Audio Logs 50: A Private Language

Julian Pankratz

This is Audio Logs. I’m Julian Pankratz. Glossia, Frothly’s encrypted messaging protocol, turns fifteen this year, and version 4.0 ships in a couple of weeks. Gideon Ravenor has led the program since its very first release, and he’s joining me from our office in Chiba, where I’m told it’s already tomorrow. Gideon, welcome.

Gideon Ravenor

Thank you, Julian. Fifteen years. I was rather younger when we started. And yes, it is early tomorrow here. So far, I can report, nothing has gone wrong with it.

Julian Pankratz

Good to know. Let’s start with the name. Where does Glossia come from?

Gideon Ravenor

From a private cant invented by a small group of colleagues I worked with early in my career. We often had to speak openly in rooms full of strangers, so the man who led us built a language for it, out of fragments of other languages, private references and jokes only we understood. He is now Frothly’s president. When we started designing a protocol, it seemed right to borrow the name.

Julian Pankratz

That’s Gregor Eisenhorn, for anyone who hasn’t met him. Can you give me an example? A word, a phrase?

Gideon Ravenor

I could, but then it would not be private, and he would know within the hour. I can give you the shape of one. There was a phrase that meant “the man by the door is listening.” To anyone else, it sounded like a complaint about the soup. I have never since been able to order soup in a restaurant without glancing at the door.

Julian Pankratz

Ha! Who else spoke it?

Gideon Ravenor

A handful of us. Alizebeth Bequin, who was on this program last month, was one. She still speaks it better than I do. And because people have such trouble remembering she was in the room, she could always use it more freely than the rest of us.

Julian Pankratz

And when you borrowed the name for the protocol, did he approve?

Gideon Ravenor

He said it was the first sensible use anyone had made of it. From him, that is high praise.

Julian Pankratz

He’s not a man who hands out a lot of praise?

Gideon Ravenor

Gregor reads everything twice. The second reading is for finding what is wrong. Praise, when it comes at all, comes after that, and it is usually one sentence long.

Julian Pankratz

You know, when I was touring, the band had a whole vocabulary of its own. A word for the promoter, and a word for a crowd that was about to start throwing things.

Gideon Ravenor

Then you were a speaker of a cant, Julian. Every trade has one. What was the word for that crowd?

Julian Pankratz

I’m afraid it isn’t suitable for broadcast.

Gideon Ravenor

Then it is still working.

Julian Pankratz

Ha. And while I’m confessing, the noble house that gave me my honorary title has a family motto in a dialect that nobody living can actually read.

Gideon Ravenor

Then it is the most secure thing you own.

Julian Pankratz

Did the cant teach you anything you actually used when you came to design the protocol?

Gideon Ravenor

The most important thing, I think. A private language stays private only until someone outside learns it. So Gregor would retire a word the moment he suspected it had been overheard. We called it burning a word. Years later, when I began reading the cryptographic literature properly, I found the engineers had a name for the same idea. They call it forward secrecy.

Julian Pankratz

Unpack that for us.

Gideon Ravenor

Every Glossia message is encrypted with its own key, and the key is destroyed as soon as it has been used. So if someone steals my phone tomorrow, what they find there cannot unlock what I said yesterday. And a conversation heals itself. Once a thief loses access, the next exchange of replies locks them out again. We burn words, Julian. A great many of them, every day.

Julian Pankratz

I love that. Take me back to the beginning, though. What did Glossia look like on day one, in 2011?

Gideon Ravenor

Two relays in a single rack in a back room of our new Chiba office. They were called N-R-T zero one and N-R-T zero two, after the airport code. They went live on the fourteenth of June, the day version one was released. Both are still running, in a proper data center now.

Julian Pankratz

And who was using it?

Gideon Ravenor

Mostly people we knew. Reporters, a few organizers, some families. Our first real outage came the following summer, when a leap second was added to the world’s clocks and almost every relay we had simply stopped forwarding messages. It took an hour and fifty minutes to restart them all by hand. I was not the one holding the screwdriver. I was the one writing the apology.

Julian Pankratz

Your essay last year, “The Value of a Private Language,” argued that encryption is a cultural right, not just a technical feature. Can you explain?

Gideon Ravenor

People have always kept private languages: traders, workers, families, persecuted communities. They protect the ability to speak freely among your own. Encryption is the latest form of that very old practice. When governments ask for a way into it, they are not asking for a technical feature. They are asking communities to give up something they have always had.

Julian Pankratz

You have a personal stake in that.

Gideon Ravenor

I do. For reasons listeners may know, I spend a good part of my day speaking through a machine. I have strong opinions about who else gets to listen.

