Meta, Google, and Microsoft all use encryption built by the same 50-person nonprofit.
Zero revenue from 2 billion users. The founder uses a fake name. And when the FBI subpoenaed them, they only provided 2 pieces of data.
Here's how a non-profit secures the internet🧵
Zero revenue from 2 billion users. The founder uses a fake name. And when the FBI subpoenaed them, they only provided 2 pieces of data.
Here's how a non-profit secures the internet🧵
In 2013, a tiny nonprofit had just 3 developers building encrypted messaging that no government could crack.
Their leader went by "Moxie Marlinspike" - not his real name.
WhatsApp founders were tracking their journey.
Their leader went by "Moxie Marlinspike" - not his real name.
WhatsApp founders were tracking their journey.
2014: WhatsApp sells to Facebook for $19 billion.
But the founders, Brian Acton and Jan Koum, are privacy hardliners. They partnered with Moxie's 3-person nonprofit to integrate military-grade encryption.
Facebook had no idea what was coming...
But the founders, Brian Acton and Jan Koum, are privacy hardliners. They partnered with Moxie's 3-person nonprofit to integrate military-grade encryption.
Facebook had no idea what was coming...
For 2 years, WhatsApp quietly rebuilds its entire messaging system around their protocol.
April 2016: 1B users wake up to this notification:
"Messages are now secured with end-to-end encryption"
A 3-person nonprofit just protected 1/7th of humanity.
Then the FBI showed up...
April 2016: 1B users wake up to this notification:
"Messages are now secured with end-to-end encryption"
A 3-person nonprofit just protected 1/7th of humanity.
Then the FBI showed up...
2016: FBI subpoenas Signal for user data in a criminal case.
Signal's entire response:
- Date account created
- Last connection time
That's it. No messages. No contacts. No call logs.
They literally CAN'T provide what they don't have.
Every tech giant was watching.
Signal's entire response:
- Date account created
- Last connection time
That's it. No messages. No contacts. No call logs.
They literally CAN'T provide what they don't have.
Every tech giant was watching.
July 2016: Facebook Messenger adds Signal Protocol
2016: Google integrates it
2018: Skype adopts it
Trillion-dollar companies all chose the same nonprofit's encryption.
Why? Because Signal invented something thought impossible...
2016: Google integrates it
2018: Skype adopts it
Trillion-dollar companies all chose the same nonprofit's encryption.
Why? Because Signal invented something thought impossible...
The "Double Ratchet" - a method where every single message gets a unique encryption key.
Think of it like a lock that changes itself after each use.
Crack today's key? You get ONE message. That's it.
But the real magic is what happens if you get hacked...
Think of it like a lock that changes itself after each use.
Crack today's key? You get ONE message. That's it.
But the real magic is what happens if you get hacked...
"Post-compromise security" - if a hacker steals your keys RIGHT NOW, Signal's protocol heals itself.
After a few messages, they're locked out again. The system literally repairs its own security breaches.
But Facebook didn't want this, which led to a cold war.
After a few messages, they're locked out again. The system literally repairs its own security breaches.
But Facebook didn't want this, which led to a cold war.
2017: Facebook was pushing to monetize WhatsApp. Add ads. Mine data.
Essentially...break the privacy promise.
Brian Acton fought back. He wanted to uphold privacy, but ultimately loses.
He faced a choice: Stay and collect $850 million in unvested stock, or walk away...
Essentially...break the privacy promise.
Brian Acton fought back. He wanted to uphold privacy, but ultimately loses.
He faced a choice: Stay and collect $850 million in unvested stock, or walk away...
Acton walks.
Leaves $850 MILLION on the table rather than betray user privacy.
2018: He takes $50 million of his own money and creates the Signal Foundation with Moxie.
Zero ads. Zero data collection. Zero investors. How do they survive?
Leaves $850 MILLION on the table rather than betray user privacy.
2018: He takes $50 million of his own money and creates the Signal Foundation with Moxie.
Zero ads. Zero data collection. Zero investors. How do they survive?
No ads. No data collection. No shareholders. Pure nonprofit.
Running Signal costs $50M/year:
20 million gigabytes of bandwidth
SMS verification codes
50 employees
Jack Dorsey sends $1M annually. Users donate $5/month.
When governments tried to break them, Signal drew a line...
Running Signal costs $50M/year:
20 million gigabytes of bandwidth
SMS verification codes
50 employees
Jack Dorsey sends $1M annually. Users donate $5/month.
When governments tried to break them, Signal drew a line...
UK's Online Safety Bill demanded apps scan encrypted messages for illegal content.
Signal's response: "We'll leave the UK before we break encryption."
WhatsApp backed them. The UK government had to choose.
Signal's response: "We'll leave the UK before we break encryption."
WhatsApp backed them. The UK government had to choose.
UK backed down.
They admitted the technology to scan encrypted messages "doesn't exist" without destroying privacy.
A 50-person nonprofit made the British government blink.
But Signal's already fighting the next war.
They admitted the technology to scan encrypted messages "doesn't exist" without destroying privacy.
A 50-person nonprofit made the British government blink.
But Signal's already fighting the next war.
2023: Signal implements quantum-resistant encryption.
Why? Adversaries are recording messages TODAY to decrypt in 10+ years when quantum computers arrive.
Signal's PQXDH protocol uses dual encryption. Even future quantum computers can't break both.
Why? Adversaries are recording messages TODAY to decrypt in 10+ years when quantum computers arrive.
Signal's PQXDH protocol uses dual encryption. Even future quantum computers can't break both.
The entire Signal Protocol is open source.
Any researcher can verify it. Any competitor can copy it.
Total transparency. Zero security through obscurity.
That's how a nonprofit accidentally secured the internet...
Any researcher can verify it. Any competitor can copy it.
Total transparency. Zero security through obscurity.
That's how a nonprofit accidentally secured the internet...
Thanks for making it to the end!
I'm Alex, co-founder at ColdIQ. Built a $6M ARR business in under 2 years.
We're a remote team across 10 countries, helping 400+ businesses scale through outbound systems.
I'm Alex, co-founder at ColdIQ. Built a $6M ARR business in under 2 years.
We're a remote team across 10 countries, helping 400+ businesses scale through outbound systems.
RT the first tweet if you found this thread valuable.
Follow me @itsalexvacca for more threads on technology, outbound and GTM strategy, AI-powered sales systems, & how to build profitable businesses that don't depend on you.
I share what worked (and what didn't) in real time.
Follow me @itsalexvacca for more threads on technology, outbound and GTM strategy, AI-powered sales systems, & how to build profitable businesses that don't depend on you.
I share what worked (and what didn't) in real time.
https://twitter.com/859850213015597056/status/1958183851358101606
• • •
Missing some Tweet in this thread? You can try to
force a refresh
