5 ms·

> It's ironic to think that one of the main selling points of Blackberry was end-to-end security (the devices talked to an on-premises server via a dedicated mo

> It's ironic to think that one of the main selling points of Blackberry was end-to-end security (the devices talked to an on-premises server via a dedicated mobile APN which had to comply with a number of requirements), and yet its on-device security model allowed an app to take over such critical functionality _by design_. While true, the initial versions of iOS and Android represented a step down in security. (BlackBerry at least encrypted the phone, by default - maybe even required?) I was always baffled that the tech media would never mention how insecure Android or iOS were.

reaperducer 7y ago
Maybe because Android and iOS came out at the same time as people were learning that Blackberry's "security" was a pastiche. In order to operate in some countries, all Blackberry traffic had to be routed through that country's government servers. It's been a long while, but I'm pretty sure that India was one such country. And at least one Middle Eastern country.
- generalpass 7y ago
  > Maybe because Android and iOS came out at the same time as people were learning that Blackberry's "security" was a pastiche. > In order to operate in some countries, all Blackberry traffic had to be routed through that country's government servers. > It's been a long while, but I'm pretty sure that India was one such country. And at least one Middle Eastern country. This was only related to the BlackBerry Messenger (BBM), and even then only on the standard consumer phones. The corporate servers had their own keys, IIRC. Plus, it was only for messages traversing Indian or Pakistani networks, and my memory was that BlackBerry did not hand the keys over, just answered all of their requests. Even at that, this level of encrypted communications was not otherwise widely available for consumers. The actual migration from BBM to whatever iPhone and Android were offering were downgrades. I'm not aware that BlackBerry devices were ever rooted, and they were default encrypted with 128-bit AES. The OS required users to grant permission for apps to access resources, such as GPS. This took something close to a decade to be installed and enabled by default in iOS and Android. There was a big story where 3rd-party apps installed by providers contained malware. It was a huge story run everywhere and headlines made it sound as if every single phone had this vulnerability. However, they didn't mention the vulnerability could not affect BlackBerry devices because BlackBerry had a contract with all providers that the provider could not install any software to the device. Not security-related, but a big complaint from devs at the time was that BlackBerry had so many different devices that it was very expensive to develop for. Apple, for sure, and maybe Android promised this would never happen on their platforms. Only the truly naive could believe this. My takeaway was that BlackBerry somehow pissed-off all of the tech journos and suffered appropriately. That's why they got nothing but bad press. The other thing they suffered from was this "co-CEO" nonsense. For whatever reason, it seems nearly universal that if more than one person is in charge, nobody is accountable. Edit: And something even I forget about is that prior to the Snowden releases, concerns over government snooping were only for the tin-foil hat donned black-helicopter dodging conspiracy theorists. It just wasn't on the public's radar.
  - parliament32 7y ago
    >it was only for messages traversing Indian or Pakistani networks, and my memory was that BlackBerry did not hand the keys over, just answered all of their requests They handed over their "global encryption key" to the RCMP, see https://www.techdirt.com/articles/20160414/10482434186/canadian-law-enforcement-can-intercept-decrypt-blackberry-messages.shtml https://www.techdirt.com/articles/20160414/10482434186/canad... They jumped from "most secure" to "least secure" effectively immediately once they did that.
    - generalpass 7y ago
      > >it was only for messages traversing Indian or Pakistani networks, and my memory was that BlackBerry did not hand the keys over, just answered all of their requests > They handed over their "global encryption key" to the RCMP, see https://www.techdirt.com/articles/20160414/10482434186/canad.. https://www.techdirt.com/articles/20160414/10482434186/canad.... > They jumped from "most secure" to "least secure" effectively immediately once they did that. That article is an absolutely fantastic example of how the press treated BlackBerry (average consumers might come away thinking that BlackBerry devices are insecure). It is after BlackBerry was dead from a market share perspective, so this isn't really applicable to the period I am referring to, which was from iPhone launch to maybe as late as 2012, when BlackBerry went from hero to zero.
frandroid 7y ago
With a backdoor for governments... So meh!
- generalpass 7y ago
  > With a backdoor for governments... So meh! Well, maybe see my comment below for more, but backdoor implies a backdoor was required. With no encryption, as was the case with iOS and Android, no backdoor was required for communication intercepts or device, and you're only referring to BlackBerry Messenger. Users could install their own messaging apps and larger customers could opt for BES.

