But the actual problem is the baseband processor running completely non-free software, with an enormous attack surface and access to all the interesting periphery (GPS, microphone). There is not just opportunity to compromise your privacy, Qualcomm and others actively implement such features at the behest of governments and carriers.
Oh, and if you plug that enormous hole, you get to the SIM card, yet another processor that you have zero control over, but which has access to enough juicy data to compromise your privacy. I highly recommend everyone to watch a talk from 30C3 by Karsten Nohl, where he shows a live attack on an improperly configured SIM card that remotely implants a Java app on the SIM card which continuously sends your cell ID (your approximate location) to the attacker by short message (without notification to the application processor, e.g. Android or iOS):
http://www.youtube.com/watch?v=5B7XyVWgoxg
Carriers can do this today. (edit: that's a bit nonsensical, because carriers of course already know your cell id. Anyone with the ability to run a fake basestation momentarily (think IMSI catcher) can do this.)
http://flors.wordpress.com/2009/08/27/software-freedom-lover...
Blackphone is pretty lame, IMO. There's something better coming from a trusted source in weeks, and plenty of work being done on the "there is no phone" phone concept.
Fully support the initiative for an open baseband. One reason it's not open is the (fairly legit) fear that intentional and unintentional DoS attacks would occur, affecting everyone in the area. It's really really simple to be an obnoxious cellular network citizen and it's pretty damn hard to police.
Baseband bugs that impact networks are common too due to the complexity. I saw a function point analysis of GSM vs 3G once, seem to remember 1-2 orders of magnitudes difference. Ahh Function Points, you flawed devil of a management metric.
Could you provide more concrete info on what you are referencing there?
You can't really prevent that with technology unless you start to educate kids/users better. But who am I kidding? People will forfeit their private data for shiny stuff as long as there will be shiny stuff and private data.
The first connotation is the one my mother warned me about. It's Facebook photos of that tequila weekend in Tijuana and those two PM Tuesday tweets from the beach bar when I called in sick to work. These are things that require personal judgement in regard to what I say. Self-control addresses this type of privacy.
The second connotation of privacy is newer, but still nearly twenty years old. It entails concerns regarding information collected about my actions beyond what I explicitly choose to broadcast. It's cookies in the browser [and their more sophisticated descendants]. It's my browser linking my Google+ account to my browsing history at lesbiandwarffurries.com.
Privacy issues of this second type are assumed to be normal when they are considered at all - why doesn't my browser sandbox cookies for each website? Or rather why isn't there a browser that does so? The same logic underpins the Blackphone - sand boxing unrelated parts of the system so that privacy is a matter of personal judgement rather a battle against a technically sophisticated adversary.
True, and once that one will be made open-source too, there's still the NSA tracking mobile phones worldwide and generating all kinds of privacy-invading data based on it:
http://www.washingtonpost.com/world/national-security/nsa-tr...
(And until that is resolved, my mobile phone will stay in flight mode only.)
So once again, while tech may help in the short term, long-term solutions will have to be structural/systemic ones regarding government in general.
The point made elsewhere in this thread is that even an open-source implementation can be exploited. If the baseband is tightly integrated, then that exploit gains the attacker full access.
From a security perspective, even a closed-source baseband could be ok as if it has proper separation from the rest of the system (though open-source would obviously be better).
I am not sure about the technology, however from look of the video I can say it is mostly aim at non-technology experts, with nice fancy design.
Can I ask what kind of people do we need to design all the chips hardware such as baseband processor, using open source design?
And what are HN opinion on Silent Circle?
Also, their privacy policy is laughable:
We turn the logging level on our systems to log only protocol-related errors - great!
the pages on our main web site pull in javascript files from a third party. This allows our web developers and salespeople to know which pages are being looked at - so instead of keeping your own logs, you are outsourcing this to a 3rd party with worse privacy policies, and who can now aggregate your website usage with other sites.
Why didn't they just keep logging on and get rid of the 3rd party bugs?
How is it re-shaping anything before it's started shipping?
