Moxie Marlinspike

Last updated

Moxie Marlinspike
Moxie Marlinspike in 2022 02.jpg
Marlinspike in 2022
BornEarly 1980s [1]
Georgia, U.S.
Other namesMatthew Rosenfeld [2]
Known for
Scientific career
Fields
Website moxie.org OOjs UI icon edit-ltr-progressive.svg

Matthew Rosenfeld, better known by the pseudonym Moxie Marlinspike, is an American entrepreneur, cryptographer, and computer security researcher. [1] [3] Marlinspike is the creator of Signal, co-founder of the Signal Technology Foundation, and served as the first CEO of Signal Messenger LLC. He is also a co-author of the Signal Protocol encryption used by Signal, WhatsApp, [4] Google Messages, [5] Facebook Messenger, [6] and Skype. [7]

Contents

Marlinspike is a former head of the security team at Twitter [8] and the author of a proposed SSL authentication system replacement called Convergence. [9] He previously maintained a cloud-based WPA cracking service [10] and a targeted anonymity service called GoogleSharing. [11]

Career

Marlinspike began his career working for several technology companies, including enterprise infrastructure software maker BEA Systems Inc. [4] [12]

In 2010, Marlinspike was the chief technology officer and co-founder of Whisper Systems, [13] an enterprise mobile security startup company. In May 2010, Whisper Systems launched TextSecure and RedPhone. These were applications that provided end-to-end encrypted SMS messaging and voice calling, respectively. Twitter acquired the company for an undisclosed amount in late 2011. [14] The acquisition was done "primarily so that Mr. Marlinspike could help the then-startup improve its security". [12] During his time as Twitter's head of cybersecurity, [15] the firm made Whisper Systems' apps open source. [16] [17]

Marlinspike left Twitter in early 2013 and founded Open Whisper Systems as a collaborative open source project for the continued development of TextSecure and RedPhone. [18] [19] [20] At the time, Marlinspike and Trevor Perrin started developing the Signal Protocol, an early version of which was first introduced in the TextSecure app in February 2014. [21] In November 2015, Open Whisper Systems unified the TextSecure and RedPhone applications as Signal. [22] Between 2014 and 2016, Marlinspike worked with WhatsApp, Facebook, and Google to integrate the Signal Protocol into their messaging services. [23] [24] [25]

On February 21, 2018, Marlinspike and WhatsApp co-founder Brian Acton announced the formation of the Signal Technology Foundation and its subsidiary, Signal Messenger LLC. [26] [1] Marlinspike served as Signal Messenger's first CEO until stepping down on January 10, 2022. [27]

Research

SSL stripping

In a 2009 paper, Marlinspike introduced the concept of SSL stripping, a man-in-the-middle attack in which a network attacker could prevent a web browser from upgrading to an SSL connection in a way that would likely go unnoticed by a user. He also announced the release of a tool, sslstrip, that would automatically perform these types of man-in-the-middle attacks. [28] [29] The HTTP Strict Transport Security (HSTS) specification was subsequently developed to combat these attacks. [30]

SSL implementation attacks

Marlinspike has discovered a number of different vulnerabilities in popular SSL implementations. Notably, he published a 2002 paper on exploiting SSL/TLS implementations that did not correctly verify the X.509 v3 "BasicConstraints" extension in public key certificate chains. This allowed anyone with a valid CA-signed certificate for any domain name to create what appeared to be valid CA-signed certificates for any other domain. The vulnerable SSL/TLS implementations included the Microsoft CryptoAPI, making Internet Explorer and all other Windows software that relied on SSL/TLS connections vulnerable to a man-in-the-middle attack. In 2011, the same vulnerability was discovered to have remained in the SSL/TLS implementation on Apple Inc.'s iOS. [31] [32] Also notably, Marlinspike presented a 2009 paper in which he introduced the concept of a null-prefix attack on SSL certificates. He revealed that all major SSL implementations failed to properly verify the Common Name value of a certificate, so that they could be tricked into accepting forged certificates by embedding null characters into the CN field. [33] [34]

