Griffin Boyce: > Jacob Appelbaum <[email protected]> wrote: > >> Griffin Boyce: >>> I disagree. Blackberry isn't openly selling your data or >>> otherwise gifting it to third parties, but I don't think that's >>> really enough. >> >> That is exactly what they're doing. They have a key that is static >> and from what I've heard, disclosed to LE and intel agencies, >> specifically to retain or to enhance their marketshare. >> > > Well, their market share is enhanced more by shiny packaging and > bullshitting their customers into thinking their phones are secure. >
That is exactly my point. They're selling out their end users because their real "customers" are either carriers or governments. > >>> Keep in mind that all PINs are 8-digit hex strings. Narrows the >>> field a bit. ;P >> The PIN is just the hardware identifier as I understand things - >> that isn't my concern - my concern is the fixed key. > > > Granted, but you need to determine the PIN (and then spoof it), for > PIN-to-PIN Blackberry messages. > Neither of those things matters to me at all. That is - if I can decrypt your messages, I can trivially recover your PIN if you ever send any message with it, ever. > You already know this, but for the benefit of the list: There's a > difference between BBM messages and Pin-to-Pin messages. With BBM, > you have to request permission to be added to their list and then you > both mutually approve each other. With Pin-to-Pin, you can send > anyone a message if you have their PIN. A PIN message is similar to > email, and displays red in your "messages" queue. BBM is threaded and > closer to chat. As of Blackberry v10 (I believe), BBM no longer uses > a PIN, but the BBID. > Unless these are on a BES server - it's all insecure - if it is on a BES server, it may still be insecure depending on a few factors. > Also, while a PIN message can be encrypted, the default option on > both a BES ~and~ PIN messages is to not be encrypted. Solidly awful. > > What REALLY scares me about this is how many medical providers use > Blackberry products in their practices. A stolen PIN coupled with a > poorly set-up BES could lead to a serious privacy breach. Well, sure. It would be as bad as every other BlackBerry device normally. A real joy, I tell you. > > Andrés Leopoldo Pacheco Sanfuentes <[email protected]> wrote: > >> Are there "truly secure" solutions? I don't think so.. especially >> not when we add the qualifier "of mass consumption " >> > That's probably the real question. It probably doesn't exist with > off-the-shelf solutions. Yes, it does. There have been off-the-shelf solutions for decades. Some require a clearance or connections (eg: STU-III), others require money (eg: cryptophone ), still others require some technical skill (eg: Guardian apps on Android). There are obviously degrees of secure. > TextSecure is useful and secure, but the > network effect applies there as everywhere else. If I send you an > encrypted text, and you don't use the same app, you can't reasonably > decrypt it. That isn't really a problem as far as I'm concerned. > Cryptocat mobile would be a game-changer here, but it > also doesn't allow for asynchronous communication since it's a chat > program. And both parties would still need to use it. > GibberBot with OTR provides the same set of features without all of the home rolled crypto problems, the web related problems or a third party that you're not already using on a daily basis. > I'm not sure there's a full solution right now. Definitely a market > opportunity. > I suggest you check out Cryptophone: http://www.cryptophone.de/ I've been a reasonably happy user on and off since ~2003. All the best, Jacob -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at [email protected] or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
