Blackphone

[TechMan]

http://www.youtube.com/watch?v=TxuviN5_W4Y

http://www.geeksaresexy.net/2014/01/20/blackphone-promises-total-security/

Makers claims it offers complete security from snooping on all forms of communication.

Joint project between Geeksphone, a Spanish smartphone manufacturer and Silent Circle a US firm which already offers encrypted communications as a paid mobile device service.  The co-founder of Silent Circle is Phil Zimmerman, the man behind PGP.  Mash the links for more.

[Brad Johnson]

Makers claims it offers complete security from snooping on all forms of communication.

Riiiiiight.....

Brad

[HankB]

And as proof of its security, they no doubt include the latest hardwired encryption device, the Mark XIV Clipper Chip. 

[Gowen]

Makers claims it offers complete security from snooping on all forms of communication.

Just give the NSA geeks a challenge.  They'll raise you one and get a judge to issue a court order for the code.

[Perd Hapley]

Racist.

[lee n. field]

http://www.youtube.com/watch?v=TxuviN5_W4Y

http://www.geeksaresexy.net/2014/01/20/blackphone-promises-total-security/

Makers claims it offers complete security from snooping on all forms of communication.

Joint project between Geeksphone, a Spanish smartphone manufacturer and Silent Circle a US firm which already offers encrypted communications as a paid mobile device service.  The co-founder of Silent Circle is Phil Zimmerman, the man behind PGP.  Mash the links for more.

A microphone in the room?

[dogmush]

....

[waits on Rev's input]

.....

[Firethorn]

Just give the NSA geeks a challenge.  They'll raise you one and get a judge to issue a court order for the code.

Security through obscurity is transitionary at best.  PROPER encryption systems don't make it any easier for you to compromise them even if you have the writer of the program standing by to assist you with anything you don't understand, so long as nobody is giving you either access to the hardware or the private encryption keys.

In this case the 'best' way to set it up is that both people have a 'blackphone', and in setting up a call they use public key encryption and are verified against pre-published certificates to avoid a 'man in the middle'(MITM) attack. 

Otherwise, well, if you want to protect your calls to the local pizza place that doesn't have the capability you'd only be able to protect around half of the trip - encrypted to some server, which decrypts it and forwards the call to the pizza joint.  You don't want the server in the middle with the keys in on the session because that's just asking for MITM attacks.

Really, securing data in transition is easy.  It's properly setting up an encrypted secure session that's difficult.

[KD5NRH]

A microphone in the room?

A dumbass shouting their conversation in a public place?

Used to hear it all the time on the DART trains; idiots calling in a credit card order, or dealing with the bank loudly.  CC#, SS#, address, anything else you could want yelled to pretty much everybody on the train.

[TechMan]

A dumbass shouting their conversation in a public place?

Used to hear it all the time on the DART trains; idiots calling in a credit card order, or dealing with the bank loudly.  CC#, SS#, address, anything else you could want yelled to pretty much everybody on the train.

You cannot fix stupid.  SWMBO has no problem chatting on the phone in the store.  I refuse to do that.  I will call her if I have a question, but I refuse to have a conversation while I am shopping.

[RevDisk]

And as proof of its security, they no doubt include the latest hardwired encryption device, the Mark XIV Clipper Chip. 

Just give the NSA geeks a challenge.  They'll raise you one and get a judge to issue a court order for the code.

Wrong. No need to support tin foil when you can provide the technical details.

All common carriers, facilities-based broadband Internet access providers, and providers of interconnected Voice over Internet Protocol (VoIP) service must be Communications Assistance for Law Enforcement Act (CALEA) (Pub. L. No. 103-414, 108 Stat. 4279, codified at 47 USC 1001-1010) compliant. Previously, CALEA only applied to telephone. In 2004, DOJ, BATFE, FBI, DEA asked the FCC to include the ability to monitor VoIP and broadband internet communications. In 2005, the FCC so ruled that "telecommunications carriers" under CALEA includes VoIP and internet providers. FCC affirmed again this in 2006 and the DC Circuit Court agreed.

If they offer VoIP in said phones and it is not CALEA compliant, it is illegal in the US.

[dogmush]

So semi-related question:  Feel free to shut me down if we're treading too close to illegal.

I haven't read CALEA, But my understanding is the jist of it is the .gov can listen to your calls.  The hardware will let them in.

How would one circumvent this?  VPN between terminals, then VOIP?  Root phones and set up your own encryption?

Somebody has got to have gone around this, if only just because it's there.

I'm just going to make some one time pads and text everyone from now on.

[RevDisk]

So semi-related question:  Feel free to shut me down if we're treading too close to illegal.

I haven't read CALEA, But my understanding is the jist of it is the .gov can listen to your calls.  The hardware will let them in.

How would one circumvent this?  VPN between terminals, then VOIP?  Root phones and set up your own encryption?

Somebody has got to have gone around this, if only just because it's there.

I'm just going to make some one time pads and text everyone from now on.

Considering CALEA compliance is a multi hundred million dollar industry, it's not illegal to ask questions. CALEA mandates that any telecom service be wiretap friendly, no more, no less. Bigger companies have it very automated. The hardware, 99 times out of a 100, does NOT let them in. It's not out of the goodness of their heart. CALEA requests are billed back to the government. LEO, which can be locals as well as feds, sends a warrant (or national security letter) to telecom. Telecom complies with warrant, which is damn near a rubber stamped checkbox situation. "We want all call logs", "We want locational data", "We want voice recordings", "We want live stream" or "All the Above". Damn near no one wants live stream of calls, real life isn't an episode of 24. If the person is important enough for live audio stream, there's a surveillance team on the person. Different agencies get their data delivered different ways. Faxed, emailed, uploaded to FTP account, or connected through DCSnet.

It can get a bit more tricky if they want the provider to upload malware. I haven't dealt with that as much, but I do know it's getting more popular for cell phones. Only way to get around it is decentralized tech. CALEA only applies to providers, not all software. If a provider doesn't HAVE the data, they can't provide it and legally aren't required to provide it. See RIM and BES encryption keys.



To give a real world example. Everyone remember the PRISM slides proclaiming that Google was handing over the keys of kingdom to the NSA? Good. Care to guess who was the MOST surprised? Google. As far as they knew, they provided all warrant/NSL requests via sFTP. They didn't lie when they said the NSA didn't have direct hardware access, because as far as they knew they didn't. They were wrong, of course.

You can imagine how shocked Google was when they found out the NSA legally illegal wiretapped the fiber lines going in, out and between their data centers. (No, that's not a typo in that sentence.)

[JN01]

Does it come with a certificate of authenticity?