Solutions to the CA problem

In 2011, Marlinspike presented a talk, "SSL And The Future Of Authenticity", [35] at the Black Hat security conference in Las Vegas. He outlined many of the problems with certificate authorities and announced the release of a software project called Convergence to replace them. [36] [37] In 2012, Marlinspike and Perrin submitted an Internet Draft for TACK, [38] which is designed to provide SSL certificate pinning and help solve the CA problem, to the Internet Engineering Task Force. [39]

Cracking MS-CHAPv2

In 2012, Marlinspike and David Hulton presented research that makes it possible to reduce the security of MS-CHAPv2 handshakes to a single DES encryption. Hulton built hardware capable of cracking the remaining DES encryption in less than 24 hours, and the two made the hardware available for anyone to use as an Internet service. [40]

Mobily surveillance controversy

In 2013, Marlinspike published emails on his blog that he claimed were from Saudi Arabian telecom service Mobily soliciting his help in surveilling their customers, including intercepting communications running through various applications. Marlinspike refused to help, making the emails public instead. Mobily denied the allegations. "We never communicate with hackers", the company said. [41]

Traveling

Marlinspike says that when flying within the United States he is unable to print his own boarding pass, is required to have airline ticketing agents make a phone call in order to issue one, and is subjected to secondary screening at TSA security checkpoints. [42]

While entering the U.S. on a flight from the Dominican Republic in 2010, Marlinspike was detained by federal agents for nearly five hours, all his electronic devices were confiscated, and at first agents claimed he would only get them back if he provided his passwords so they could decrypt the data. Marlinspike refused to do this, and the devices were eventually returned, though he noted that he could no longer trust them, saying, "They could have modified the hardware or installed new keyboard firmware." [43]

Recognition

Personal life

Originally from the state of Georgia, [4] Marlinspike moved to San Francisco in the late 1990s at age 18. [1] [12] The name Moxie Marlinspike is an assumed name partly derived from a childhood nickname. [1] [4]

Marlinspike is a sailing enthusiast and master mariner. [4] [48] In 2004, he bought a derelict sailboat and, with three friends, refurbished it and sailed around the Bahamas while making a "video zine" about their journey called Hold Fast. [1] [4] [12] He is also an anarchist, [4] and several of his essays and speeches are published on the website The Anarchist Library, including "An Anarchist Critique of Democracy" [49] and "The Promise of Defeat." [50]

Related Research Articles

<span class="mw-page-title-main">HTTPS</span> Extension of the HTTP communications protocol to support TLS encryption

Hypertext Transfer Protocol Secure (HTTPS) is an extension of the Hypertext Transfer Protocol (HTTP). It uses encryption for secure communication over a computer network, and is widely used on the Internet. In HTTPS, the communication protocol is encrypted using Transport Layer Security (TLS) or, formerly, Secure Sockets Layer (SSL). The protocol is therefore also referred to as HTTP over TLS, or HTTP over SSL.

Transport Layer Security (TLS) is a cryptographic protocol designed to provide communications security over a computer network, such as the Internet. The protocol is widely used in applications such as email, instant messaging, and voice over IP, but its use in securing HTTPS remains the most publicly visible.

End-to-end encryption (E2EE) is a private communication system in which only communicating users can participate. As such, no one else, including the communication system provider, telecom providers, Internet providers or malicious actors, can access the cryptographic keys needed to converse. End-to-end encryption is intended to prevent data being read or secretly modified, other than by the true sender and recipient(s). The messages are encrypted by the sender but the third party does not have a means to decrypt them, and stores them encrypted. The recipients retrieve the encrypted data and decrypt it themselves. Because no third parties can decipher the data being communicated or stored, for example, companies that provide end-to-end encryption are unable to hand over texts of their customers' messages to the authorities.

This is a comparison of voice over IP (VoIP) software used to conduct telephone-like voice conversations across Internet Protocol (IP) based networks. For residential markets, voice over IP phone service is often cheaper than traditional public switched telephone network (PSTN) service and can remove geographic restrictions to telephone numbers, e.g., have a PSTN phone number in a New York area code ring in Tokyo.

