Ryan Lester and Josh Boehm, Cyph Co-Founders
What opportunity did you recognize that led to the founding of Cyph?
Ryan Lester & Josh Boehm: Back in AIM's heyday, the two of us would often chat online using Pidgin with the OTR plugin (the end-to-end encryption setup du jour). This wasn't because we'd had any particular need for that level of privacy, but more because it seemed cool and made us feel like secret agents.
However, as "cool" as OTR seemed to us, we couldn't get any of our other friends to start using it with us; it was just too much of a pain to download and set up a new application, install some third-party plugin, generate a key pair, verify friends' public keys, learn enough crypto 101 to even understand what public key authentication meant/was/did, etc.Years later, we were working at SpaceX together, where we repeatedly witnessed firsthand the critical need to protect trade secrets from powerful adversaries and to keep strict compliance with export controls such as ITAR. During this time, Edward Snowden's leaks about the NSA's extensive digital surveillance programs also came to light.Instantly, it clicked for us that both business and consumer contexts faced an urgent unmet need for truly private communication. There were some tools and methods that existed, but from experience we'd learned that they would largely remain unadopted without a user experience that equalled or surpassed existing non-secure communication solutions.
What specific value does addressing that problem provide for your customers?
Lester and Boehm: We have no doubt that people want more security and privacy when it comes to their communication and data online — just not if it comes at the cost of their convenience or has a learning curve to it. By addressing this and making user experience second only to application security in our priorities, Cyph is making cutting-edge quantum-resistant cryptography more accessible and easier to use than ever before.Instead of the traditional painful user experience, you don't need to force anyone to sign up or install some software to communicate with them. When someone doesn't already have a Cyph account, you can simply send them a link which will work on any device with a modern web browser.On that note, the browser turned out to be a very interesting technical challenge for us. Due to the plethora of attack vectors which entirely undermine the security of web applications within the context of our threat model, initially it seemed like we wouldn't be able to offer our desired UX (in good conscience, anyway) — which brings us to our next answer...
Why aren’t current solutions addressing this problem effectively?
Lester & Boehm: Before our talks at Black Hat 2016 and DEF CON 24 on the research that went into Cyph — more specifically on something we call WebSign — providing code signing (a standard practice in native apps, and an absolute prerequisite to secure communication) within a web application was considered by the security industry at large to be literally impossible. Given that we had to invent the solution to this daunting technical problem, it isn't surprising that we're the first to address it effectively.Going forward, WebSign is an advantage that we'll most likely retain uniquely to Cyph, as we have a patent pending on the technology.
What makes your approach different and better from existing approaches?
Lester & Boehm: First, as implied in our previous comment, Cyph is the only secure communication tool in the world that can run as a web app. This may sound minor, but it actually makes a huge impact on the user experience. Most people don't want to have to download and install new software for something as simple as sending a text message or joining a video call — particularly your non-technical friends who may not fully understand your frenzied rants about NSA spying. To get started with Cyph, they can just click a link.Second, Cyph is one of a tiny handful of solutions that are remotely trustworthy for secure communication -- the other major one being Signal by Open Whisper Systems -- among which Cyph is the only one to attempt to protect present-day communication from theoretical future quantum computing attacks. This may actually kind of matter, given the NSA's recent announcement.
What about your team’s background puts you in a unique position to succeed?
Lester & Boehm: The two of us have worked together and known each other for the last 20 years or so. We know our strong suits and shortcomings, and each complement the other's. We've worked on numerous cool projects and jobs together, but what generally defines our ethos to most people is the time we spent leading Software Quality Assurance at Elon Musk's SpaceX (occasionally working on the same code with Tesla Motors). It was our responsibility to ensure that all of our internal software was free of bugs, defects, and vulnerabilities; downtime could potentially cost the company millions.While our team was understaffed and we were overworked, our experience with SpaceX and Tesla was invaluable preparation for running a successful software product. We gained experience working directly with their CIOs, and of course with some of the brightest programmers in the world. While SpaceX was a large company, it retained a startup feel with open offices, flat reporting structures, and people "wearing many hats"; the whole environment was like a pressure cooker for entrepreneurship.Plus, we've noticed that saying you've worked with Elon tends to open a few doors. :)
What are some of the milestones you have passed since graduating from Mach37's fall 2014 cohort?
Lester & Boehm:
- We closed our $500k seed funding round last fall, with the lead investors being Goel Fund and Mach37's former parent company CIT
- We're now working to monetize on the enterprise side, while keeping Cyph completely free for individual end users
- We had an extremely positive code audit report from the pentesting firm Cure53: "Cyph provides security from a broad range of cryptographic attacks and very strong client-side crypto. The general conclusion of the test is that no major issues in regards to application security or cryptographic implementations could be spotted in spite of a thorough audit."
- As mentioned, we recently gave a successful talk at Black Hat and DEF CON (the two largest hacker conferences in the world)
What one aspect of the Mach37 programs did you personally find most beneficial?
Lester & Boehm: Coming from pure software engineering backgrounds, Mach37 helped immensely in spinning us up on how to run a real startup -- ("real" in the sense of being a full-time venture with external stakeholders and financial targets, rather than just a side project). A large portion of Mach37's three-month program focuses on quickly getting founders up to speed on material you would expect to see in an MBA program — particularly as it pertains to startups, fundraising, and the cybersecurity industry.
What question should we have asked but didn't?
Lester & Boehm:"How are you going to make money?"First of all, if you're an individual (i.e. not using Cyph for business purposes), access to the core product will always be free. People aren't used to paying to talk to their friends and family, nor do we believe they should have to just to ensure basic privacy. While we may eventually offer a premium tier for users who want to support us, something like that would only grant access to non-essential bonus features. The free tier of Cyph will never be less capable than paid options when it comes to privacy or security.The money comes in from licensing our software to businesses and government, either to protect their internal communications or to allow for easy secure channels to their customers/clients. One of the first industries that we've noticed crying out for an answer is the telehealth space. By law their communication needs to meet HIPAA standards and yet for many older patients the solution for that must be easy to use and absolutely intuitive.However, the biggest opportunity may very well turn out to not even be Cyph itself, but rather licensing out WebSign for entirely separate use cases. The potential utility of "secure websites" (in-browser code signing) is almost certainly broader than our narrow focus on end-to-end encrypted communication.Learn more about Cyph here.
