3 ms·

While the article implies that corporate BES customers would be compromised with this move, Crackberry is refuting that aspect: http://crackberry.com/rim-encryp

While the article implies that corporate BES customers would be compromised with this move, Crackberry is refuting that aspect: http://crackberry.com/rim-encryption-keys http://crackberry.com/rim-encryption-keys

tensor 14y ago
I was under the impression that RIM doesn't even have access to corporate encryption keys.
- Zenst 14y ago
  I think you will find that the key is used for a VPN link to the RIM servers, which in turn push the email out to the telco over another encrypted link. Bottom line the handset has to be able to decript it, so between the telco and the handset there is a common key at work. Still if you don't trust your own goverment then why would they trust you. Just wished some goverments were as open as they like us the public to be.
  - omh 14y ago
    According to RIM, the device key is used to encrypt all messages. The device tells the corporate server its key and the corporate server encrypts every message before it is sent. There is no common key between the telco and handset for the message content. (This is on top of the VPN link etc.) Of course it's hard to verify RIM's claims since the whole system is run by them.
  - nathan_long 14y ago
    >> if you don't trust your own goverment then why would they trust you. In the context of intercepting and storing your messages, trusting "your own government" means thousands of strangers, government employees and contractors alike, in this and future administrations, both now and as long as the data is stored (likely beyond your lifetime). It means trusting that they won't leak that data intentionally, for political or personal gain, or by incompetence, under attack by hackers all over the world. (And let's face it, almost no one is competent when it comes to that level of attacks.) If you send any information at all, business or personal, that you wouldn't want to be used against you, you can either trust all of these people, or you can use strong encryption and never worry about it again.
    - EthanHeilman 14y ago
      >It means trusting that they won't leak that data intentionally, for political or personal gain, or by incompetence, under attack by hackers all over the world. This! No communication is as secure as it could be if gives access to someone that is not an intended recipient. It's not a matter of trust, it is a matter of design and common sense. I trust plenty of people, but I don't email them the passwords to all my accounts. Doing so would be an unnecessary risk with zero benefit even if they are 100% trustworthy (possible) and even if they are never compromised (extremely unlikely) because other people's systems are beyond my knowledge and my control. How can someone analyze risk under such circumstances? * Do you think a secretive intelligence agency is going to announce that they were compromised? * Even if they do, how much data are they going to provide on what exactly was stolen?
- mrb 14y ago
  Of course they do have access to these keys. Their own code runs on the device. They could very well have the OS communicate the keys back to RIM's servers.
  - omh 14y ago
    They could of course have some code on the device which reports this back, or failing that something which lets them force an update to the OS to add this functionality. But if they haven't put either of those in place already then it's too late. They'd be relying on customers updating the software themselves, which is unlikely - especially for many security conscious companies.

tensor 14y ago

I was under the impression that RIM doesn't even have access to corporate encryption keys.

Zenst 14y ago
I think you will find that the key is used for a VPN link to the RIM servers, which in turn push the email out to the telco over another encrypted link. Bottom line the handset has to be able to decript it, so between the telco and the handset there is a common key at work. Still if you don't trust your own goverment then why would they trust you. Just wished some goverments were as open as they like us the public to be.
- omh 14y ago
  According to RIM, the device key is used to encrypt all messages. The device tells the corporate server its key and the corporate server encrypts every message before it is sent. There is no common key between the telco and handset for the message content. (This is on top of the VPN link etc.) Of course it's hard to verify RIM's claims since the whole system is run by them.
- nathan_long 14y ago
  >> if you don't trust your own goverment then why would they trust you. In the context of intercepting and storing your messages, trusting "your own government" means thousands of strangers, government employees and contractors alike, in this and future administrations, both now and as long as the data is stored (likely beyond your lifetime). It means trusting that they won't leak that data intentionally, for political or personal gain, or by incompetence, under attack by hackers all over the world. (And let's face it, almost no one is competent when it comes to that level of attacks.) If you send any information at all, business or personal, that you wouldn't want to be used against you, you can either trust all of these people, or you can use strong encryption and never worry about it again.
  - EthanHeilman 14y ago
    >It means trusting that they won't leak that data intentionally, for political or personal gain, or by incompetence, under attack by hackers all over the world. This! No communication is as secure as it could be if gives access to someone that is not an intended recipient. It's not a matter of trust, it is a matter of design and common sense. I trust plenty of people, but I don't email them the passwords to all my accounts. Doing so would be an unnecessary risk with zero benefit even if they are 100% trustworthy (possible) and even if they are never compromised (extremely unlikely) because other people's systems are beyond my knowledge and my control. How can someone analyze risk under such circumstances? * Do you think a secretive intelligence agency is going to announce that they were compromised? * Even if they do, how much data are they going to provide on what exactly was stolen?
mrb 14y ago
Of course they do have access to these keys. Their own code runs on the device. They could very well have the OS communicate the keys back to RIM's servers.
- omh 14y ago
  They could of course have some code on the device which reports this back, or failing that something which lets them force an update to the OS to add this functionality. But if they haven't put either of those in place already then it's too late. They'd be relying on customers updating the software themselves, which is unlikely - especially for many security conscious companies.