10 ms·

Blackphone

93 points by MrEliasen 13y ago

robin_reala 13y ago
So I’m guessing this still has a black-box baseband?
- bsilvereagle 13y ago
  I'd say so. See comments from previous post about a month ago: https://news.ycombinator.com/item?id=7062748 https://news.ycombinator.com/item?id=7062748
colinbartlett 13y ago
It's a bit disconcerting to see that it comes with software "enabled for at least 2 years of usage".
- byoogle 13y ago
  Why? I believe that sentence refers to extra software/services that’d normally be paid.
  - StavrosK 13y ago
    It does, you get 2 years' worth of subscription to various services.
- cpenner461 13y ago
  Yeah I wondered the same thing. Needs some clarification - it reads to me like "we plan to be in business for at least 2 years, during which time your phone will work", but leaves me wondering how useful the phone would be if they went out of business.
jebus989 13y ago
Transparently marketing fear. Apparently this phone is for you if you ever [0]: > speak personally with a partner > worry about your kids Shameful. [0] https://www.blackphone.ch/individuals/ https://www.blackphone.ch/individuals/
- higherpurpose 13y ago
  I think most people need some fear about state spying. Most are still treating it like it's no big deal. It's like the Stasi are here and no one gives a damn. That should scare people. Maybe we're deeper into Huxley's world than we thought.
  - lordCarbonFiber 13y ago
    Amusingly enough, I think a large part of why people aren't more scared are sentiments like the ones you just expressed. It is plainly not "just like the Stasi are here" and the average person can see that. By overstating the threat we de-legitimise our concerns and apathy grows (similar to the effect the DARE program had on drug use). Is the expansion of state level surveillance cause for concern? Of course it is! However, we are by no means living in a police state and saying so is an insult towards the people working very hard to effect policy to keep it that way. In short, in my opinion, we should spread less fear mongering and more political activism if we want to see change in these policies.
  - brown9-2 13y ago
    Or perhaps people are treating it like a big deal because it turns out that the Stasi actually isn't here.
  - nirnira 13y ago
    Um, I think you mean Orwell's world. Unless you're trying to compare us to people who are too busy getting high and going to senso-movies to care about anything important. Or are you implying we make babies in factories?
Nrsolis 13y ago
I hate to break it to you, but this is not going to keep you safe from a state-level adversary. I could drone on about this for pages and pages, but the sad fact is that if you are a target, it doesn't matter that you are using a "secure phone", "secure OS", or "encryption". Time and time again, these systems have been broken or breached with simple tradecraft and subtle sabotage. The Pentagon has a concerted (and expensive) effort to validate or verify the absence of "backdoors" or evidence of "additional circuitry" on ASICs or subsystems of it's major weapons systems and associated gadgetry. Do you? I tell people that their simplest way to avoid having their communications intercepted is to NOT. USE. AN. ELECTRONIC. COMMUNICATIONS. DEVICE. UBL used couriers, flash drives, and cutouts. If you need that level of protection, SO SHOULD YOU. When I need to communicate secretly I BUY SOMEONE A BEER.
- scrrr 13y ago
  If it made it harder for non-state adversaries to create profiles about you, it would still be a good thing. I don't want the Gov. to know about my private life. But neither do I want any search engine, online store or ISP to have that data. So even though you are right, it's still better to choose a safer technology.
- rjzzleep 13y ago
  > When I need to communicate secretly I BUY SOMEONE A BEER. Hi Richard, it has come to our attention that you have been secretively discussing leaking government information to our enemy in a pub in central London. What's that you say? You didn't discuss private information? Then why did you try to conceal your handwriting on the napkin from our CCTV security cameras? We'd like to take you in for questioning. If you resist this may end badly for you. On a sidenote, if they at least have 2 separate SoC's on board, and a self rolled hardware firewall to make sure the baseband can't access things it shouldn't access, that may still be a great improvement to what we have right now. It still won't protect you from unknown hardware level exploits, but it's better than nothing.
  - electrichead 13y ago
    Very curious, how did you discover that his name was Richard? Edit: nm, I should have just googled it :)
line-zero 13y ago
"A $700 high-powered tracking device that protects your privacy!" What a scam.
- jmnicolas 13y ago
  But ... but it's black !
sigsergv 13y ago
Nope, it's still there.
xeeton 13y ago
For $629 you could by quite a few one-time or short-time use trac phones that you buy with cash. Wouldn't that be more secure/private than this?
- higherpurpose 13y ago
  Maybe if you speak in code the whole time, and never reveal the identities of both of you. The contents of the conversation will not be secure, so you have to assume they are hearing it, but don't understand what you're talking about. That may be a little difficult.
- roc 13y ago
  Burners are an effective defense against single-phone-number taps. But in an era of dragnet surveillance and meta-data analysis [1] they're not very useful. Unless you're calling varying phones, at varying places, from varying places, at varying times, all with no discernible pattern or schedule -- it would be easy enough for them to identify a network of burners and determine which ones belong to which individuals on the network based on that meta-data. And if anyone in the network carried or used a 'real' phone alongside the burner, it would only get easier. And you can Google search on the news wires to see how well people do at this game, even when they know their lives are literally on the line and thus devote a significant portion of their effort toward it. [1] Done well-enough to be confident-enough to lob hellfire missiles at SIM cards in not-quite-friendly countries...
csmatt 13y ago
Does it protect against this http://abcnews.go.com/blogs/headlines/2006/12/can_you_hear_me/ http://abcnews.go.com/blogs/headlines/2006/12/can_you_hear_m... ?
davexunit 13y ago
