11 ms·

>"Baker said encrypting user data had been a bad business model for Blackberry, which has had to dramatically downsize its business and refocus on business cust

>"Baker said encrypting user data had been a bad business model for Blackberry, which has had to dramatically downsize its business and refocus on business customers. “Blackberry pioneered the same business model that Google and Apple are doing now - that has not ended well for Blackberry,” said Baker. Baker is incompetent. Blackberry's primary advantage was its encryption. It branded itself as a business device and supported enterprise use. As bring your own device became mainstream and as the app store markets grew, Blackberry fell behind, failing to deliver the diversity of apps that iOS and Android did. Sales of devices fell and hence they've had to lay off 1000s. TlDr; Baker has it wrong; Encryption was a business advantage for Blackberry, until access to a diversity of apps mattered more.

higherpurpose 12y ago
Not to mention the news that Blackberry started giving Indian and Saudi Arabia governments access to their encrypted data actually hurt Blackberry's image in enterprise. Also some countries are banning US tech companies now not because they encrypt stuff but because they give access to the US government to their citizens' data (including officials). Maybe it's true maybe it's not, but they have the right to question it and protect against it. If companies had end-to-end encryption and even they couldn't look at the data, I have a feeling those officials would trust them a little more. I also find it hilarious that Baker is straight out suggesting "we should be more like China" when it comes to surveillance. How is he not being laughed out of the building?
- atmosx 12y ago
  Hm, maybe Apple can do that, but for Google not looking at the data is not an option, it's the core business. For facebook too. However maybe, just maybe, they can come up with a way to share with governments only a small fraction, protecting their customers/users. I don't see how, but their engineers are smart, they could figure out something that works. It's not just NSA or the US here. These corporations are multinational, operating on many different countries. Once the NSA has officially stepped foot in Google's data so will do the EU, Japan, China, etc.
  - Zigurd 12y ago
    Subscription services are almost always more profitable than ad supported services. If encrypted gmail and hangouts were priced like the storage I buy from Google, I'd be a paying customer.
    - ddispaltro 12y ago
      I personally prefer it as well, but I imagine that statement is hard to back up (although I wish it is true). Did you mean specifically profitable or income related?
- rdl 12y ago
  IIRC Blackberry gave PIN-based/consumer/BIS messaging keys to those governments, and had key escrow for BES deployed in country, but when I took a US-BES Blackberry into UAE, India, KSA, etc., I still had end to end protection.
revelation 12y ago
Blackberry is suddenly the posterchild for encryption? I thought Blackberry is this service where all your mail and communication is routed in cleartext through their services, a workaround from the days of 1G that they simply never got around to get rid of before smartphones flattened their business. That is not encryption, if anything it is the direct opposite.
- wmf 12y ago
  I thought Blackberry is this service where all your mail and communication is routed in cleartext through their services That's how consumer BlackBerry worked (while other consumer services at the time that had no encryption whatsoever) but the enterprise version was as secure as they could make it.
- hendzen 12y ago
  BlackBerry (RIM) is the owner of Certicom, which holds many key patents related to efficiently implementing elliptic curve cryptography.
- Spooky23 12y ago
  In enterprise environments, your traffic is/was strongly encrypted from the device to your BES server.
- maerF0x0 12y ago
  Also, their encryption had the key feature that it could be easily run on low powered devices. It was a big deal to run AES on a phone 10+ years ago, but apparently (I dont have a source) the eliptic curve crypto was more efficient.
rdl 12y ago
Blackberry did always support "decrypt at the BES" which meant essentially corporate key escrow. It did mean the system owner (company) had full control of everything, but it meant governments/carriers/etc. didn't. It's a great security model for businesses. For consumers, allowing "3 of 5 trusted friends" to do key recovery for you, with a 7 day delay, might also be a good model. I actually have no problem with key recovery/key repository type systems (reluctant to say "key escrow" when it's not mandatory) -- as long as the users are explicitly informed and given a choice. For 99% of users, some kind of key recovery usually is the right choice.
deleted 12y ago
[deleted]
deleted 12y ago
[deleted]
Spooky23 12y ago
It is touching that a NSA lawyer cares so deeply about Apple and Google's business model. BlackBerry fucked up their business the old fashioned way -- by screwing up. They were an early player that listened too closely to their early adopter customers. These customers, including the banks and federal government, cared about stuff like keyboards and CAC integration. I've worked in very large IT environments, and users of our networks occasionally commit crimes, including heinous crimes that disgust me. Either way, when counsel tells me that we have a lawful warrant, we have a duty to provide the data. The argument put forth by this clown is complete bunk.
- ddispaltro 12y ago
  This is exactly what I was thinking. It's incredibly frustrating that this guy is spewing complete garbage. Hopefully the public (probably not true) is starting to see through this crap and realize this is a last ditch effort to attack companies trying to do the right thing.
- csandreasen 12y ago
  What Baker is trying to express is that companies like Apple could be shooting themselves in the foot with corporate sales if the data sitting on devices they're manufacturing can't be handed over when counsel tells you that there's a valid warrant. If Apple says the data on the phones is completely secure and not even the cops can get to it, then that means IT can't get to it when directed to, either. Management might not like that so much.
  - Spooky23 12y ago
    If as a company, you aren't managing your devices, (trivial to do at low cost via MDM) there is no difference between encrypted/unencrypted -- you're reliant on the custodian of the phone to do the right thing when turning over the device. Baker wants the US to have the same access to data that Saudi Arabian or Indian law requires, except in those countries there is actual law requiring this. NSA/et al prefers "gentleman's agreements" backed by some broadly defined law that is impossible to contest in open court.
fnordfnordfnord 12y ago
>Blackberry fell behind, failing to deliver the diversity of apps that iOS and Android did. Sales of devices fell and hence they've had to lay off 1000s. BB had a string of embarrassing system outages that also didn't help.

