Hacker News Reader

Hacker News

Comment by zmanian | Hacker News Reader

Parent Full thread

zmanian

The primary value of the Blackphone is that is comes with several hundred dollars of security services.

1. SilentCircle's encrypted messaging and VOIP solution + licenses for close collaborators.

2. Disconnect.Me's VPN

3. Spideroaks encrypted cloud storage

4. Kashmir's wifi finger printing services.

Everything is licensed for 2 years.

The primary market Silent Circle is going after at the moment is journalists, NGO workers, private military contractors etc who need smart phones at an organizational level but want enhanced resistance to surveillance.

View on HN

1. Eh, OK, you're probably better off using zRTP directly with your contacts. Silent Circle doesn't seem to actually say how your calls are any more secure. In a recent thread, they say they hand them off to a VoIP carrier and consider that "encrypted to the PSTN". IIRC part of Silent Circle's play is that they think the government cannot compel them to do "bad" things, so they're telling us to trust them on that basis.

2. One of a ton of services that cost like $3-4 or so a month and will probably fall. And sure, it prevents the local WiFi from running sslstrip at the cost of putting all your traffic at an easy-to-monitor place (the VPN provider).

3. A closed source program running access to all your data doesn't sound particularly impressive. But sure, it's better than using Dropbox.

4. Kismet Wifi manager is $2.99 on Google Play.

It might be better than nothing, but the product sounds seriously over-hyped, and some of their claims seem like outright lies or at best misleading/useless.

I also don't get, if such a combo of services was so valuable, why someone just doesn't sell it separately.

Silent Circle does use ZRTP (the 'Z' in ZRTP is 'Zimmermann', who is one of Silent Circle's cofounders).

You don't need to trust anyone. There are (admittedly slightly out dated) buildable sources for the Android clients on GitHub. The whole point of ZRTP is that the server can be considered untrusted.

Except Silent Circle is actively promoting "encrypted to the PSTN" without specifying exactly what that means. Handoff to iBasis is hardly "encrypted to the PSTN" for any worthwhile value of PSTN.

The ZRTP part is fine if you can bring your own client. And I guess $12 a month isn't much to pay for SC to run FreeSWITCH as a NAT traversal/endpoint discovery platform.

There's still no real details on how we're supposed to trust Silent Circle from being actively attacked and backdooring clients. If memory serves me correctly Mr. Zimmerman said they're relying on the government not being able to compel them to cooperate. AKA, Lavabit-style. (Sure, ZRTP is solid, but a compromised client isn't detectable to end-users, plus SC talks a lot about calling the PSTN.)

For a comparison to a company that takes security seriously, look at tarsnap. Then go read the PR from Mike Janke the other day.

On another note, what does "100% dedicated network – no sharing or leasing" even mean? Did SC run fibre from Toronto to Switzerland? How is SC's network any different from any other VoIP company that builds a datacenter?

The Silent Circle phone app is end to end encryption, it's their other service that offers "Out-Circle Calling" which is encrypted to the PSTN. I don't understand the dedicated network PR either

Reply on news.ycombinator.com