A prerequisite for security is free software. Critical applications like the Silent Circle ones are proprietary, afaict. I have zero trust in the Blackphone and would not purchase one.
- byoogle 13y ago
  This Verge article [1] says “The company will open source the vast majority of its code for the phone in order for third parties to properly audit its techniques, find holes, and ultimately help to improve the product.” 1. http://www.theverge.com/2014/2/24/5441642/blackphone-silent-circle-geeksphone-pre-order-launch http://www.theverge.com/2014/2/24/5441642/blackphone-silent-...
  - sspiff 13y ago
    If they do, that would go a long way to convincing me this is a tidbit more secure than any other random Android device. They should really have released their code at the same time they released their phone though.
    - theboss 13y ago
      I've talked to Silent Circle at conferences and what not. It is not like they have some crypto noob working on their project...They have Phil Zimmerman. But, knowing nothing about them, when I asked them ``How does your protocol compare to TextSecure's Axolotl?'' the response was ``We have Phil Zimmerman''. So....I'm still a bit put off by them. Some of their code is already open-sourced here. https://github.com/SilentCircle https://github.com/SilentCircle
      - StavrosK 13y ago
        As someone who works at Silent Circle (though not someone who can speak FOR SC), I'd say "Axolotl and SCIMP are both very good". Also, I don't know who you talked to, but keep in mind that not everyone working for SC is technical and can explain (or sometimes even knows) what Axolotl is/how it works.
runn1ng 13y ago
I am not sure why do anyone needs that. You can have basically secure messaging on the phone today. You can use Replicant (libre software) on many phones where there probably are no backdoors, you can use OTR with Xabber (you can build it yourself), there are probably applications for PGP too. Yeah, Replicant will fail to work on many phones and on those that work, half of the functionality is missing ( http://redmine.replicant.us/projects/replicant/wiki/ReplicantStatus#Replicant-42 http://redmine.replicant.us/projects/replicant/wiki/Replican... ) - but trying to sell non-free phone as "secure" is snake-oil anyway. In my humble opinion.
- 01Michael10 13y ago
  Yes, one can do all that but I think the market Blackphone is going for is the paranoid but less tech savvy crowd that wants a working solution out of the box. I am not saying this implementation is an actual working solution...
- shawabawa3 13y ago
  Reminds of this classic comment: https://news.ycombinator.com/item?id=9224 https://news.ycombinator.com/item?id=9224 Guy complaining that dropbox is useless because "For a Linux user, you can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using SVN or CVS on the mounted filesystem."
mosselman 13y ago
How compatible is the OS with 'normal' android apps? Since 4.4 I have been able to, at least to some level, revoke some basic rights that apps have, like seeing my contacts (through app shield or whatever). If I am able to download apps from the 'normal' Android store, is access that those apps have somehow controlled as well? Some sort of sandbox mode would be nice.
gfv 13y ago
I hate this circlejerk around privacy. Not as a concept though. It seems like every geek-oriented app or device is "private and secure" with "state-of-the-art encryption capabilities" nowadays, even though they continue to use pretty much same software and hardware as they did a year ago, before Snowden. As for this phone -- they don't even have exact specifications and they plan to ship it in June, just four months away. Come on, ">2GHz Quad Core CPU" is a placeholder and not a real deal, especially with a "certain specifications are subject to change" in small font. I do not think that it will be released in June, and, if it will actually be released, I don't really think it will get popular enough to break the "friends and relatives of the developer" barrier. I may be a little too tough (sorry!), but I got really tired of all these startups that propose nothing new besides illusive security with a bad implementation.
01Michael10 13y ago
Gee, you think being on Blackphone's mailing list I would like maybe get an email that it's available. Edit: Ha! I just received the email...
bcl 13y ago
Shipping in June is not exactly 'here'. Come back when independent people can verify and reproduce the software it is running. Open sourcing "vast majority of its code" is not good enough -- this thing is selling security and if you can't rebuild it all yourself there's really no point.
Navarr 13y ago
Hardware android buttons? What is this, 2010?
Ihmahr 13y ago
WHY use a vpn when you can already use Tor on android?
ptaffs 13y ago
It seems like just avoiding mainstream popular services is enough to regain a lot of privacy, if the agencies look no further than Verizon, Google, Twitter, Facebook. They know exactly what my parents activities are.
etiam 13y ago
From an interview I read a while ago I got the impression that Blackphone wouldn't claim to protect from state-level adversaries, and maybe if you were to ask them to be explicit about it they really don't. One could easily come away with another impression from the description here though. That's a shame, since protection from state level adversaries is really what's at the top of my feature wish list, and that probably goes for a fair amount of other people too, in this day and age. Is anyone here aware of cell-phone-like projects that have potential to resist exploitation of the type we've seen reported from Five Eyes? I'd be particularly curious about ways to mitigate the location tracking.
whyme 13y ago
Sadly, we live in a world where it's quite possible that phones like these are nothing more than a ploy to lure NSA targets in. They need to get people, who have something to hide, to feel safe again.
rimantas 13y ago
That "unique combination" does not assure me but reminds of the curse "may you live in interesting times".
grifpete 13y ago
What about the 'second operating system?' The baseband software? http://www.osnews.com/story/27416/The_second_operating_system_hiding_in_every_mobile_phone http://www.osnews.com/story/27416/The_second_operating_syste...
badman_ting 13y ago
"Select 3rd party apps". Now there's a crazy idea -- what if the maker of the device vetted the apps that run on the device? Crazy idea. It just might work.
rickisen 13y ago
So is this PrivatOS open source, or irrelevant?