Julian Pankratz

Say a bit more about that, if you’re willing.

Gideon Ravenor

After my accident, the first device I was given sent everything I said to a company’s servers to be processed. Every sentence. What I said to my doctors, to my mother, to Gregor. The terms of service reserved the right to use it to improve their products. I was improving their products with my private life. The voice you are hearing now is produced inside my chair, and nowhere else. It took me four years to arrange that. Nobody should have to fight that hard to speak privately.

Julian Pankratz

For listeners who’ve never thought about it, what actually happens when I send a Glossia message? Where does it go?

Gideon Ravenor

Your phone encrypts it for the person you are writing to, so that only their device can open it. Then it wraps it in three more layers, one for each relay it will pass through. The first relay, the entry relay, knows your address, but not where the message is going. The second knows only the relay before it and the relay after it. The third holds the message in a mailbox until your friend collects it. It knows a mailbox address, which changes every day at midnight, but not who owns it or who sent the message.

Julian Pankratz

So no single relay ever sees both ends.

Gideon Ravenor

None. Your phone will never choose two relays run by the same organization, or in the same country, for one route. And Frothly sees no more than any other relay operator does. We designed it so that we could not cheat even if we wanted to.

Julian Pankratz

You also pad every message to a fixed size. Why does that matter, if nobody can read it anyway?

Gideon Ravenor

Because size is a sentence of its own. Suppose a reporter asks a source, “Will you meet me tomorrow?” The answer is either “yes,” or a long paragraph explaining why not. Someone watching the network cannot read a word, but they can tell which answer came back. A photograph looks like a photograph. A voice note is exactly as long as someone’s voice. So every message is padded to one of five fixed sizes. That does not hide everything, but it turns thousands of telling sizes into five, and almost all ordinary text lands in the same one. We could pad everything to the largest size, but then every “yes” would cost as much data as a photograph.

Julian Pankratz

And timing? I’d imagine that gives a lot away, too.

Gideon Ravenor

Timing is the hardest problem we have. If you send something at four minutes past nine, and someone across the city receives something at four minutes past nine, an observer who can watch you both learns a great deal. So clients can send cover traffic, which is dummy messages to mailboxes nobody collects, and can hold each real message for a random delay of up to ninety seconds. The cover traffic was designed by a colleague, Wystan Frauka, who has spent ten years making messages harder to notice. He would prefer I had not mentioned him at all, which I take as professional pride.

Julian Pankratz

Why isn’t that switched on for everyone?

Gideon Ravenor

Because it costs battery and data, and many of our users pay for every megabyte. So it is off by default, and we tell people who believe they are being watched closely to turn it on. I would rather be honest about a trade-off than pretend there is none.

Julian Pankratz

What’s new in 4.0?

Gideon Ravenor

The headline is post-quantum key exchange. Messages sent today could be recorded and stored until someone builds a computer capable of breaking today’s encryption. For most people that is a distant worry. For a journalist protecting a source, it is not, because the source will still be alive in twenty years. So we now combine established cryptography with newer algorithms designed to resist that attack.

Julian Pankratz

So the threat is, record everything now and read it later.

Gideon Ravenor

Exactly that, and it is not hypothetical. Storage is cheap, and patience is free. In practice, every new conversation now begins with two exchanges at once: the elliptic-curve method Glossia has always used, and a newer algorithm that was standardized two years ago. An attacker must break both. It adds a little over two kilobytes to the first message of a conversation, and nothing at all to the messages after it.

Julian Pankratz

Do people have to do anything?

Gideon Ravenor

Nothing. Conversations upgrade themselves once both people have the new version. Until then, both apps say plainly that the conversation is not yet protected. Last year a government asked us to hold that protection back in its territory. We declined. It will ship everywhere on the same day.

Julian Pankratz

And it’s faster.

Gideon Ravenor

Up to forty percent faster on poor connections, which is where our users actually are. We design for the worst conditions first: slow networks, shared phones, devices that may be seized at a border. If it works there, it works everywhere.

Julian Pankratz

Where does a number like forty percent come from?

Gideon Ravenor

From removing the waiting. A phone that reconnects no longer repeats a full handshake before it may speak. A photograph interrupted halfway resumes where it stopped instead of starting again, which anyone who has tried to send a picture from a bus in a mountain valley will appreciate. On a simulated slow connection, the median delivery time falls from about nine and a half seconds to under six.

Julian Pankratz

“Design for the worst conditions first” sounds an awful lot like an accessibility principle.

