Slashdot Mirror

Nobody does a better job with messaging and security.

Except for GSMK (Cryptophone) (and maybe others).

This would almost certainly need work at the driver level. I'd be rather astonished if the decision to switch towers is made outside the driver. Most likely this doesn't even reach the processor(s) running the main kernel and remains on the isolated processor which handles talking to the cell network. This might be something to hope for in the future, but it will take pushing the various companies to add this feature. You might be able to get this feature out of CryptoPhone in a reasonable timeframe.

Then rest assured that governments know how to get into them. Else we'd have seen some kind of harebrained reason why these phones can no longer be bought and used.

I don't quite follow the reasoning going from sentence 1 to conclusion at 2. Germany is not really cowboy land. The very reason it is based in Germany is because of the privacy laws there. It's actually illegal for them to build in a backdoor. Merkel should buy one :)

When the cryptophone was at its first version, the first thing they did was to organise a hackaton for hacker friends to try to find bugs. At that time everyone could just download the software themselves, and it still is available for review: http://www.cryptophone.de/en/b...

Before judging too quickly, maybe check some facts about Germany's laws. Disclaimer: i knew the company back in 2003, and i know its founders personally.

See http://www.androidauthority.com/smartphones-have-a-second-os-317800/

Cellphones have two processors, a main processor (running an open-source OS in the case of Android) and a baseband processor built into the modem chip (running a closed-source OS in all cases). The baseband processor can be used to hack the phone. For a phone to be truly secure, you need a firewall between the main memory and the baseband processor, and AFAIK no phone is designed that way (except this one).

There are encrypted GSM phones with end-to-end encryption when talking to a similar phone. They're overpriced and hard to buy, but available. The source code is available so you can see how it works. It's classic Diffie-Hellman 4096-bit key exchange to establish a session key, followed by 256-bit AES encryption for the data.

It's too bad OpenMoko tanked. That was a totally open source phone down to the hardware level. That plus Cryptophone-compatible code would have been trustworthy.

a cryptophone. Sure, the call will be logged, but it'll be encrypted, care for some speech to text on noise?

Anybody know what the Sectera costs? I looked into Cryptophones ( http://www.cryptophone.de/ ) but the pricing despite all my wanting to support it is just way over the top as a private person.

Would also like to know, if not OpenMoko could be/will be extended application-wise to provide similar voice calls with end-to-end encryption?

How about a RedScrambler?
Or a Cryptophone
Sagem's Vectrotel doesn't seem to be available anymore (if it ever shipped at all).
Nokia's E Series support secure telephony and are the most common choice for Israelis abroad.

I would suggest all Americans now get a Cryptophone and use PGP as standard.

Cryptophone and use PGP and TOR online and be secure.

It looks like a firm in Germany already offers a AES-256 bit encrypted mobile and POTS phone, as well as a softphone. Although their hard phones aren't cheap, the softphone is free to give to your contacts. http://www.cryptophone.de They alse include source code for "full independent review" with their products.

Similarly, Phil Zimmermann, the creator of PGP has released his Zphone to make encrypted VoIP calls. Also, the Asterisk project offers an encrypted IAX channel.

Just use a cryptophone or their free Windows Software.

You are incorrect. You can make the phone connect when it is on hook, at least you could in the Netherlands (and I do not believe our phones are that different from the ones abroad). This was al over the news (xx years ago). It was Rob Gonggrijp that brought it into the media (including live demonstrations), the same guy that now is making all the fuzz about the Dutch voting machines.

And, on another note, he is also involved in the only really secure AND really open source mobile handset, the CryptoPhone.

With Cryptophone and SecureGSM operating with larger keys why would anyone buy this? Both use military grade encryption. Vectrotel do your homework before releasing an inferior product!

Also as mentioned by another user you must release both hardware and software documents to prove there are no hidden features to monitor the secure call.

http://www.cryptophone.de/

there is even a softphone that works with a PC/modem (not winmodems).