Server Name Indication (SNI) is an extension to the Transport Layer Security (TLS) computer networking protocol by which a client indicates which hostname it is attempting to connect to at the start of the handshaking process. The extension allows a server to present one of multiple possible certificates on the same IP address and TCP port number and hence allows multiple secure (HTTPS) websites to be served by the same IP address without requiring all those sites to use the same certificate. It is the conceptual equivalent to HTTP/1.1 name-based virtual hosting, but for HTTPS. This also allows a proxy to forward client traffic to the right server during TLS/SSL handshake. The desired hostname is not encrypted in the original SNI extension, so an eavesdropper can see which site is being requested. The SNI extension was specified in 2003 in RFC 3546

There are various implementations of the Advanced Encryption Standard, also known as Rijndael.

Whisper Systems was an American enterprise mobile security company that was co-founded by security researcher Moxie Marlinspike and roboticist Stuart Anderson in 2010. The company was acquired by Twitter in November 2011. Some of the company's software products were released under open-source licenses after the acquisition. An independent group called Open Whisper Systems later picked up the development of this open-source software, which led to the creation of the Signal Technology Foundation.

TextSecure was an encrypted messaging application for Android that was developed from 2010 to 2015. It was a predecessor to Signal and the first application to use the Signal Protocol, which has since been implemented into WhatsApp and other applications. TextSecure used end-to-end encryption to secure the transmission of text messages, group messages, attachments and media messages to other TextSecure users.

<span class="mw-page-title-main">Open Whisper Systems</span> Open source software organization

Open Whisper Systems was a software development group that was founded by Moxie Marlinspike in 2013. The group picked up the open source development of TextSecure and RedPhone, and was later responsible for starting the development of the Signal Protocol and the Signal messaging app. In 2018, Signal Messenger was incorporated as an LLC by Moxie Marlinspike and Brian Acton and then rolled under the independent 501c3 non-profit Signal Technology Foundation. Today, the Signal app is developed by Signal Messenger LLC, which is funded by the Signal Technology Foundation.

HTTPS Everywhere is a discontinued free and open-source browser extension for Google Chrome, Microsoft Edge, Mozilla Firefox, Opera, Brave, Vivaldi and Firefox for Android, which was developed collaboratively by The Tor Project and the Electronic Frontier Foundation (EFF). It automatically makes websites use a more secure HTTPS connection instead of HTTP, if they support it. The option "Encrypt All Sites Eligible" makes it possible to block and unblock all non-HTTPS browser connections with one click. Due to the widespread adoption of HTTPS on the World Wide Web, and the integration of HTTPS-only mode on major browsers, the extension was retired in January 2023.

Let's Encrypt is a non-profit certificate authority run by Internet Security Research Group (ISRG) that provides X.509 certificates for Transport Layer Security (TLS) encryption at no charge. It is the world's largest certificate authority, used by more than 300 million websites, with the goal of all websites being secure and using HTTPS. The Internet Security Research Group (ISRG), the provider of the service, is a public benefit organization. Major sponsors include the Electronic Frontier Foundation (EFF), the Mozilla Foundation, OVH, Cisco Systems, Facebook, Google Chrome, Internet Society, AWS, NGINX, and Bill and Melinda Gates Foundation. Other partners include the certificate authority IdenTrust, the University of Michigan (U-M), and the Linux Foundation.

<span class="mw-page-title-main">Signal (software)</span> Privacy-focused encrypted messaging app

Signal is an open-source, encrypted messaging service for instant messaging, voice calls, and video calls. The instant messaging function includes sending text, voice notes, images, videos, and other files. Communication may be one-to-one between users or may involve group messaging.

Peerio was a cross-platform end-to-end encrypted application that provided secure messaging, file sharing, and cloud file storage. Peerio was available as an application for iOS, Android, macOS, Windows, and Linux. Peerio (Legacy) was originally released on 14 January 2015, and was replaced by Peerio 2 on 15 June 2017. The app is discontinued.