* physical switches for GPS, WIFI, Radio, Camera, Mic, write/read access to disk (go diskless),
* a secondary low power eInk display that is wired directly into the hardware that shows when the last time GPS, mic, camera were turned on (and for how long) and how much data has been sent over the radio and read from disk,
* a FS which encrypts certain files with a key that is stored remotely. If your phone is stolen you can delete this remote key. The key is changed on every decrypt. You also get a remote log of all times this remote key was accessed.
* hardware support for read-only, write-only files,
* hardware support for real secure delete on the SSD,
* the ability to change all my HW identifiers at will (IMEI, SIM, etc),
* a log, stored on a separate SD card, of all data sent and received using a HW tap on the radio/WIFI. The log should be encrypted such that only someone with the private key can read it (public key used to encrypt an AES session key which is rotated out every 5 minutes). If you think someone has compromised your phone you can audit this log for both exploitation and data exfiltration. Since the log is implemented in HW, no rootkit can alter it.
It's in partnerships with http://www.geeksphone.com/ which is FirefoxOS based. But yet the Blackphone splash has an image of a phone with Android buttons.
They claim no hooks to vendors, so if it's Android I can't imagine this is going to carry the Play store.
I'd be interested in knowing how they will secure and make private the core functionality of being a phone and sending email and text, all of which are insecure.
On that, I'd speculate that this is just pre-loaded with Silent Circle apps, and maybe will be announced as having DarkMail and a choice of RedPhone.
But... there's no info at all really, so who knows what this is.
The only problem they really have to solve is the eternal question of: Is it possible to provide real security and privacy whilst providing convenience?
http://eprint.iacr.org/2014/036.pdf
Email? They've announced the DarkMail protocol last year, and should be coming soon:
Obviously usability would suffer a little bit (mostly in huge latency when you actually wanted to make a call), but seems like very cheap phone could be built that integrated a pager, allowing complete disconnection from the 'active' radio network, avoiding location tracking by your cell provider, or similar evil tricks by third parties.
Except if everyone started using a phone like that, you wouldn't be able to call anyone.
The biggest security hole next to the baseband processor and the SIM is the user who installs every app in seconds without checking permissions.
Not true, http://developer.android.com/reference/android/Manifest.perm...
I'm sure there's logic there - powering a very basic non-informative landing site with a WP installation that you took the time to customize, but not delete the default post and comment from...
But it certainly doesn't give me warm fuzzy feelings about the people behind this.
These products should be advertised on theblaze and infowares.
Sure there is a need for better privacy, but I don't really care for the fearmongering...
- High-End Android device
- Privacy features in the (custom) Android version
- "Secure communication builtin"
Again, I like the idea. But so far the details match CyanogenMod (with TextSecure for SMS, maybe XPrivacy on top)?
One of the big drawbacks when I first started my nexus5 was that I was being spyed. Why the hell do I need a gmail account to get started?!
I wonder if it would be possible to install this Android flavour in a Nexus device ?
2) Access Internet (and VOIP) only via VPN or better yet TOR.
3) Only give out your VOIP number. No one must know your direct number, it’s only for emergencies.
This severs all the important connections to make any use of that data, assuming you don’t have any leaks.
[0] https://en.wikipedia.org/wiki/SIP_Trunking
[1] https://en.wikipedia.org/wiki/Pstn
Edit: A quick search gave me this[2] by Plivo. Does any one know of any other options?
[2] http://plivo.com/blog/sip-trunking-to-replace-my-landline-ph...
But only if you are a private person (or a small cafe/venue). If you are an ISP, you can operate hotspots wherever you want and charge whatever anyone is willing to pay. And you do not need to fear being held liable for your users actions.
[Edit] Meant to say, that since this change of law we do not have a lot of open WIFI-Spots anymore.
The irony is almost too much.
http://web.nvd.nist.gov/view/vuln/search-results?query=firef...
As for, NSA spying how exactly can this phone ensure 100% secrecy. Given a user would have to use the same apps, and above all, the carrier that other smartphone users use.
