Moxie Marlinspike

Moxie Marlinspike is an American computer security researcher, cryptographer, and entrepreneur best known for exposing systemic weaknesses in the SSL/TLS certificate system and for later co-creating the Signal Protocol, the end-to-end encryption technology that underlies the Signal messaging app and secures conversations on WhatsApp, Facebook Messenger, and other major platforms.

Early SSL/TLS Research

As early as 2002, Marlinspike published research showing that many SSL/TLS implementations failed to properly verify certificate chains, allowing an attacker holding any valid CA-signed certificate to mint seemingly valid certificates for arbitrary domains. He packaged related techniques into a man-in-the-middle tool called sslsniff, and in 2009 expanded this work with the SSLstrip tool, presented at Black Hat DC and Black Hat USA. SSLstrip transparently downgraded a victim's HTTPS connections to plaintext HTTP, demonstrating how easily real-world SSL deployments could be bypassed.

Whisper Systems and the Twitter Acquisition

In 2010, Marlinspike co-founded the mobile security startup Whisper Systems with Stuart Anderson, releasing the encrypted texting app TextSecure and the encrypted voice-calling app RedPhone. On November 28, 2011, Twitter acquired Whisper Systems, bringing Marlinspike on board; Twitter subsequently open-sourced TextSecure under the GPLv3 license.

Open Whisper Systems and the Signal Protocol

After leaving Twitter, Marlinspike founded Open Whisper Systems in 2013 to continue developing TextSecure and RedPhone as open-source projects. Working with cryptographer Trevor Perrin, he co-developed what became known as the Signal Protocol, first integrated into TextSecure in February 2014. In November 2015, TextSecure and RedPhone were unified into a single application called Signal. WhatsApp completed the rollout of full end-to-end encryption using the protocol for all users in April 2016, and it was subsequently adopted by Facebook Messenger, Google Messages, and Skype. Marlinspike and Perrin received the 2017 Levchin Prize for Real World Cryptography for this work.

Signal Foundation and Later Career

On February 21, 2018, Marlinspike co-founded the nonprofit Signal Foundation with WhatsApp co-founder Brian Acton, and served as the first CEO of Signal Messenger LLC. On January 10, 2022, he stepped down as CEO, remaining on Signal's board.

Legacy

Marlinspike's career spans two related contributions to computer security: demonstrating how fragile real-world implementations of 'secure' protocols could be, and then building Signal into the de facto standard for end-to-end encrypted communication used by billions of people worldwide.

Timeline

• 2002Publishes research on SSL/TLS certificate-chain verification flaws and releases the sslsniff tool.
• 2009Presents null-prefix SSL certificate attacks and releases SSLstrip at Black Hat.
• 2010Co-founds Whisper Systems, releasing the encrypted apps TextSecure and RedPhone.
• 2011-11-28Twitter acquires Whisper Systems; TextSecure is later open-sourced under the GPLv3.
• 2013Founds Open Whisper Systems to continue independent development of TextSecure and RedPhone.
• 2014-02The Signal Protocol, co-developed with Trevor Perrin, is first integrated into TextSecure.
• 2015-11TextSecure and RedPhone are merged into a single app called Signal.
• 2016-04-05WhatsApp completes rollout of full end-to-end encryption using the Signal Protocol.
• 2018-02-21Co-founds the nonprofit Signal Foundation with Brian Acton and becomes the first CEO of Signal Messenger LLC.
• 2022-01-10Steps down as CEO of Signal, remaining on its board.