<span class="mw-page-title-main">Double Ratchet Algorithm</span> Cryptographic key management algorithm

In cryptography, the Double Ratchet Algorithm is a key management algorithm that was developed by Trevor Perrin and Moxie Marlinspike in 2013. It can be used as part of a cryptographic protocol to provide end-to-end encryption for instant messaging. After an initial key exchange it manages the ongoing renewal and maintenance of short-lived session keys. It combines a cryptographic so-called "ratchet" based on the Diffie–Hellman key exchange (DH) and a ratchet based on a key derivation function (KDF), such as a hash function, and is therefore called a double ratchet.

<span class="mw-page-title-main">Signal Protocol</span> Non-federated cryptographic protocol

The Signal Protocol is a non-federated cryptographic protocol that provides end-to-end encryption for voice and instant messaging conversations. The protocol was developed by Open Whisper Systems in 2013 and was introduced in the open-source TextSecure app, which later became Signal. Several closed-source applications have implemented the protocol, such as WhatsApp, which is said to encrypt the conversations of "more than a billion people worldwide" or Google who provides end-to-end encryption by default to all RCS-based conversations between users of their Google Messages app for one-to-one conversations. Facebook Messenger also say they offer the protocol for optional Secret Conversations, as does Skype for its Private Conversations.

<span class="mw-page-title-main">Domain fronting</span> Technique for Internet censorship circumvention

Domain fronting is a technique for Internet censorship circumvention that uses different domain names in different communication layers of an HTTPS connection to discreetly connect to a different target domain than that which is discernable to third parties monitoring the requests and connections.

<span class="mw-page-title-main">Signal Foundation</span> American non-profit organization

The Signal Technology Foundation, commonly known as the Signal Foundation, is an American non-profit organization founded in 2018 by Moxie Marlinspike and Brian Acton. Its mission is to "protect free expression and enable secure global communication through open source privacy technology." Its subsidiary, Signal Messenger LLC, is responsible for the development of the Signal messaging app and the Signal Protocol.

MobileCoin is a peer-to-peer cryptocurrency developed by MobileCoin Inc., which was founded in 2017 by Josh Goldbard and Shane Glynn.

<span class="mw-page-title-main">Hugo Krawczyk</span> Argentine-Israeli cryptographer

Hugo Krawczyk is an Argentine-Israeli cryptographer best known for co-inventing the HMAC message authentication algorithm and contributing in fundamental ways to the cryptographic architecture of central Internet standards, including IPsec, IKE, and SSL/TLS. In particular, both IKEv2 and TLS 1.3 use Krawczyk’s SIGMA protocol as the cryptographic core of their key exchange procedures. He has also contributed foundational work in the areas of threshold and proactive cryptosystems and searchable symmetric encryption, among others.

<span class="mw-page-title-main">Silence (software)</span>

Silence is a free, open-source messaging encryption software, based on a fork from TextSecure software. It allows the secure exchange of SMS and MMS-type messages with other Silence or TextSecure users. The program allows message encryption and identity verification between correspondents by comparing the fingerprint of the encryption keys.

