5 ms·

Blackphone 2 – Coming Soon

50 points by mike-cardwell 11y ago

mtgx 11y ago
Have they ever responded to that warrant canary issue? https://news.ycombinator.com/item?id=8796307 https://news.ycombinator.com/item?id=8796307 https://news.ycombinator.com/item?id=9162186 https://news.ycombinator.com/item?id=9162186 By the looks of it, they seem to have updated the warrant canary: https://canary.silentcircle.com/?new-issue https://canary.silentcircle.com/?new-issue
- StavrosK 11y ago
  I'm not sure if there was a public statement, but I was commenting on the thread way back when it happened. It turns out that there was an editor issue with the way the canary was being updated that prevented the new one from getting saved, and nobody realized that was the case. We've since changed the way we update the canary and added monitoring checks to notify us if it's out of date. IIRC we also changed the text to a more clear version.
ch4s3 11y ago
I'd be curious to hear from anyone that has a Blackphone. How does it compare to other phones you have used? Do you plan to get a Blackphone 2?
- rbcgerard 11y ago
  In particular, what's it like using the phone outside of the silent circle ecosystem...because let's face it, 95% of the people you are going to call/text etc will not be using a similar device
  - ch4s3 11y ago
    I was wondering that as well.
  - orph4nus 11y ago
    I would assume it would have the same effect as with end-to-end encryption mails, where you just have unencrypted data when you are communicating with people that don't support this. Such as is the case with https://protonmail.ch/ https://protonmail.ch/
  - jquast 11y ago
    your side is encrypted to the telecom systems switch hosted by silentcircle, unencrypted outbound from there.
- jquast 11y ago
  Blackphone for ~4 months. I never used an android before purchasing the blackphone. I previously used an iPod with silentcircle. The blackphone is pretty poor. Maybe most androids are this poor, but I feel ripped off. I re-enabled the iPod for using silentcircle at home -- the call quality is better !! As far as security. I don't know. Shark repellent works fine all the way up until you die by shark.
ilurk 11y ago
AFAIK only the Neo9000 offers baseband isolation from the main system. https://neo900.org/faq https://neo900.org/faq > Unlike some other smartphones do, Neo900 won't share system RAM with the modem and system CPU will always have full control over the microphone signal sent to the modem. You can think of it as a USB dongle connected to the PC, with you in full control over the drivers, with a virtual LED to show any modem activity. I found no information on baseband isolation for the Blackphone. Does anyone has further information on this?
- mr337 11y ago
  I have been following the Neo9000 project and debating on getting a phone. They are crazy expensive since aren't produced in mass quantity, when they start shipping. We will see how it pans out.
  - dogma1138 11y ago
    650-700$ for a phone with a decade old hardware which is weaker than the original RaspberryPi what for exactly? Yes it will be able to make calls but other than that it's DSP won't even be able to play modern video formats...
- EthanHeilman 11y ago
  Baseband isolation is a must for a secure phone. Blackphone does not offer it and blackphones can been compromised as a result[1]. >"The Blackphone does not protect you against vulnerabilities in the Android subsystem, in the application processor (SoC), or in the baseband itself." [1] Blackphone excels at protecting communication from passive adversaries, but it needs to shore up endpoint security. >The makers of Blackphone are well aware of this. “We have a bit of a problem with the press saying that the Blackphone will make you NSA-proof. If someone [at the Blackphone booth] tells you that it’ll protect you from the NSA, I’ll fire them,” Phil Zimmermann, one of the Blackphone’s creators, told Anthony. - [2] While the NEO9000 has some baseband isolation, I would still be extremely careful in assuming this isolation is complete. I haven't researched this enough to have an opinion but I would like to know exactly what privileges it has and what sandboxing is done to isolate it. [1]: http://www.itproportal.com/2014/02/26/blackphones-big-problem-the-belief-that-the-device-is-nsa-proof/#ixzz2uW5QC6WJ http://www.itproportal.com/2014/02/26/blackphones-big-proble... [2]: http://qz.com/181977/hidden-risk-in-blackphones-secure-communications/ http://qz.com/181977/hidden-risk-in-blackphones-secure-commu...
d_theorist 11y ago
In Chromium on Ubuntu I'm getting: "You attempted to reach www.silentcircle.com, but the server presented a certificate issued by an entity that is not trusted by your computer's operating system. This may mean that the server has generated its own security credentials, which Chromium cannot rely on for identity information, or an attacker may be trying to intercept your communications."
- mike-cardwell 11y ago
  Weird. I'm getting the same thing using Chromium on Debian Jessie. Firefox on the same system has no such warning. I don't see any errors on ssllabs.com, but interestingly, it only supports TLS1.1 and above. No support for TLS1.0: https://www.ssllabs.com/ssltest/analyze.html?d=silentcircle.com https://www.ssllabs.com/ssltest/analyze.html?d=silentcircle....
  - heinrich5991 11y ago
    I believe Firefox ships their own Root Certificates.
- LinuxBender 11y ago
  Not every device supports SNI yet. I wish they all did, SNI would be quite handy. They also disabled TLS 1.0. That will also break quite a few browsers, believe it or not.
- mike-cardwell 11y ago
  I don't know what they changed, but it works now.
karmakaze 11y ago
The product info would be much more interesting with target pricing. Anyone have an idea?
Zhenya 11y ago
Is silentcircle no longer offering the service for consumers? Cache shows this: http://webcache.googleusercontent.com/search?q=cache:oiqIFBtn7TgJ:https://silentcircle.com/pricing+&cd=1&hl=en&ct=clnk&gl=us http://webcache.googleusercontent.com/search?q=cache:oiqIFBt... Starter 100 Silent World Minutes Make Calls to 120 Destinations Unlimited Received Calls Unlimited Member to Member $12.95 /month etc but their website now only has you contact sales for enterprise: https://silentcircle.com/products-and-solutions/ https://silentcircle.com/products-and-solutions/
- dogma1138 11y ago
  You can still register as a personal user with and buy a subscription for 1 to 50 users.