Gideon Ravenor

It is one, and I did not learn it from cryptographers. Build a ramp and everyone uses it: parents with pushchairs, delivery drivers, people with suitcases. Build for the woman with a cheap phone, a failing connection and a border post ahead of her, and the man on fast broadband in a quiet city gets something better as well.

Julian Pankratz

Tell me about that border post. What does designing for a seized device actually look like?

Gideon Ravenor

You imagine the worst moment, which is an officer holding your phone, unlocked, and asking you to wait. A locked phone reveals very little, because the keys live in the phone’s secure storage. Unlocked is the hard case. So there is travel mode, which hides the conversations you choose behind a passphrase and can be switched on with two taps before you reach the desk. There are disappearing messages. There is no phone number or email address tied to you; people find each other by exchanging contact codes. And we say clearly that the person you are writing to can always copy a message before it disappears. We would rather people knew.

Julian Pankratz

You mentioned shared phones as well.

Gideon Ravenor

In many places where Glossia is used, a phone belongs to a household rather than a person. Travel mode was designed for borders. It turns out to be used at least as often at kitchen tables.

Julian Pankratz

A few weeks ago there was a wobble in Chiba, I gather.

Gideon Ravenor

There was. On the twelfth of September one of our relays there failed to come back after a routine restart. For forty-seven minutes, about one in thirty recipients in East Asia had messages waiting in a mailbox they could not reach. No message was lost, and none could have been read, because the relay holding them cannot open them, whether it is working or not. In 4.0 every mailbox is copied to a second relay, so next time nobody will wait at all. Our new Chief Technology Officer has also asked me to say that the calibrations he is running are not connected. I am saying it.

Julian Pankratz

So noted. The description for this episode says the best codes belong to communities, not companies. Who actually runs the network?

Gideon Ravenor

There are a little over eleven hundred relays now, in more than ninety countries. Frothly runs about thirty of them. The rest are run by some six hundred vetted organizations: universities, libraries, newsrooms, community networks. Never individuals, and never governments. One sits in a cabinet above a row of bars and arcades near Chiba harbor. One is on a LoTek rooftop in Newark. One, in a converted mine on Svalbard, ran for eleven weeks under snow in its first winter, and nobody noticed until spring.

Julian Pankratz

Nobody noticed?

Gideon Ravenor

Nobody had to. That is my favorite kind of infrastructure. And the specification is public; anyone may build a client without asking us. A language belongs to the people who speak it, not to whoever wrote the first dictionary.

Julian Pankratz

And before release, 4.0 has been through an independent audit.

Gideon Ravenor

Its fourth. Pauley and Finn have audited every major version since 2014, and they spent nine weeks on this one over the summer. Their report will be published in full on release day, including anything we would rather not have had. I will not pre-empt it. I will say that I am sleeping.

Julian Pankratz

What are you proudest of, after fifteen years?

Gideon Ravenor

That we have never held anyone’s keys, and so have never had anything to hand over. Several times people have come asking. Each time the answer was the same, and it was true: we cannot read it. A private language only stays private if nobody outside the conversation can.

Julian Pankratz

Give me one of those times.

Gideon Ravenor

The first was in 2012, a civil subpoena demanding all messages between two named people. We had no messages, and no names. We said so, and heard nothing more. My favorite came a couple of years ago. A court ordered us to preserve all records relating to a particular person. We have no records relating to anyone. We preserved them.

Julian Pankratz

Ha! That might be the most perfectly bureaucratic sentence I’ve ever heard.

Gideon Ravenor

It was very carefully worded. Heinrix, our general counsel, enjoyed writing it more than he would admit.

Julian Pankratz

Has anyone ever asked for more than records?

Gideon Ravenor

Twice, seriously. Once an agency asked us to build a way in, to be used, of course, only with a warrant. Once a new law would have required us to make messages readable on request. We declined the first and challenged the second, and the second was withdrawn. We have said publicly that we would stop running relays in a country before we complied. This week Heinrix and I renewed our warrant canary. It is a public statement that we have never received a secret order, and we have renewed it every quarter since 2013. If one day it stops being renewed, people should draw their own conclusions. I hope they never have to.

Julian Pankratz

Last question. What does Glossia look like at thirty?

Gideon Ravenor

I hope it is dull. I hope it is like grammar: something people use every day without thinking about it, so that the interesting part is what they say. The best private language is one nobody needs to notice.

Julian Pankratz

Gideon Ravenor, thank you.

Gideon Ravenor

Thank you, Julian.

Julian Pankratz

That was Audio Logs. Glossia 4.0 ships on the fourteenth of October, and the specification and the audit report will be on the relay site that day. Gideon’s essay, “The Value of a Private Language,” is in our research library. We’ll be back in two weeks.

A Private Language

Transcript