References

  1. 1 2 3 4 5 6 Wiener, Anna (October 19, 2020). "Taking Back Our Privacy : Moxie Marlinspike, the founder of the end-to-end encrypted messaging service Signal, is "trying to bring normality to the Internet."". The New Yorker . Archived from the original on March 5, 2021. Retrieved October 27, 2020.
  2. ↑ "Moxie Marlinspike leaves encrypted-messaging app Signal". BBC News. January 11, 2022. Retrieved July 7, 2024.
  3. ↑ Rosenblum, Andrew (April 26, 2016). "Moxie Marlinspike Makes Encryption for Everyone". Popular Science. Bonnier Corporation. Retrieved July 9, 2016.
  4. 1 2 3 4 5 6 7 Greenberg, Andy (July 31, 2016). "Meet Moxie Marlinspike, the Anarchist Bringing Encryption to All of Us". Wired. Condé Nast. Archived from the original on January 25, 2021. Retrieved July 31, 2016.
  5. ↑ Amadeo, Ron (June 16, 2021). "Google enables end-to-end encryption for Android's default SMS/RCS app". Ars Technica. Retrieved March 3, 2022.
  6. ↑ Greenberg, Andy (October 4, 2016). "You can finally encrypt Facebook Messenger, so do it". Wired.
  7. ↑ Newman, Lily Hay (January 11, 2018). "Skype Finally Starts Rolling Out End-to-End Encryption". Wired.
  8. ↑ Hern, Alex (October 17, 2014). "Twitter's former security head condemns Whisper's privacy flaws". The Guardian. Retrieved January 22, 2015.
  9. ↑ Messmer, Ellen (October 12, 2011). "The SSL certificate industry can and should be replaced". Network World. IDG. Archived from the original on March 1, 2014. Retrieved September 25, 2016.
  10. ↑ "New Cloud-Based Service Steals Wi-fi Passwords". PC World. Archived from the original on April 20, 2012. Retrieved December 9, 2013.
  11. ↑ "A Better Way To Hide From Google". Forbes. November 25, 2013. Archived from the original on October 12, 2013. Retrieved December 9, 2013.
  12. 1 2 3 4 Yadron, Danny (July 9, 2015). "Moxie Marlinspike: The Coder Who Encrypted Your Texts". The Wall Street Journal. Archived from the original on July 10, 2015. Retrieved September 27, 2016.
  13. ↑ Mills, Elinor (March 15, 2011). "CNet: WhisperCore App Encrypts All Data For Android". News.cnet.com. Retrieved December 9, 2013.
  14. ↑ "Twitter Acquires Moxie Marlinspike's Encryption Startup Whisper Systems". Forbes. Retrieved October 4, 2013.
  15. ↑ Powers, Shawn M.; Jablonski, Michael (February 2015). The Real Cyber War: The Political Economy of Internet Freedom. University of Illinois Press. p. 198. ISBN   978-0-252-09710-2. JSTOR   10.5406/j.ctt130jtjf.
  16. ↑ Chris Aniszczyk (December 20, 2011). "The Whispers Are True". The Twitter Developer Blog. Twitter. Archived from the original on October 24, 2014. Retrieved January 22, 2015.
  17. ↑ "RedPhone is now Open Source!". Whisper Systems. July 18, 2012. Archived from the original on July 31, 2012. Retrieved January 22, 2015.
  18. ↑ Yadron, Danny (July 10, 2015). "What Moxie Marlinspike Did at Twitter". Digits. The Wall Street Journal. Archived from the original on March 18, 2016. Retrieved September 27, 2016.
  19. ↑ Andy Greenberg (July 29, 2014). "Your iPhone Can Finally Make Free, Encrypted Calls". Wired. Retrieved January 18, 2015.
  20. ↑ "A New Home". Open Whisper Systems. January 21, 2013. Retrieved July 11, 2015.
  21. ↑ Donohue, Brian (February 24, 2014). "TextSecure Sheds SMS in Latest Version". Threatpost. Retrieved July 14, 2016.
  22. ↑ Greenberg, Andy (November 2, 2015). "Signal, the Snowden-Approved Crypto App, Comes to Android". Wired. Condé Nast. Retrieved November 24, 2015.
  23. ↑ Metz, Cade (April 5, 2016). "Forget Apple vs. the FBI: WhatsApp Just Switched on Encryption for a Billion People". Wired. Condé Nast. Retrieved August 2, 2016.
