Exactly. This phone is about privacy, not removing features that have the potential to be abused. Like say, a microphone...
This is exactly why I have been warning against this phone. All they did was install silent circles app onto a stock android (AOSP) install. There is no better security here then say running a Nexus 5 with stock AOSP. Throw in Redphone or OStel and TextSecure or ChatSecure and you are at the exact same level. No kernel hardening or better encryption though.
I am still torn on the Blackphone, planning an upgrade later this year so will have to compare the relative cost. Some of the Xposed Framework modules (Xprivacy) offer some of the features of blackphone meaning could by a much better phone for the price.
One way of looking at the price issue is that, clearly, the pricing model reflects the expectation of exploiting your data downstream. It's not a free fix that's being offered, but it's heavily subsided IMO.
Very happy to see them growing, enterprise is natural fit given that Government seems to think it has the right to intercept and attack lawful private businesses (Gemalto). Dont forgot about tin foil hat wearing consumers.
If anything, the state of Blackphone shows why just being an excellent cryptography doesn't mean you know security. This phone is yet AGAIN not hardened in any way. All you get is secure comms which you can get on ANY phone. I wish they would at least add in some exploit mitigation but they don't. This is the opposite problem of blackberry. Blackberry has great local security (Good encryption, Good exploit mitigation) but no comm security (unless you include BBM but I don't) where as blackphone has great comm security but crappy local security ( Alright encryption, no exploit mitigation - Outside of what android already has).
Why the new Blackphone is potentially attractive to me is that it removes Google from the equation. It also includes other privacy oriented features such as places. If their app store takes off it will be a bonus. From the specs announced at CES the Blackphone is promising for offering this much. I wish it was fully security hardened but alas I may need to compromise at least in the near term. GuardianROM is something to look forward to and will definitely assess it as an option when it comes out
My issue with Blackphone though is two fold. They claim there phone is "secure" but really it's only date in-transit that is secure and for that mater you can build your own equivalent using any off the shelf phone and flashing CM or OmniRom. Just don't flash Google Apps and instead use F-Droid + Chatsecure & Ostel. If you are more paranoid grab a Nexus 5 and compile AOSP yourself. Done. No Google, Hardly any closed-source binaries, and you can still get secure comms for free. I respect Phil Zimmerman but as I said, just because you understand crypto doesn't mean you understand OPSEC or Exploit Mitigation. Crypto is just one factor of the equation and with the NSA leaks we know that the NSA uses side-channel attacks when-ever-possible. They need to up there game before selling a phone and calling it secure. In it's current state any Android OS vulnerability will directly work against BlackPhone with NO MODIFICATION. Where as if they hardened the kernel, it would require modification to work. Of course it's just another layer, everything can be broken given enough time. That all said. BlackPhone is currently the most secure phone you can buy. Blackberry is close but it does nothing to secure comms unless you have a BES server.
I agree completely with your thoughts. The ability to exploit core Android OS vulnerability is a serious concern and I am certain government agencies have exploits that work. Yes getting a Nexus 5 and AOSP would solve many of the problems but for most people this is something out of their skill set. On the upside, the Blackphone does have a reduced leakage of private information because it does not have all that Google, Samsung, Dropbox, Facebook, etc bloatware that comes from a standard phone. Yes again, compiling AOSP would solve the problem but it is awfully convenient having it in the one package. Still super excited to see what you have cooking with GuardianROM.
I agree about having one package. That is the only reason I recommend BlackPhone. It is the most secure phone ON the market right now. People just need to understand what it is protecting you from (person information leakage) and what it isn't protect you from (targeted attacks using local exploits). Sadly OPSEC is not a product, it's a 24/7 way of thinking. Most people aren't able to do that, because us humans are wired to trust not to doubt. Ha, for a long read sure Best place to start is with any of these: ICS2Cares PDF [ PDF WARNING] My old post on XDA Tor Projects post University Of Texas Checklist [Basic - Should be mostly common sense] I am in the progress of upload all of our source code and guides on how to recreate a hardened install of AOSP. I will post in my thread with more details later.
I find it funny that the Department of Defense is buying secure phones to stop the NSA spying on them.
Well, it's also to keep the Australians, British, Canadians, Chinese, Germans, Israelis, New Zealanders, Russians, etc out And I suspect that there's lots of office politics and intra-agency spying. The chain of command is very ambiguous, according to what I've read.
