Moxie Marlinspike: From sslstrip to Signal

Moxie Marlinspike describes his past jobs as "founder, engineer, sailor, captain, and shipwright," in that order, and he isn't kidding about the boats.

He's also the hacker who showed a Black Hat audience in 2009 how to quietly strip the encryption off a secure website, the founder who sold a startup to Twitter, and the cryptographer whose protocol now scrambles the chats of more than a billion WhatsApp users.

Then, in 2022, at the top of his game, he resigned as CEO of Signal, the app that carries his life's work. He said the team no longer needed him. He may have been right.

Moxie Marlinspike at a Glance

• Marlinspike has hopped freight trains across the United States and sailed boats that were in no condition to be sailed, and he says he values "skills and relationships over careers and money."
• In February 2009 he presented sslstrip at Black Hat DC, a tool that turned HTTPS links into plain HTTP without the victim noticing; by 2010 he was known for breaking SSL certificates in several other ways.
• Around 2010 he co-founded Whisper Systems, which built TextSecure for encrypted texting and RedPhone for encrypted calls; Twitter bought the company in late 2011 and released its software as open source.
• In January 2013 he announced Open Whisper Systems, a community project that took over TextSecure and RedPhone and, in November 2015, merged them into Signal.
• On April 5, 2016, WhatsApp finished rolling out the Signal Protocol to more than a billion monthly users, making his design the most widely used end-to-end encryption on earth.
• In February 2018 WhatsApp co-founder Brian Acton put $50 million into the new Signal Foundation, with Marlinspike as CEO of Signal Messenger.
• In 2021 he said he watched a Cellebrite phone-cracking kit "fall off a truck," took it home and published vulnerabilities that could corrupt every report the tool had ever produced.
• He stepped down as Signal's CEO on January 10, 2022, handing the job to Acton on an interim basis, and now writes essays from California.

The Life of Moxie Marlinspike

A Hacker With a Boat

Marlinspike guards his biography. His website says only that he's worked as a founder, engineer, sailor, captain and shipwright, that he's crossed the country on freight trains and sailed deteriorating vessels, and that he lives in California.

The philosophy he does share is consistent: prioritize skills and relationships over careers and money, pursue what you find interesting, and keep a healthy suspicion of anyone in authority. It reads like a manifesto, and it explains most of what followed.

Stripping SSL

By 2010 the DEF CON program described him as a fellow at the Institute For Disruptive Studies with more than thirteen years of experience attacking networks, which puts his start in the mid-1990s.

His specialty was the padlock icon. In February 2009, at Black Hat DC, he gave a talk titled "New Tricks for Defeating SSL in Practice" and released sslstrip, a man-in-the-middle tool that watched for links to HTTPS pages and silently rewrote them to HTTP, so the victim's browser never asked for encryption at all.

He followed it with null-prefix attacks on X.509 certificates and session-denial attacks against OCSP, the protocol that checks whether a certificate has been revoked. His earlier tool, sslsniff, was used by the research team that forged a rogue certificate authority through an MD5 collision.

By 2011 he was sharing a DEF CON stage with Whitfield Diffie, the co-inventor of public-key cryptography, to argue about certificate authorities and what he called trust agility. The system that secured the web, he kept saying, rested on a few hundred companies nobody had chosen to trust.

Whisper Systems

Breaking things got old. Around 2010 Marlinspike co-founded Whisper Systems, a mobile security company that shipped two Android apps: TextSecure, which encrypted text messages, and RedPhone, which encrypted voice calls.

In late 2011 Twitter acquired the company. The deal could've been the end of both apps, but Twitter released the Whisper Systems software under the GPLv3 open-source license, and the code survived its owner.

Open Whisper Systems

On January 21, 2013, Marlinspike published a post titled "A New Home." The community that'd grown around the freed code would now be called Open Whisper Systems, maintaining TextSecure and RedPhone with one goal: to make it as easy as possible "for anyone to be able to organize and communicate securely."

In February 2014, TextSecure v2 turned the SMS app into a full internet messenger with forward secrecy, encrypted group chat and no reliance on the phone network. The protocol was already running on more than 10 million phones through CyanogenMod, and the stated aim was secure messaging "as easy and reliable to use as making a normal phone call."

On November 2, 2015, TextSecure and RedPhone merged into a single Android app called Signal, finishing a job that'd started on the iPhone. "Everything in Signal is always end-to-end encrypted," the announcement said, and there'd be no ads, only donations and grants.

A Billion Users Overnight

The bigger win happened inside someone else's app. On April 5, 2016, Marlinspike announced that WhatsApp had completed its integration of the Signal Protocol across every platform and every kind of message, from group chats to voice calls.

More than a billion monthly users were now protected by end-to-end encryption by default, most of them without ever hearing the name Moxie Marlinspike. WhatsApp even added his "security codes," strings of 60 digits users could compare to verify each other.

The Foundation

Signal had been running on grants and the goodwill of the Freedom of the Press Foundation, which acted as its fiscal sponsor. On February 21, 2018, that changed.

Brian Acton, who'd co-founded WhatsApp and sold it to Facebook, gave $50 million to launch the Signal Foundation, a 501(c)(3) nonprofit, and took the job of executive chairman. Marlinspike became CEO of Signal Messenger underneath it. The pitch, in Acton's words, was a structure "free of the inherent limitations of a for-profit company."

Fell Off a Truck

In April 2021, Marlinspike wrote that while out on a walk he'd seen a small package "fall off a truck" ahead of him. Inside, by a truly unbelievable coincidence, was a Cellebrite kit: the software police use to extract data from seized phones, a licensing dongle and a bag of cable adapters.

He took it apart. The software bundled FFmpeg libraries from 2012 that'd missed more than 100 security patches, and he showed that a specially crafted file sitting on a phone could run code on the Cellebrite machine scanning it, altering not just that report but every past and future report the tool produced.

The post ended with a straight face and a note that future versions of Signal might start fetching files of their own into the app's storage, purely because, he wrote, "aesthetics are important in software."

Walking Away

On January 10, 2022, Marlinspike announced he was stepping down as Signal's CEO. When he started, he wrote, he'd written all of the Android code and all of the server code himself and had been the only person on call; now there was a team of 30, and "the values and the mission that Signal was built on are embedded in the whole of the organization."

Acton stepped in as interim CEO while the board searched for a successor. Three days earlier Marlinspike had published his first impressions of web3, an essay that punctured the hype with a single observation: "People do not want to run their own servers."

Since then he's written at his own pace, on California, on the difference between engineering and science, on whatever catches his interest. The boats, presumably, are still there.

Moxie Marlinspike: The Captain Who Left the Bridge

Most people who build something used by a billion people don't give it away, and most people who run a successful organization don't resign because it no longer needs them.

Marlinspike did both. The protocol he designed is now the default for private conversation on the planet, and Signal, the app that bears his fingerprints, runs on donations and refuses to collect what it doesn't need.

He said he valued skills and relationships over careers and money. For once, somebody meant it.