- xyzzy123 12y ago
  I would be interested in your thoughts on alternative platforms / firmware /ecosystems which get around this?
  - jevinskie 12y ago
    Perhaps using Paranoid Android (if supported on your phone) would be a start.
dublinben 12y ago
I would rather pay a nominal fee to support their infrastructure than have to rely on Google Play Services for a supposedly "secure" messaging service.
- phaer 12y ago
  I see you point but it should not weaken the security because encryption happens at the client, Google "only" gets metadata which at least authorities will get anyway. Besides, TextSecure is free software so it might possible to run your own server at least in the future.
  - higherpurpose 12y ago
    Google gets the metadata? That's news to me. I thought the metadata was encrypted by the TextSecure server?
    - phaer 12y ago
      I don't know, but I would have guessed that Google needs to know when it should deliver a message and where it should go, no? That is metadata in my definition.
      - jlund 12y ago
        GCM payloads are fully encrypted. Google would be able to tell that you are a TextSecure user who is receiving a message, but they cannot tell who the message is coming from nor can they look at its contents (obviously).
        avn2109 12y ago
        But crucially, this will still be vulnerable to timing attacks, if I'm not mistaken.
        tptacek 12y ago
jlund 12y ago
This isn't entirely true. A detailed explanation is available in the Open WhisperSystems Support Center [1] and several solutions are in the works. Google's GCM push messaging framework is used only for message delivery; the TextSecure server itself is open source [2]. [1] http://support.whispersystems.org/customer/portal/articles/1476204-why-do-i-need-google-play-installed-to-use-textsecure-on-android- http://support.whispersystems.org/customer/portal/articles/1... [2] https://github.com/WhisperSystems/TextSecure-Server https://github.com/WhisperSystems/TextSecure-Server
- acqq 12y ago
  It's true currently. At the support page you link first it is promised that it will be eventually changed but now: "Outside of Google's GCM, the fact is that there are no alternative push messaging frameworks for Android that can scale to the millions of users that TextSecure has. GCM requires Google Play." Note, the page confirms: Google Play still has to be installed to use TextSecure on Android. That is the current state. Google has practically the root access to the every Android device which runs TextSecure.
  - jlund 12y ago
    Full disclosure: I wrote that Support Center article. The comment I was replying to made it sound as though TextSecure's infrastructure is almost entirely Google-based. It is not, and that's what I meant when I said "This isn't entirely true." The server is open source and it already includes preliminary support for WebSockets and Apple's APN push messaging network. Google's GCM is merely one component, and alternatives are being worked on. Apple also has root access to all iOS devices via their over-the-air update framework. Opaque basebands and graphics chips with closed source drivers are difficult to trust too. None of these scenarios mean that software which offers serious improvements over the status quo should be casually dismissed. TextSecure can (and does) provide significant protection from mass surveillance and targeted surveillance. Security nihilism is corrosive.
    - acqq 12y ago
      So it's still true that currently the sever side uses only Google servers. It's nice to hear that there's work on the alternatives. What you call "nihilism" is simply the observation of the current state. At the moment Google has root access and all the metadata of all TextSecure users, and currently the user can't configure TextSecure to use some other servers even if he'd prefer to do so. Still I'm glad that I've seen that some server-side code is now open source.

Lx1oG-AWb6h_ZG0 12y ago

I'd like a good answer to the first question as well (it would be ideal if there was an easy way we could host it ourselves), at least OpenWhisperSystems does not belong to Twitter [0]: > Whisper Systems was a company focused on the development of mobile security software, which was acquired by Twitter in late 2011. Twitter very generously made some of the Whisper Systems software available under an Open Source license (GPLv3), which has since been under open development by the community. The software has seen a number of new releases based on that open development, and we’ve been calling the project for this continued work “Open Whisper Systems.” Welcome to the project’s new home. https://whispersystems.org/blog/welcome/ https://whispersystems.org/blog/welcome/

nmb 12y ago

https://twitter.com/moxie/status/437030748965449728 https://twitter.com/moxie/status/437030748965449728

deleted 12y ago

[deleted]

moxie 12y ago

> 1. What is TextSecure's business model? Who pays for the server infrastructure? It's a good question. TextSecure is not a business, so we don't really have a business model in the traditional sense. Open Whisper Systems is a collective project made up of volunteers and a growing number of contributors, who are sometimes paid by donations (https://whispersystems.org/blog/bithub/ https://whispersystems.org/blog/bithub/) and grants. Thus far, we've been able to smoothly fund the server infrastructure through grants and donations as well. I think we'll probably be able to continue that way indefinitely, but if that ever changed for any reason, we would consider charging small amounts for premium or high cost features like extremely large attachments. But in general, Open Whisper Systems is a project rather than a company, and the project's objective is not financial profit. I know that's a difficult thing to explain. > 2. Doesn't WhisperSystems belong to Twitter? Twitter is a US-company (and also part of the NSA stuff), so why should I use that kind of software? This is also confusing, but Open Whisper Systems is not Whisper Systems. Open Whisper Systems has no relationship with Twitter at all, and is a different organization that came together to facilitate development of the Whisper Systems software which was released under GPLv3. Twitter has never contributed money or resources to Open Whisper Systems, and is not in control of any of the infrastructure.

ghughes 12y ago
That is indeed confusing. Because the names are so similar, there is an implied close relationship between these two entities. Have you considered renaming the project?
evmar 12y ago
Hey moxie, I recently myself switched to using TextSecure (mostly was just looking from an SMS app from reputable people, but the crypto parts are a nice bonus). The above question about the business model was also my first question after my initial evaluation. It would be awesome if you could put this info somewhere on the website (maybe I missed it?).
higherpurpose 12y ago
What's the relation between the server and the SMS verification when setting up the app? I haven't tried TextSecure in a while, but when I tried right after you announced TextSecure v2, I kept getting failure to send me the SMS, and I had to receive the robo-call. I had a friend from another country who experienced the same. Is that still a problem?