Blackphone

93 points by MrEliasen 13y ago

robin_reala 13y ago

So I’m guessing this still has a black-box baseband?

bsilvereagle 13y ago
I'd say so. See comments from previous post about a month ago: https://news.ycombinator.com/item?id=7062748 https://news.ycombinator.com/item?id=7062748

colinbartlett 13y ago

It's a bit disconcerting to see that it comes with software "enabled for at least 2 years of usage".

byoogle 13y ago
Why? I believe that sentence refers to extra software/services that’d normally be paid.
- StavrosK 13y ago
  It does, you get 2 years' worth of subscription to various services.
cpenner461 13y ago
Yeah I wondered the same thing. Needs some clarification - it reads to me like "we plan to be in business for at least 2 years, during which time your phone will work", but leaves me wondering how useful the phone would be if they went out of business.

jebus989 13y ago

Transparently marketing fear. Apparently this phone is for you if you ever [0]: > speak personally with a partner > worry about your kids Shameful. [0] https://www.blackphone.ch/individuals/ https://www.blackphone.ch/individuals/

higherpurpose 13y ago
I think most people need some fear about state spying. Most are still treating it like it's no big deal. It's like the Stasi are here and no one gives a damn. That should scare people. Maybe we're deeper into Huxley's world than we thought.
- lordCarbonFiber 13y ago
  Amusingly enough, I think a large part of why people aren't more scared are sentiments like the ones you just expressed. It is plainly not "just like the Stasi are here" and the average person can see that. By overstating the threat we de-legitimise our concerns and apathy grows (similar to the effect the DARE program had on drug use). Is the expansion of state level surveillance cause for concern? Of course it is! However, we are by no means living in a police state and saying so is an insult towards the people working very hard to effect policy to keep it that way. In short, in my opinion, we should spread less fear mongering and more political activism if we want to see change in these policies.
- brown9-2 13y ago
  Or perhaps people are treating it like a big deal because it turns out that the Stasi actually isn't here.
- nirnira 13y ago
  Um, I think you mean Orwell's world. Unless you're trying to compare us to people who are too busy getting high and going to senso-movies to care about anything important. Or are you implying we make babies in factories?