Point is, US Govt is hellbent on spying on you. And they will no matter what. Either change the US Govt, or suck it up. Nothing else is gonna work.
Basically, this seems like a lifestyle device for pseudo-"hacktivists". And I expect people to install WhatsApp and Facebook on it. There was this article a few days ago: "When I was young there were beatniks. Hippies. Punks. Gangsters. Now you're a hacktivist. Which I would probably be if I was 20. Shuttin' down MasterCard. But there's no look to that lifestyle! Besides just wearing a bad outfit with bad posture. Has WikiLeaks caused a look? No! I'm mad about that."
http://online.wsj.com/news/articles/SB1000142405270230463640...
I called bullshit from the beginning that anything will change politically, and now six months later I'm more certain nothing is going to change at the political level. They've dug in their heels for the long ride.
The only positive developments has been private companies like Google encrypting their data centers and privacy software finally finding an audience. But at the same time, not even the most die-hard cypherpunks think you can achieve 100% secrecy from a dedicated adversary. But that's not the primary goal. Countering mass-surveillance is.
It still wouldn't be perfect, but would succeed in many scenarios and would greatly increase adversary costs.
Using things like Blackphone can potentially increase the cost of anyone doing this kind of spying, to vastly reduce who will do it for what reasons.
This talk by Dymaxion is good on economics and usability of this stuff: http://dymaxion.org/talks/EaPitLW.html
Were they successful in delivering on the Firefox phones?, Their website always says 'out of stock'. Blackphone seems to be ambitious too. Is it possible for a startup to sail these two boats?
Also I find it odd that the PR is always just before the Mobile World Congress (MWC) which happens in Spain, last year with Firefox OS and this year with Blackphone
With the latest NSA stuff, I came to conclusion that a true secure system can only be built under these conditions and just to put it out there, this is just my opinion;
- A computer company that manufactures their own hardware such as hard drive, ram, cables, network cards.
- An OS that is newly written and not based on any other existing operating systems.
- Building the whole system with INDEPENDENT hardware and software mentioned above.
- Keeping the mobile device's source code offline from Internet as much as possible
These are just the first steps on developing a secure system, then comes the mobile network architecture and encryption etc.
I admit, it is not an easy job but, trying to develop a secure system with "not secure" development tools is not the right way to go :)
It's an interesting thought experiment, but I wonder if we can satisfy many use cases without having to build a truly secure smartphone.
For example, if I just want to have voice calls to a handful of people with the content of the calls encrypted, then perhaps I can just plug in a "scrambler box" between my untrusted off-the-shelf phone and my audio headset?
So rather than designing a secure phone where we trust the wifi stack, the baseband stack, the bluetooth stack, the graphics stack, the USB stack, the flash storage stack because we've designed them from scratch, all we have to design is a little scrambler box that just has audio in, audio out, some mechanism for key generation and exchange, and only needs a laughably modest CPU to do the encryption.
Don't really need an OS at all - single process and static memory allocation should suffice.
The audio encoding/decoding and encryption/decryption don't sound too hard to implement from scratch. It's the interoperability with the rest of the world and the UI that makes implementing a whole smartphone so hard.
[I do wonder though how well our scrambled audio will make it through the phone network which is applying lots of clever compression designed for speech.]
If we assume we can mostly trust hardware designs that are at least 30 years old then we can probably avoid designing all the hardware from scratch - e.g. there's probably some sort of Z80 clone CPU we can copy.
The mechanism for key generation and management sounds a bit tricky though. The user would need some way to add his contacts' keys to his scrambler box.
A keyboard and LCD display to type keys in by hand would be secure but impractical for long keys.
The level of tech needed to read a key file from a FAT filing system on a USB stick might be too high to be easily implemented securely. Any ideas?
I'm aware of the famous "trusting trust" paper, but I'm not sure we need to worry too much about the compiler used to build the software running on our scrambler box. All we need to do is choose a compiler released before we started out project and never upgrade it. It is hard to imagine a compiler backdoor that would automatically recognize that the intent of our code is to encrypt data and undetectably comprise it (though it would be wise I guess to avoid any existing implementations of cryptographic primitives).