> AT&T and others have tried to sell secure telephones
> to the general public, with disappointing results.

First off, they were no real alternative since it was closed-source and .gov-approved. And second, they were ridiculously expensive. Still are. Check http://www.cryptophone.de/ (though this one seems to be better in regards to security at least)

http://www.cryptophone.de/index.html

Not exactly VoIP, but it works over landline or GSM network, and it's actual phone to phone encryption, not just phone to tower. They have several devices/software available, and full source code.

Once again I remind us of

http://tor.eff.org/
http://www.i2p.net/
http://freenet.sourceforge.net/

and also
http://www.cryptophone.de/
GSM can now be decrypted in almost realtime, and the recieving hardware is only a few thousand dollars. Though personally I'd prefer a freeware OSS push to talk GPRS program because not many can make data calls

... or they're using the cryptophone...

If I understand it correctly, that telephone uses a sort of ssh-like connection for normal calls... sounds pretty cool :)

Now it's a matter of time before someone implements a software version of the Cryptophone for these wifi-phones.. I really wonder how LEA's will deal with this. Afterall, wiretapping a phone will be fairly impossible :-)

Or have the CryptoPhone software on their computer with modem.

Too bad this software is only available for Windows.

Check out the cryptophone. http://www.cryptophone.de/ May not meet exactly the criteria the original poster is looking for, but definately a hacker friendly phone nonetheless. Has strong encryption, not the pseudo encryption used on most wireless phones. Works over GSM and both parties must have this type of phone.

Is this what you're after? I remember seeing something else on Slashdot not long ago about a specific type encrypted cell phone- mainly marketed to US law enforcement and government agencies.

Apparently, this relies on a GSM data stream, but it's the right idea.

Mobile VOIP handset. Go anywhere with it. There's a Windows client so you can call to/from desktops. It runs open source encryption software:

Cryptophone.

Guess what? Make VOIP tappable and only the true criminals will have untappable VOIP software.

cryptophone.de

CryptoPhone is the name of a new PocketPC-based phone that provides state-of-the-art encryption technology for everybody (who can pay the price). The phone is based on a combination of two recognized encryption standard named AES-256 and Twofish using just a single dynamically generated key per phone connection.

What makes this phone outstanding is that its source code is going to be published in full for peer review. This a strong difference to other commercial products that do not disclose their encryption underpinnings which makes independent review impossible. The CryptoPhone people have a completely trustworthy approach. Check out their great FAQ to get more information on the details.

Best of all the product comes with a free windows telephony application using the same encryption allowing secure phone calls from PCs to the CryptoPhone. Hope there will be a Mac port soon.

Cryptophone.de

It's actually a division of a privately held German company called GSMK.

I noticed that your CryptoPhone is based on Windows CE / PocketPC. Isn't this a security risk?

The current version of the CryptoPhone runs on top of a heavily modified and stripped down Microsoft PocketPC2002 ROM. The reason is that we wanted an affordable and well researched platform that offered sufficient performance for the speech encoding and crypto functions.A Pocket PC based system was chosen as the first platform for CryptoPhone because it was the only sufficiently fast device allowed us to do software integrity protection in ROM and the stripping of unnecessary functions.

The only commercially available alternative at the time of the necessary development decision was Symbian. Symbian is even more closed source (Windows CE is open source for developers in most parts) and was available only on a more expensive hardware platform. There was (and still is) no viable mass-market Embedded Linux based hardware with sufficient performance, stability, hardware integration and availability on the market at decision time, so we were not able to pursue this alternative.

We are aware that there are risks associated with using any Windows platform and we have taken a number of measures to mitigate these risks as best we could. We removed applications, communication stacks and system parts that are unnecessary for the CryptoPhone operation and which may cause potential security problems. You should not install third party software on the CryptoPhone to prevent software based attacks on the firmware integrity. The firmware update mechanism is cryptographically secured.

can be found at CryptoPhone's Picture Page

looks like one of those phone/PDA's in one.

see this page for further information (in English).