Slashdot Mirror
Ars Takes an Early Look At the Privacy-Centric Blackphone
Ars Technica has spent some time with pre-production (but very nearly final) samples of the Blackphone, from Geeksphone and Silent Circle. They give it generally high marks; the hardware is mostly solid but not cutting edge, but the software it comes with distinguishes it from run-of-the-mill Android phones. Though it's based on Android, the PrivOS system in these phone offers fine grained permissions, and other software included with the phone makes it more secure both if someone has physical access to the phone (by encrypting files, among other things) and if communications between this phone and another are being eavesdropped on. A small taste: At first start up, Blackphone’s configuration wizard walks through getting the phone configured and secured. After picking a language and setting a password or PIN to unlock the phone itself, the wizard presents the option of encrypting the phone’s stored data with another password. If you decline to encrypt the phone’s mini-SD storage during setup, you’ll get the opportunity later (and in the release candidate version of the PrivOS we used, the phone continued to remind me about that opportunity each time I logged into it until I did).
PrivOS’ main innovation is its Security Center, an interface that allows the user to explicitly control just what bits of hardware functionality and data each application on the phone has access to. It even provides control over the system-level applications—you can, if you wish for some reason, turn off the Camera app’s access to the camera hardware and turn off the Browser app’s access to networks.
Obviously, if you're concerned about privacy, you should avoid apps which require location, etc., information. However, it would be neat if you could get PrivOS to spoof things like location (and possibly calls, contact lists, etc.).
Location information could still be very useful for apps that need it, if you have a sane spoofing policy (either manual or automatic). If you, say, travel to another city for a week, you could have the OS spoof a single location in that city for the duration of the trip. The privacy implications of, "Bob is in San Francisco" are somewhat different than, "Bob is at 14th and Valencia."
Of course, I didn't RTFA, so I have no idea if something like this is implemented/in the works/impossible...
"PrivOS’ main innovation is its Security Center, an interface that allows the user to explicitly control just what bits of hardware functionality and data each application on the phone has access to"
Those of us with a normal but rooted Android can do these things already with XPrivacy, an XPosed module. Fine grained control per system call, also for system apps (yes, that includes keeping pre-installed Facebook out of my address book and gps data). And I can choose to simply refuse, or tell it the address book is empty and I'm on the south pole.
All fine, but can they (or someone else) release such a device with a keyboard? the point'n'grunt interface just gets so annoying for serious stuff (ssh with a soft keyboard, you're kidding me, where's the other half of my screen?). I mean this phone is not aiming for the 8-year old brat crowd, unlike most of what's on the market today.
Blackphone is MY only way to go.
after all, how can I trust anything on any other device? The manufacturers and Google are very much interested in keeping a major part of their official ecosystems CLOSED SOURCE.
I am putting the keys to my kingdom on them: on-line banking, SSH, VPN, and all sorts of other stuff is accessed by my phone. Just a tiny bit of mystery code could be slurping up all these credentials and key data and storing it on the device... only to transmit it later via covert means (DNS requests or whatever). How do I know this is NOT happening? I don't. I need to have faith in the multitude of vendors and app authors. Vendors that I have no reason to trust.
Two factor authentication? HA! The second factor is ALSO on my phone. Sorry to say, that's ZERO FACTOR if someone already has code running as root on the device.
I have to seriously hope that the phone is more than just encryption and access control. What types of intrusion detection does the phone have? What types of behavioral analysis to determine unknown exploit vectors does the phone have? Does the phone have decentralized communication methods? One idea I have pondered but seriously don't have the time to get engaged in is to try an SVOIP concept using peer to peer wifi connections, a mesh network of sorts. If the communications are decentralized and segregated from infrastructure, then you can bypass many of the eavesdropping techniques. If you have some form of behavioral analysis, then you can start to identify techniques to exploit the phone at the operational level. Encryption goes a long way to help, and software based access control at the OS level (assuming it's secure and not hackable) is also a good start. But maleware is getting far more customized and attacks on the platform are getting much tougher to detect on a pattern based methodology.
Select from tblFriends where interesting >= 4;
If you want to build good security, you need to know what threats you are trying to protect against: NSA spying? Thieves stealing your financial information? European spying? Chinese industrial espionage? Jealous wife? Corrupt prosecutor? MPAA fishing expeditions? Depending on the threat, the security solutions look rather different. Which of these use cases is the phone actually suitable for?
And there are plenty of open questions about the security this phone claims to provide. How do we know we can trust the employees of the companies involved? Which jurisdictions apply to the phone, the software, and the services? Who can push updates? Which parts of the software did they audit and how and who? Did they close off any attacks against the baseband processor or is that still wide open?
I think if you want a secure mobile setup, you're far better off going with something simpler: get a dumb phone, a mobile hotspot, and a Linux laptop; run VPN and VoIP from the laptop. You're going to get better security and a much more transparent system than Blackphone.