Nrsolis 13y ago

I hate to break it to you, but this is not going to keep you safe from a state-level adversary. I could drone on about this for pages and pages, but the sad fact is that if you are a target, it doesn't matter that you are using a "secure phone", "secure OS", or "encryption". Time and time again, these systems have been broken or breached with simple tradecraft and subtle sabotage. The Pentagon has a concerted (and expensive) effort to validate or verify the absence of "backdoors" or evidence of "additional circuitry" on ASICs or subsystems of it's major weapons systems and associated gadgetry. Do you? I tell people that their simplest way to avoid having their communications intercepted is to NOT. USE. AN. ELECTRONIC. COMMUNICATIONS. DEVICE. UBL used couriers, flash drives, and cutouts. If you need that level of protection, SO SHOULD YOU. When I need to communicate secretly I BUY SOMEONE A BEER.

scrrr 13y ago
If it made it harder for non-state adversaries to create profiles about you, it would still be a good thing. I don't want the Gov. to know about my private life. But neither do I want any search engine, online store or ISP to have that data. So even though you are right, it's still better to choose a safer technology.
rjzzleep 13y ago
> When I need to communicate secretly I BUY SOMEONE A BEER. Hi Richard, it has come to our attention that you have been secretively discussing leaking government information to our enemy in a pub in central London. What's that you say? You didn't discuss private information? Then why did you try to conceal your handwriting on the napkin from our CCTV security cameras? We'd like to take you in for questioning. If you resist this may end badly for you. On a sidenote, if they at least have 2 separate SoC's on board, and a self rolled hardware firewall to make sure the baseband can't access things it shouldn't access, that may still be a great improvement to what we have right now. It still won't protect you from unknown hardware level exploits, but it's better than nothing.
- electrichead 13y ago
  Very curious, how did you discover that his name was Richard? Edit: nm, I should have just googled it :)

line-zero 13y ago

"A $700 high-powered tracking device that protects your privacy!" What a scam.

jmnicolas 13y ago
But ... but it's black !

sigsergv 13y ago

Nope, it's still there.

xeeton 13y ago

For $629 you could by quite a few one-time or short-time use trac phones that you buy with cash. Wouldn't that be more secure/private than this?

higherpurpose 13y ago
Maybe if you speak in code the whole time, and never reveal the identities of both of you. The contents of the conversation will not be secure, so you have to assume they are hearing it, but don't understand what you're talking about. That may be a little difficult.
roc 13y ago
Burners are an effective defense against single-phone-number taps. But in an era of dragnet surveillance and meta-data analysis [1] they're not very useful. Unless you're calling varying phones, at varying places, from varying places, at varying times, all with no discernible pattern or schedule -- it would be easy enough for them to identify a network of burners and determine which ones belong to which individuals on the network based on that meta-data. And if anyone in the network carried or used a 'real' phone alongside the burner, it would only get easier. And you can Google search on the news wires to see how well people do at this game, even when they know their lives are literally on the line and thus devote a significant portion of their effort toward it. [1] Done well-enough to be confident-enough to lob hellfire missiles at SIM cards in not-quite-friendly countries...

csmatt 13y ago

Does it protect against this http://abcnews.go.com/blogs/headlines/2006/12/can_you_hear_me/ http://abcnews.go.com/blogs/headlines/2006/12/can_you_hear_m... ?

davexunit 13y ago

A prerequisite for security is free software. Critical applications like the Silent Circle ones are proprietary, afaict. I have zero trust in the Blackphone and would not purchase one.

byoogle 13y ago
This Verge article [1] says “The company will open source the vast majority of its code for the phone in order for third parties to properly audit its techniques, find holes, and ultimately help to improve the product.” 1. http://www.theverge.com/2014/2/24/5441642/blackphone-silent-circle-geeksphone-pre-order-launch http://www.theverge.com/2014/2/24/5441642/blackphone-silent-...
- sspiff 13y ago
  If they do, that would go a long way to convincing me this is a tidbit more secure than any other random Android device. They should really have released their code at the same time they released their phone though.
  - theboss 13y ago
    I've talked to Silent Circle at conferences and what not. It is not like they have some crypto noob working on their project...They have Phil Zimmerman. But, knowing nothing about them, when I asked them ``How does your protocol compare to TextSecure's Axolotl?'' the response was ``We have Phil Zimmerman''. So....I'm still a bit put off by them. Some of their code is already open-sourced here. https://github.com/SilentCircle https://github.com/SilentCircle
    - StavrosK 13y ago
      As someone who works at Silent Circle (though not someone who can speak FOR SC), I'd say "Axolotl and SCIMP are both very good". Also, I don't know who you talked to, but keep in mind that not everyone working for SC is technical and can explain (or sometimes even knows) what Axolotl is/how it works.