50 points by mike-cardwell 11y ago

mtgx 11y ago

Have they ever responded to that warrant canary issue? https://news.ycombinator.com/item?id=8796307 https://news.ycombinator.com/item?id=8796307 https://news.ycombinator.com/item?id=9162186 https://news.ycombinator.com/item?id=9162186 By the looks of it, they seem to have updated the warrant canary: https://canary.silentcircle.com/?new-issue https://canary.silentcircle.com/?new-issue

StavrosK 11y ago
I'm not sure if there was a public statement, but I was commenting on the thread way back when it happened. It turns out that there was an editor issue with the way the canary was being updated that prevented the new one from getting saved, and nobody realized that was the case. We've since changed the way we update the canary and added monitoring checks to notify us if it's out of date. IIRC we also changed the text to a more clear version.

ch4s3 11y ago

I'd be curious to hear from anyone that has a Blackphone. How does it compare to other phones you have used? Do you plan to get a Blackphone 2?

rbcgerard 11y ago
In particular, what's it like using the phone outside of the silent circle ecosystem...because let's face it, 95% of the people you are going to call/text etc will not be using a similar device
- ch4s3 11y ago
  I was wondering that as well.
- orph4nus 11y ago
  I would assume it would have the same effect as with end-to-end encryption mails, where you just have unencrypted data when you are communicating with people that don't support this. Such as is the case with https://protonmail.ch/ https://protonmail.ch/
- jquast 11y ago
  your side is encrypted to the telecom systems switch hosted by silentcircle, unencrypted outbound from there.
jquast 11y ago
Blackphone for ~4 months. I never used an android before purchasing the blackphone. I previously used an iPod with silentcircle. The blackphone is pretty poor. Maybe most androids are this poor, but I feel ripped off. I re-enabled the iPod for using silentcircle at home -- the call quality is better !! As far as security. I don't know. Shark repellent works fine all the way up until you die by shark.

