3 ms·
Few years ago I noticed BBM Enterprise touts end-to-end encryption pretty strongly in their marketing, without mentioning an up-front caveat. https://www.black
by frabjoused 6y ago
Few years ago I noticed BBM Enterprise touts end-to-end encryption pretty strongly in their marketing, without mentioning an up-front caveat.
https://www.blackberry.com/us/en/products/bbm-enterprise https://www.blackberry.com/us/en/products/bbm-enterprise
Turns out that by default, BBME is not end-to-end. The initial handshake is transparent to Blackberry, and they could use that to decrypt future messages without your knowledge.
To enable true end-to-end, you have to opt in to an out of band handshake to start each new conversation, an option you can turn on in their admin console.
How many people are actually going to opt in to dealing with a confirmation SMS for every new thread?
I reached out to Blackberry at the time to update their literature as it was misleading, but no action was taken by them.
- dane-pgp 6y agoBlackBerry has always been untrustworthy when it comes to encryption: > The defence in the case surmised that the RCMP must have used the "correct global encryption key," since any attempt to apply a key other than BlackBerry's own global encryption key would have resulted in a garbled mess. According to the judge, "all parties"—including the Crown—agree that "the RCMP would have had the correct global key when it decrypted messages during its investigation." https://www.vice.com/en/article/mg77vv/rcmp-blackberry-project-clemenza-global-encryption-key-canada https://www.vice.com/en/article/mg77vv/rcmp-blackberry-proje...