1. kmcobra64's Avatar
    Hey all,

    So I have been reading a bit about how FBI and law enforcement are all upset that Apple and Google now encrypt phones by default. Apparently apple, at that point, can not provide data from the phone to law enforcement even with a warrant.

    My question is twofold. First, could BlackBerry somehow access your phone if given a warrant and provide data to law enforcement? And second, same question, but what if you turn device and media card encryption on?

    I know BBM, texts and emails and all that can be read by others because they go through other people's servers, but I guess I'm trying to see if we already had the level of security that everyone is freaking out about now, or if it is not available to us.

    Thanks!

    Posted via CB10
    09-26-14 07:30 AM
  2. danielsamwel's Avatar
    Any data that you encrypt on your phone / media card is safe as long as you have a suitably strong password. That's also assuming there's no mandated backdoors in BB10, Android and iOS.

    BBMs aren't safe because even though they're encrypted, BlackBerry has the keys and law enforcement can force them to decrypt BBMs. What BlackBerry should do is move BBM to a public key cryptography model where BBM servers exchange public keys between users.

    Posted via CB10
    Last edited by danielsamwel; 09-26-14 at 08:05 AM.
    09-26-14 07:36 AM
  3. kmcobra64's Avatar
    Any data that you encrypt on your phone / media card is safe as long as you have a suitably strong password.

    BBMs aren't safe because even though they're encrypted, BlackBerry has the keys and law enforcement can force them to decrypt BBMs. What BlackBerry should do is move BBM to a public key cryptography model where BBM servers exchange public keys between users.

    Posted via CB10
    Yeah I agree, though isn't that what BBM Protected is? They may lose revenue if they make that widely available.

    Also, is Apple saying that now iMessage is encrypted as you say? If so, bbry needs to catch up.


    Posted via CB10
    09-26-14 07:44 AM
  4. danielsamwel's Avatar
    Yeah I agree, though isn't that what BBM Protected is? They may lose revenue if they make that widely available.

    Also, is Apple saying that now iMessage is encrypted as you say? If so, bbry needs to catch up.


    Posted via CB10
    As far as I know iMessage encryption uses Apple's keys, so they can decrypt messages at any time.

    BBM Protected is a bit more clunky because they're using just a shared private key between 2 users. The issue becomes how do you share that key? If you do it via the Internet someone could intercept it and decrypt your communications. Really the only secure way to use BBM Protected is to physically exchange the key in person and that's inconvenient.

    Public key cryptography gets around this by assigning 2 keys to each user, a public one and a private one. Public keys are used to encrypt messages for a particular user that can then only be decrypted by the corresponding private key. Not even the public key used to encrypt can decrypt the message. So the idea is that you should be able to publish your public key to the BBM servers, so other BBM users can conveniently encrypt messages for you, but only your private key, which resides securely on your phone somewhere (and not on BlackBerry's servers) will be able to decrypt it.

    Posted via CB10
    09-26-14 08:01 AM
  5. dpeters11's Avatar
    Right, iMessage uses Public Key Encryption, but since you have no control over the public key, that's a flaw.

    But I understand why they do that. Using truly secure public key encryption end to end, like PGP, is non-trivial.
    09-26-14 08:06 AM
  6. Richard Buckley's Avatar
    As far as I know iMessage encryption uses Apple's keys, so they can decrypt messages at any time.

    BBM Protected is a bit more clunky because they're using just a shared private key between 2 users. The issue becomes how do you share that key? If you do it via the Internet someone could intercept it and decrypt your communications. Really the only secure way to use BBM Protected is to physically exchange the key in person and that's inconvenient.

    Public key cryptography gets around this by assigning 2 keys to each user, a public one and a private one. Public keys are used to encrypt messages for a particular user that can then only be decrypted by the corresponding private key. Not even the public key used to encrypt can decrypt the message. So the idea is that you should be able to publish your public key to the BBM servers, so other BBM users can conveniently encrypt messages for you, but only your private key, which resides securely on your phone somewhere (and not on BlackBerry's servers) will be able to decrypt it.

    Posted via CB10
    Diffie–Hellman key exchange.
    09-26-14 09:39 AM
  7. BanffMoose's Avatar
    As far as I know iMessage encryption uses Apple's keys, so they can decrypt messages at any time.

    BBM Protected is a bit more clunky because they're using just a shared private key between 2 users. The issue becomes how do you share that key? If you do it via the Internet someone could intercept it and decrypt your communications. Really the only secure way to use BBM Protected is to physically exchange the key in person and that's inconvenient.

    Public key cryptography gets around this by assigning 2 keys to each user, a public one and a private one. Public keys are used to encrypt messages for a particular user that can then only be decrypted by the corresponding private key. Not even the public key used to encrypt can decrypt the message. So the idea is that you should be able to publish your public key to the BBM servers, so other BBM users can conveniently encrypt messages for you, but only your private key, which resides securely on your phone somewhere (and not on BlackBerry's servers) will be able to decrypt it.

    Posted via CB10
    Search the Inside BlackBerry website. BlackBerry had an article describing how BBM Protected actually works. First it requires that all participants be on a BES (can be with different companies) with the BBM Protected option on. I don't recall what that option's default value is. Maybe "OFF" since BBM Protected is an additional fee annual service. Second when you first initiate a BBM with another person who can do BBM Protected messaging the initiator is prompted for a 10 digit key. That key is system generated, but can be overridden by the initiator. The jnitiator then needs to somehow tell the other party(ies) the key (in person, by phone, email, etc.) before they can start the chat. Once provided though the key stays in force until the chat is ended. BBM Protected also works with BBM Groups and multi person chats. But again, all participants need to have BBM Protected. If one doesn't then the protected status ends.

    So, aside from the initial key exchange, it really isn't that cumbersome.
    09-26-14 02:23 PM

Similar Threads

  1. List of Apps missing from Blackberry World for Passport
    By mndb369 in forum BlackBerry Passport
    Replies: 2
    Last Post: 10-14-14, 09:05 PM
  2. BlackBerry Passport 4:3 Brother
    By habicht in forum BlackBerry Concepts & Dream Devices
    Replies: 21
    Last Post: 10-03-14, 08:30 PM
  3. Replies: 16
    Last Post: 09-27-14, 09:13 AM
  4. Over 200,000 BlackBerry Passports sold through Amazon and Shop BlackBerry
    By CrackBerry News in forum CrackBerry.com News Discussion
    Replies: 1
    Last Post: 09-26-14, 08:08 AM
  5. BlackBerry Q2 Fiscal 2015 Earnings Call live blog
    By CrackBerry News in forum CrackBerry.com News Discussion
    Replies: 0
    Last Post: 09-26-14, 06:51 AM
LINK TO POST COPIED TO CLIPBOARD