ilurk 11y ago

AFAIK only the Neo9000 offers baseband isolation from the main system. https://neo900.org/faq https://neo900.org/faq > Unlike some other smartphones do, Neo900 won't share system RAM with the modem and system CPU will always have full control over the microphone signal sent to the modem. You can think of it as a USB dongle connected to the PC, with you in full control over the drivers, with a virtual LED to show any modem activity. I found no information on baseband isolation for the Blackphone. Does anyone has further information on this?

mr337 11y ago
I have been following the Neo9000 project and debating on getting a phone. They are crazy expensive since aren't produced in mass quantity, when they start shipping. We will see how it pans out.
- dogma1138 11y ago
  650-700$ for a phone with a decade old hardware which is weaker than the original RaspberryPi what for exactly? Yes it will be able to make calls but other than that it's DSP won't even be able to play modern video formats...
EthanHeilman 11y ago
Baseband isolation is a must for a secure phone. Blackphone does not offer it and blackphones can been compromised as a result[1]. >"The Blackphone does not protect you against vulnerabilities in the Android subsystem, in the application processor (SoC), or in the baseband itself." [1] Blackphone excels at protecting communication from passive adversaries, but it needs to shore up endpoint security. >The makers of Blackphone are well aware of this. “We have a bit of a problem with the press saying that the Blackphone will make you NSA-proof. If someone [at the Blackphone booth] tells you that it’ll protect you from the NSA, I’ll fire them,” Phil Zimmermann, one of the Blackphone’s creators, told Anthony. - [2] While the NEO9000 has some baseband isolation, I would still be extremely careful in assuming this isolation is complete. I haven't researched this enough to have an opinion but I would like to know exactly what privileges it has and what sandboxing is done to isolate it. [1]: http://www.itproportal.com/2014/02/26/blackphones-big-problem-the-belief-that-the-device-is-nsa-proof/#ixzz2uW5QC6WJ http://www.itproportal.com/2014/02/26/blackphones-big-proble... [2]: http://qz.com/181977/hidden-risk-in-blackphones-secure-communications/ http://qz.com/181977/hidden-risk-in-blackphones-secure-commu...

d_theorist 11y ago

In Chromium on Ubuntu I'm getting: "You attempted to reach www.silentcircle.com, but the server presented a certificate issued by an entity that is not trusted by your computer's operating system. This may mean that the server has generated its own security credentials, which Chromium cannot rely on for identity information, or an attacker may be trying to intercept your communications."

mike-cardwell 11y ago
Weird. I'm getting the same thing using Chromium on Debian Jessie. Firefox on the same system has no such warning. I don't see any errors on ssllabs.com, but interestingly, it only supports TLS1.1 and above. No support for TLS1.0: https://www.ssllabs.com/ssltest/analyze.html?d=silentcircle.com https://www.ssllabs.com/ssltest/analyze.html?d=silentcircle....
- heinrich5991 11y ago
  I believe Firefox ships their own Root Certificates.
LinuxBender 11y ago
Not every device supports SNI yet. I wish they all did, SNI would be quite handy. They also disabled TLS 1.0. That will also break quite a few browsers, believe it or not.
mike-cardwell 11y ago
I don't know what they changed, but it works now.

karmakaze 11y ago

The product info would be much more interesting with target pricing. Anyone have an idea?

Zhenya 11y ago

Is silentcircle no longer offering the service for consumers? Cache shows this: http://webcache.googleusercontent.com/search?q=cache:oiqIFBtn7TgJ:https://silentcircle.com/pricing+&cd=1&hl=en&ct=clnk&gl=us http://webcache.googleusercontent.com/search?q=cache:oiqIFBt... Starter 100 Silent World Minutes Make Calls to 120 Destinations Unlimited Received Calls Unlimited Member to Member $12.95 /month etc but their website now only has you contact sales for enterprise: https://silentcircle.com/products-and-solutions/ https://silentcircle.com/products-and-solutions/

dogma1138 11y ago
You can still register as a personal user with and buy a subscription for 1 to 50 users.