  24. ↑ Greenberg, Andy (July 8, 2016). "'Secret Conversations:' End-to-End Encryption Comes to Facebook Messenger". Wired. Condé Nast. Retrieved September 24, 2016.
  25. ↑ Greenberg, Andy (May 18, 2016). "With Allo and Duo, Google Finally Encrypts Conversations End-to-End". Wired. Condé Nast. Retrieved September 24, 2016.
  26. ↑ Marlinspike, Moxie; Acton, Brian (February 21, 2018). "Signal Foundation". Signal.org. Retrieved February 21, 2018.
  27. ↑ Marlinspike, Moxie (January 10, 2022). "New year, new CEO". signal.org. Signal Messenger. Retrieved January 10, 2022.
  28. ↑ Greenberg, Andy (February 18, 2009). "Breaking Your Browser's Padlock". Forbes. Archived from the original on February 27, 2014.
  29. ↑ Kelly Jackson Higgins February 24, 2009 (February 24, 2009). "SSLStrip Hacking Tool Released". Darkreading.com. Retrieved December 9, 2013.{{cite web}}: CS1 maint: numeric names: authors list (link)
  30. ↑ Bramwell, Phil (2018). Hands-On Penetration Testing on Windows: Unleash Kali Linux, PowerShell, and Windows debugging tools for security testing and analysis. Packt Publishing. p. 96. ISBN   978-1-78829-509-3.
  31. ↑ Apple iOS Bug Worse Than Advertised/
  32. ↑ "iPhone data interception tool released". Scmagazine.com.au. July 27, 2011. Archived from the original on December 14, 2013. Retrieved December 9, 2013.
  33. ↑ Zetter, Kim (July 30, 2009). "Vulnerabilities Allow Attackers To Impersonate Any Website". Wired.com. Retrieved December 9, 2013.
  34. ↑ Goodin, Dan (July 30, 2009). "Wildcard certificate spoofs web authentication". Theregister.co.uk. Retrieved December 9, 2013.
  35. ↑ "SSL And The Future Of Authenticity". Youtube.com. August 18, 2011. Archived from the original on December 21, 2021. Retrieved December 9, 2013.
  36. ↑ "New SSL Alternative". Informationweek.com. Archived from the original on October 1, 2011. Retrieved December 9, 2013.
  37. ↑ "Future of SSL in doubt?". Infosecurity-magazine.com. August 9, 2011. Retrieved December 9, 2013.
  38. ↑ "Trust Assertions For Certificate Keys". Tack.io. Retrieved December 9, 2013.
  39. ↑ Goodin, Dan (May 23, 2012). "SSL fix flags forged certificates". Arstechnica.com. Retrieved December 9, 2013.
  40. ↑ "New Tool From Moxie Marlinspike Cracks Some Crypto Passwords". threatpost. August 19, 2012. Archived from the original on August 19, 2012.{{cite web}}: CS1 maint: bot: original URL status unknown (link)
  41. ↑ Smith, Matt (May 15, 2013). "Saudi's Mobily denies asking for help to spy on customers". Reuters. Retrieved February 21, 2018.
  42. ↑ Mills, Elinor (November 18, 2010). "Security researcher: I keep getting detained by feds". CNET . Retrieved June 19, 2019.
  43. ↑ Zetter, Kim (November 18, 2010). "Another Hacker's Laptop, Cellphones Searched At Border". Wired.com. Retrieved November 8, 2024.
  44. ↑ "Moxie Marlinspike - 40 under 40". Fortune. Time Inc. 2016. Archived from the original on August 18, 2017. Retrieved September 22, 2016.
  45. ↑ WIRED Staff (April 26, 2016). "25 Geniuses Who Are Creating the Future of Business". Wired. ISSN   1059-1028 . Retrieved March 19, 2020.
  46. ↑ "The Levchin Prize for Real World Cryptography". RealWorldCrypto.
  47. ↑ Levchin, Max (January 4, 2017). "2017 Levchin Prize for Real World Cryptography". Yahoo! Finance. Retrieved February 7, 2018.
  48. ↑ "Moxie Marlinspike >> About" . Retrieved November 22, 2022.
  49. ↑ Marlinspike, Moxie; Hart, Windy (June 21, 2012). "An Anarchist Critique of Democracy". The Anarchist Library. Retrieved November 22, 2022.
  50. ↑ Marlinspike, Moxie (August 4, 2020). "The Promise of Defeat". The Anarchist Library. Retrieved November 22, 2022.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.