reaperducer 7y ago

Maybe because Android and iOS came out at the same time as people were learning that Blackberry's "security" was a pastiche. In order to operate in some countries, all Blackberry traffic had to be routed through that country's government servers. It's been a long while, but I'm pretty sure that India was one such country. And at least one Middle Eastern country.

generalpass 7y ago
> Maybe because Android and iOS came out at the same time as people were learning that Blackberry's "security" was a pastiche. > In order to operate in some countries, all Blackberry traffic had to be routed through that country's government servers. > It's been a long while, but I'm pretty sure that India was one such country. And at least one Middle Eastern country. This was only related to the BlackBerry Messenger (BBM), and even then only on the standard consumer phones. The corporate servers had their own keys, IIRC. Plus, it was only for messages traversing Indian or Pakistani networks, and my memory was that BlackBerry did not hand the keys over, just answered all of their requests. Even at that, this level of encrypted communications was not otherwise widely available for consumers. The actual migration from BBM to whatever iPhone and Android were offering were downgrades. I'm not aware that BlackBerry devices were ever rooted, and they were default encrypted with 128-bit AES. The OS required users to grant permission for apps to access resources, such as GPS. This took something close to a decade to be installed and enabled by default in iOS and Android. There was a big story where 3rd-party apps installed by providers contained malware. It was a huge story run everywhere and headlines made it sound as if every single phone had this vulnerability. However, they didn't mention the vulnerability could not affect BlackBerry devices because BlackBerry had a contract with all providers that the provider could not install any software to the device. Not security-related, but a big complaint from devs at the time was that BlackBerry had so many different devices that it was very expensive to develop for. Apple, for sure, and maybe Android promised this would never happen on their platforms. Only the truly naive could believe this. My takeaway was that BlackBerry somehow pissed-off all of the tech journos and suffered appropriately. That's why they got nothing but bad press. The other thing they suffered from was this "co-CEO" nonsense. For whatever reason, it seems nearly universal that if more than one person is in charge, nobody is accountable. Edit: And something even I forget about is that prior to the Snowden releases, concerns over government snooping were only for the tin-foil hat donned black-helicopter dodging conspiracy theorists. It just wasn't on the public's radar.
- parliament32 7y ago
  >it was only for messages traversing Indian or Pakistani networks, and my memory was that BlackBerry did not hand the keys over, just answered all of their requests They handed over their "global encryption key" to the RCMP, see https://www.techdirt.com/articles/20160414/10482434186/canadian-law-enforcement-can-intercept-decrypt-blackberry-messages.shtml https://www.techdirt.com/articles/20160414/10482434186/canad... They jumped from "most secure" to "least secure" effectively immediately once they did that.
  - generalpass 7y ago
    > >it was only for messages traversing Indian or Pakistani networks, and my memory was that BlackBerry did not hand the keys over, just answered all of their requests > They handed over their "global encryption key" to the RCMP, see https://www.techdirt.com/articles/20160414/10482434186/canad.. https://www.techdirt.com/articles/20160414/10482434186/canad.... > They jumped from "most secure" to "least secure" effectively immediately once they did that. That article is an absolutely fantastic example of how the press treated BlackBerry (average consumers might come away thinking that BlackBerry devices are insecure). It is after BlackBerry was dead from a market share perspective, so this isn't really applicable to the period I am referring to, which was from iPhone launch to maybe as late as 2012, when BlackBerry went from hero to zero.

frandroid 7y ago

With a backdoor for governments... So meh!

generalpass 7y ago
> With a backdoor for governments... So meh! Well, maybe see my comment below for more, but backdoor implies a backdoor was required. With no encryption, as was the case with iOS and Android, no backdoor was required for communication intercepts or device, and you're only referring to BlackBerry Messenger. Users could install their own messaging apps and larger customers could opt for BES.