runn1ng 13y ago

I am not sure why do anyone needs that. You can have basically secure messaging on the phone today. You can use Replicant (libre software) on many phones where there probably are no backdoors, you can use OTR with Xabber (you can build it yourself), there are probably applications for PGP too. Yeah, Replicant will fail to work on many phones and on those that work, half of the functionality is missing ( http://redmine.replicant.us/projects/replicant/wiki/ReplicantStatus#Replicant-42 http://redmine.replicant.us/projects/replicant/wiki/Replican... ) - but trying to sell non-free phone as "secure" is snake-oil anyway. In my humble opinion.

01Michael10 13y ago
Yes, one can do all that but I think the market Blackphone is going for is the paranoid but less tech savvy crowd that wants a working solution out of the box. I am not saying this implementation is an actual working solution...
shawabawa3 13y ago
Reminds of this classic comment: https://news.ycombinator.com/item?id=9224 https://news.ycombinator.com/item?id=9224 Guy complaining that dropbox is useless because "For a Linux user, you can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using SVN or CVS on the mounted filesystem."

mosselman 13y ago

How compatible is the OS with 'normal' android apps? Since 4.4 I have been able to, at least to some level, revoke some basic rights that apps have, like seeing my contacts (through app shield or whatever). If I am able to download apps from the 'normal' Android store, is access that those apps have somehow controlled as well? Some sort of sandbox mode would be nice.

gfv 13y ago

I hate this circlejerk around privacy. Not as a concept though. It seems like every geek-oriented app or device is "private and secure" with "state-of-the-art encryption capabilities" nowadays, even though they continue to use pretty much same software and hardware as they did a year ago, before Snowden. As for this phone -- they don't even have exact specifications and they plan to ship it in June, just four months away. Come on, ">2GHz Quad Core CPU" is a placeholder and not a real deal, especially with a "certain specifications are subject to change" in small font. I do not think that it will be released in June, and, if it will actually be released, I don't really think it will get popular enough to break the "friends and relatives of the developer" barrier. I may be a little too tough (sorry!), but I got really tired of all these startups that propose nothing new besides illusive security with a bad implementation.

01Michael10 13y ago

Gee, you think being on Blackphone's mailing list I would like maybe get an email that it's available. Edit: Ha! I just received the email...

bcl 13y ago

Shipping in June is not exactly 'here'. Come back when independent people can verify and reproduce the software it is running. Open sourcing "vast majority of its code" is not good enough -- this thing is selling security and if you can't rebuild it all yourself there's really no point.

Navarr 13y ago

Hardware android buttons? What is this, 2010?

Ihmahr 13y ago

WHY use a vpn when you can already use Tor on android?

ptaffs 13y ago

It seems like just avoiding mainstream popular services is enough to regain a lot of privacy, if the agencies look no further than Verizon, Google, Twitter, Facebook. They know exactly what my parents activities are.

etiam 13y ago

From an interview I read a while ago I got the impression that Blackphone wouldn't claim to protect from state-level adversaries, and maybe if you were to ask them to be explicit about it they really don't. One could easily come away with another impression from the description here though. That's a shame, since protection from state level adversaries is really what's at the top of my feature wish list, and that probably goes for a fair amount of other people too, in this day and age. Is anyone here aware of cell-phone-like projects that have potential to resist exploitation of the type we've seen reported from Five Eyes? I'd be particularly curious about ways to mitigate the location tracking.

whyme 13y ago

Sadly, we live in a world where it's quite possible that phones like these are nothing more than a ploy to lure NSA targets in. They need to get people, who have something to hide, to feel safe again.

rimantas 13y ago

That "unique combination" does not assure me but reminds of the curse "may you live in interesting times".

grifpete 13y ago

What about the 'second operating system?' The baseband software? http://www.osnews.com/story/27416/The_second_operating_system_hiding_in_every_mobile_phone http://www.osnews.com/story/27416/The_second_operating_syste...

badman_ting 13y ago

"Select 3rd party apps". Now there's a crazy idea -- what if the maker of the device vetted the apps that run on the device? Crazy idea. It just might work.

rickisen 13y ago

So is this PrivatOS open source, or irrelevant?