higherpurpose 12y ago

Not to mention the news that Blackberry started giving Indian and Saudi Arabia governments access to their encrypted data actually hurt Blackberry's image in enterprise. Also some countries are banning US tech companies now not because they encrypt stuff but because they give access to the US government to their citizens' data (including officials). Maybe it's true maybe it's not, but they have the right to question it and protect against it. If companies had end-to-end encryption and even they couldn't look at the data, I have a feeling those officials would trust them a little more. I also find it hilarious that Baker is straight out suggesting "we should be more like China" when it comes to surveillance. How is he not being laughed out of the building?

atmosx 12y ago
Hm, maybe Apple can do that, but for Google not looking at the data is not an option, it's the core business. For facebook too. However maybe, just maybe, they can come up with a way to share with governments only a small fraction, protecting their customers/users. I don't see how, but their engineers are smart, they could figure out something that works. It's not just NSA or the US here. These corporations are multinational, operating on many different countries. Once the NSA has officially stepped foot in Google's data so will do the EU, Japan, China, etc.
- Zigurd 12y ago
  Subscription services are almost always more profitable than ad supported services. If encrypted gmail and hangouts were priced like the storage I buy from Google, I'd be a paying customer.
  - ddispaltro 12y ago
    I personally prefer it as well, but I imagine that statement is hard to back up (although I wish it is true). Did you mean specifically profitable or income related?
rdl 12y ago
IIRC Blackberry gave PIN-based/consumer/BIS messaging keys to those governments, and had key escrow for BES deployed in country, but when I took a US-BES Blackberry into UAE, India, KSA, etc., I still had end to end protection.

revelation 12y ago

Blackberry is suddenly the posterchild for encryption? I thought Blackberry is this service where all your mail and communication is routed in cleartext through their services, a workaround from the days of 1G that they simply never got around to get rid of before smartphones flattened their business. That is not encryption, if anything it is the direct opposite.

wmf 12y ago
I thought Blackberry is this service where all your mail and communication is routed in cleartext through their services That's how consumer BlackBerry worked (while other consumer services at the time that had no encryption whatsoever) but the enterprise version was as secure as they could make it.
hendzen 12y ago
BlackBerry (RIM) is the owner of Certicom, which holds many key patents related to efficiently implementing elliptic curve cryptography.
Spooky23 12y ago
In enterprise environments, your traffic is/was strongly encrypted from the device to your BES server.
maerF0x0 12y ago
Also, their encryption had the key feature that it could be easily run on low powered devices. It was a big deal to run AES on a phone 10+ years ago, but apparently (I dont have a source) the eliptic curve crypto was more efficient.

rdl 12y ago

Blackberry did always support "decrypt at the BES" which meant essentially corporate key escrow. It did mean the system owner (company) had full control of everything, but it meant governments/carriers/etc. didn't. It's a great security model for businesses. For consumers, allowing "3 of 5 trusted friends" to do key recovery for you, with a 7 day delay, might also be a good model. I actually have no problem with key recovery/key repository type systems (reluctant to say "key escrow" when it's not mandatory) -- as long as the users are explicitly informed and given a choice. For 99% of users, some kind of key recovery usually is the right choice.

deleted 12y ago

[deleted]

deleted 12y ago

[deleted]

Spooky23 12y ago

It is touching that a NSA lawyer cares so deeply about Apple and Google's business model. BlackBerry fucked up their business the old fashioned way -- by screwing up. They were an early player that listened too closely to their early adopter customers. These customers, including the banks and federal government, cared about stuff like keyboards and CAC integration. I've worked in very large IT environments, and users of our networks occasionally commit crimes, including heinous crimes that disgust me. Either way, when counsel tells me that we have a lawful warrant, we have a duty to provide the data. The argument put forth by this clown is complete bunk.

ddispaltro 12y ago
This is exactly what I was thinking. It's incredibly frustrating that this guy is spewing complete garbage. Hopefully the public (probably not true) is starting to see through this crap and realize this is a last ditch effort to attack companies trying to do the right thing.
csandreasen 12y ago
What Baker is trying to express is that companies like Apple could be shooting themselves in the foot with corporate sales if the data sitting on devices they're manufacturing can't be handed over when counsel tells you that there's a valid warrant. If Apple says the data on the phones is completely secure and not even the cops can get to it, then that means IT can't get to it when directed to, either. Management might not like that so much.
- Spooky23 12y ago
  If as a company, you aren't managing your devices, (trivial to do at low cost via MDM) there is no difference between encrypted/unencrypted -- you're reliant on the custodian of the phone to do the right thing when turning over the device. Baker wants the US to have the same access to data that Saudi Arabian or Indian law requires, except in those countries there is actual law requiring this. NSA/et al prefers "gentleman's agreements" backed by some broadly defined law that is impossible to contest in open court.

fnordfnordfnord 12y ago

>Blackberry fell behind, failing to deliver the diversity of apps that iOS and Android did. Sales of devices fell and hence they've had to lay off 1000s. BB had a string of embarrassing system outages that also didn't help.