Sounds like a hardware kickstarter project :)
We may as well try it out! The concern will be the goal of the project...
What will be the output ?
Will it be just an experiment or business based project?
Never the less, it is exciting to see that a unique device can be made actually!
I would love to see how secure it would be at the end!
Not to mention that none of the providers have the code to the baseband.
I could imagine a phone that treats the baseband as an untrusted entity and encapsulates everything running over it. This would require forcing SSL for all HTTP traffic, and using some standard for SMS and Voice encryption that is on by default when the recipient on the other end also has a supported device. For those that do not you're unencrypted SMS would be exposed at many hops even if they smartphone were full OSS and trusted, even to the baseband level. So silo'ing everything where possible is a valid solution with closed basebands.
Hackers have built some amazing hardware in past and we all know about how open source communities have built some of worlds best software. Google, Apple etc. are building devices where they act as gatekeepers and charge us for all nonsensical stuff. If you make a website there are a gazillion ways to promote it but there is only one way to promote and app. Pay some advertiser and you are totally at mercy of Google or Apple.
Firefox has been doing the right thing so far but they seem to take too much time.
If you're "picked up" or detained and you have a Blackphone, or someone observes you using your Blackphone I doubt very much it would help your pricacy concerns.
If however you have a seemingly normal phone it might be overlooked and simply using it wouldn't raise suspicion.
My point is that this type of phone is more for the "regular" person who simply doesn't want to be monitored (as much) and not covert agents looking for a secure phone/platform for communication.
There is no mention of the methods used by the phone to ensure privacy.
1. Is this just a stock phone with some privacy-orientated applications built-in, or is the OS and hardware contributing anything?
2. They seem to be using Android. AOSP or Cyanogenmod? Have they any work themselves to harden the OS? Are they using virtualisation?
3. Any closed binary blobs in there? What about the baseband firmware? (Does open source baseband firmware even exist?)
4. Whats the hardware like? Is it hardened in any way?
Does anyone know if the actual baseband/wireless side has been designed with security in mind? -for example I'd love to be warned when I'm connected to an A5/0 "encrypted" GSM network, but I haven't been able to find a handset build in the last decade that's willing to warn me.
iOS and Android support VPN but it needs to be manually activated each time, making it rather useless unless you're using some public wifi. If I understand correctly there is a possibility for large companies to integrate VPN but for the average guy it's rather useless if you have to activate it. If this phone has VPN really integrated that'd be great.
Oh, and never mind compromising the people involved.
I started a thread to discuss this idea:
http://www.theverge.com/2014/1/15/5310710/phil-zimmermann-si...
People. It's really secure, private, and anonymous, ok?
Eh? Wouldn't "Enabling secure/private communications" be a better, albeit less grand, descriptor?
Also, why is domain on .ch ?
Not a super-reputable source, but succinct: http://www.wisegeek.org/why-is-switzerland-regarded-as-a-neu...
Official Swiss propaganda, but has more info: http://www.vbs.admin.ch/internet/vbs/en/home/documentation/p...
They state in the video: "Blackphone is a Swiss joint venture between Silent Circle and Geeksphone"...
Still doesn't reveal much, as both companies in this joint venture aren't swiss and in the swiss company register I couldn't find an entry for them.
http://www.theregister.co.uk/2014/01/15/encrypted_blackphone...
Domain name:
blackphone.ch
Holder of domain name:
Geeksphone S.L.
Geeksphone Rodrigo S
calle Manuel Silvela 1
ES-28010 Madrid
Spain
Thanks
Ok, so how do they stop Facebook et al from abusing our contact lists and location data as they do on existing smart phones?
;)
So, yeah you can encrypt the voice channel. That's great. You can send encrypted text messages. The people involved are serious cryptographers. All of it sounds good.
You have to ask your self though, what is it you are trying to do? Who is your adversary? Other people here have mentioned it, but what about apps on the phone? Facebook is still Facebook.
Jokes aside, I think it's a great initiative, looking forward to see what comes out of it.