Hacker Read top | best | new | newcomments | leaders | about | bookmarklet login

I found some notes from when I was looking into the Priv at the end of last year. They lack detail, but maybe are a good starting point for someone.

* Root of trust: unique crypto keys at the hardware level: Somehow implemented in way that guarantees Blackberry through supply chain, they claim. Maybe Blackerry supplies own chipset, w/ key included?

* Verified Boot and Secure Bootchain: Verifies integrity of all layers, from hardware to software. Uses hashes, crypto signatures

* hardened Linux kernel with numerous patches and configuration changes to improve security

* FIPS 140-2 compliant full disk encryption for data and applications

* Monthly updates through the Google Play store (only?)

* DTEK: "a single dashboard to monitor and control application access to your microphone, camera, location and personal information."

* Can customize each app's privacy settings, like in Android 6

Also of potential interest, from a competitor:

* http://www.tomshardware.com/news/copperhead-nexus-more-secur...

----

Sources:

* http://blogs.blackberry.com/2015/10/priv-is-for-private-how-...

* http://www.zdnet.com/article/the-many-ways-blackberry-beefs-...



sort by: page size:

Can anyone comment on the Blackberry Priv? The article mentioned it, and I know their security goes down to hardware level and what they claim is a secure manufacturing process, but all I know is what they claim ...

I'm curious whether Blackberry's Priv locks down the OS in addition to the hardware.

So am I, but when I read their site about it around the time it launched, there were so many loopholes and weasel words in the information about security features that I ran away.

FWIW, the most obvious warning sign was that they were very hot on telling you about potentially insecure things being done on your device, but I couldn't find a single definitive statement that their software actually let you do anything to prevent those things from happening, nor any reference to tools or controls that seemed like they might do so, on their entire site. It also appeared to be based on an older version of Android that didn't have some of the more recent advances in per-app per-function privilege controls, suggesting that they might actually be worse in this respect than recent devices from other providers would be just with the latest off-the-shelf Android release.


Blackberry Priv

Blackberry deserves props for experimentation and their surprising good OS 10, but if Priv is shorthand for privacy, then that's veering close to dishonesty.

Darn happy with my Passport though.


I personally wouldn't trust a company that openly bragged it built a system to provide local police and Intel agencies with real time access to Blackberry messaging flowing across an entire city in 2010 for G20. In addition to sharing their "master" encryption key for a number of years:

https://www.theverge.com/2016/4/14/11434926/blackberry-encry...

Also AFAIK Blackberry only provided a hardened kernel with a single device in 2015 called Priv. I haven't heard anything from them since... maybe someone could correct me here.


You described the BlackBerry Priv.

Blackberry Priv will have a Grsecurity hardened kernel. Why doesn't Silent OS have that yet?

Blackberry Priv. Released 2015. Very happy with it.

Not sure if it's BB10 you love or if it's BlackBerry's security model and hardware design, but if it's the latter, I highly recommend the Android models that BB sells. I personally have a Priv and I love it. The DTEK50 and DTEK60 are newer and are supposedly even better according to a few people I know that have the DTEK models.

If it's BB10...can't help you there. But you still might want to consider the Android models anyway since, as I mentioned, you get the BB security model which includes (but it not limited to) hardware keystore, secure boot, customized kernel, and FDE enabled by default. It also supports office365, BES12, as well as all native Android apps (naturally). And it comes with BB's DTEK software to make evaluating your devices security much simpler and makes granular permissions very straightforward and includes logging and notifications for those permissions as well, if desired. The DTEK software also has continuous integrity monitoring for OS files to spot anything that might be compromised.

Battery life is also amazing on the Priv and DTEK models. And BB has been pushing monthly security updates out like clockwork.


The Blackberry Priv, I think.

...if Priv is shorthand for privacy, then that's veering close to dishonesty.

I remember one experience very clearly from when the Priv first entered the market. I looked through the related web pages, curious about where Blackberry was going. I found plenty of marketing around tools that would notify you if various things went wrong in terms of privacy and security. However, I found literally nothing to state that the phone would actively prevent those things from going wrong or check with the user before performing actions they apparently considered significant enough to warn about. It was one of the most marketing-heavy, content-light, non-committal product sites I've seen in a long time.

Until today I don't think I've been there again. After reading the initial marketing, I just assumed the phone wasn't actually going to be significantly more secure or private than anyone else's or they'd have told us how it was instead of skirting around it repeatedly for the entire site. In fact, if memory serves, it was at the time based on a version of Android that predates some significant improvements in terms of app permissions and locking down what they can do, suggesting that contemporary models from competitors that used a later version of Android would actually have been much better than the Priv in at least some areas of security and privacy.


The general consumer really needs to start caring about this kind of stuff and start demanding more secure devices. They should refuse to upgrade their phones to the next model until devices are reasonably secure. Problem is that the average person cares far too much about convenience and having that sleek, next-gen gadget. Which is why this problem persists.

Personally, I purchased a BlackBerry Priv (which runs Android) and couldn't be happier. Phone is/was very cheap compared with the other flagship devices and it runs really fast. Came factory unlocked direct from BlackBerry and has zero bloatware on it. I get frequent O/S updates for security patches as well, which is far more than I can say about my previous phone (Galaxy S3 from AT&T).

Despite most people's apathy, or even hatred, of BlackBerry, they have always done security very well. The Priv is no exception - secure boot, hardware keystore, modified Linux kernel, FDE enabled by default, work/personal account separation, external SD card protection, their DTEK software, etc. Some of their security features are included as part of the base Android OS, yes, but their security model as a whole from start to finish is far ahead of all competitors.


Blackberry's own Priv from late last year is the only modern choice. Reviews generally indicate that it was good, but not great. Had minor issues with heating up and having a clicky back I think. Was mostly stock Android aside from a few small tweaks.

It's not just a "Blackberry". It's custom hardware with custom security.

They also have an upcoming Android QWERTY "Priv", http://www.cnet.com/products/blackberry-priv/

If your talking about the Priv, then :

Updates: It still gets consistent security updates, as recently as last month.

Build Quality: They already outsourced this a while ago, while maintaining high build quality. (The Priv was designed, but not assembled, by BlackBerry. This KeyOne is also designed, but not manufactured, by BlackBerry). Chinese manufacturing isn't inherently bad -- MacBooks and iPhones get made in China too.

I understand and agree with your concern about the BIS private key, but in terms of execution, BlackBerry really has done as good job with these recent phones.


I had a Priv and my roomate has a Key1. I enjoyed my Priv. BlackBerry has some cool software features, and using the keyboard as a trackpad was nice. The phone had issues overheating (with things like mapping with the screen on) and eventually bricked it’s self.

My roomates key1 also has those cool features, but the screen format didn’t play well with some apps, and the phone was running low/mid tier specs for a premium. He eventually sold it, as the slowdown really hurt the phone.

BlackBerry promised me 2 years of monthly updates, and didn’t really follow through on that. They did good at the beginning, but faltered near the end.

At this point both of us moved to iPhones. I honestly don’t expect anyone but Apple to support a phone 5 years.


I'm not sure if you can get a secure solution at that rate. The more secure systems simultaneously have high development cost and almost no buyers. This means they're usually OEM licenses for custom work instead of mass market. So, trick would be a smart group of people licensing OKL4 or something then putting it and hardened Android on a specific phone.

Far as Blackberry, no Im not saying it's more secure. I'm saying using the QNX OS made it more secure, reliable, and responsive than it was. That's because of QNX's great design.


I've been a lifetime BlackBerry user (from waterloo) and just got the priv. it's a really great device but having the passport on android would be a gamechanger imo
next

Legal | privacy