BlackPhone, BP1, PrivatOS, Do you own one? Do you use it? How do you use it?

[TheCotMan]

Cot, they were taking pre orders for the BP2 at DEF CON, $700 I believe? It looks like a traditional black sleek rectangle. A friend who has a BP-1 said he was passing on the 2 because for the extra money there really wasn't enough more memory to meet expectation of "modern" smart phones in that price range.

I like their frequent update schedule! Now if there was any new software in their app store that would be great. Tor? Authenticator? Wonder why it is so hard to get useful security apps listed.

They had an unofficial demo of the new BP2 at DEF CON at their booth. One of their people had one. It is slightly larger than the BP1, has a sealed battery, and I don't recall if there was support for any MicroSD or not -- I have a vague memory that there is no MicroSD, but don't rely on that as anything close to certain. The new BP2 is not running "PrivatOS" but instead "SilentOS" (Part of this is from the buying out of the rest of the business from the other half of the company by Silent* , so a need to rebrand, but there appears to be more to it...)

Google is rolling out an "Enterprise Security" suite for Android which allows for central management of phones, and makes it easier to have "BlackBerry" like phones with central management to dictate policies on corporate/agency phones, and support remote wipe and update by the company/agency. They claim more features for security and privacy as being available to vendors that adopt the new android features.

I like the CyanogenMod-like application security limits, allowing the OS to have a default collection of security restriction for all apps in a space, and more granular settings per app.

A problem I've seen with the spaces, though? THere appears to be some bleed-through on networking. Setting up an OpenVPN in one space in "non-captive" mode seems to include other spaces, but running in captive-mode seemed to limit network settings for that space to just that space. (I need to re-test that since getting all these updates.)

At around the same time, Turing Phone and BlackPhone 2 had news articles claiming to be taking advantage of these new features from Google in Android for enterprise.

Next, the new BlackPhone is supposed to support running "Google Apps Store" in a new BP2 "Space" -- With BP1, the only spaces officially supported are an opensource "store" and amazon "store" and one more which I don't remember. However, the amazon store still feels like shopping in the ass-end of the Internet. The amazon store has a large number of apps that demand even more privacy sacrifices than similar apps in the google app store.

Just how well the Google App store will be supported is another question. Will "Google Push Notification" (and services/apps needed to make that work) be supported? Will I be able to limit them to which kinds of data I want transmitted, or will including these create a secret channel to leak data about me?

It would be nice to have a security-centric phone that supports both the Silent suite of tools and things like RedPhone/TextSecure (soon to be Signal) to offer options with encrypted communication. Not being able to support things like RedPhone/TextSecure has made my original BP1 a good concept, and fun to play with, but not comprehensive enough to replace my primary phone.

The other question? Will BP1 be able to "upgrade" to SilentOS and get access to the same new features in BP2 with support for Google App store?

I also asked about the "New Tablet" there were new stories about Silent* planning to release later this year, but they have no concrete information on that.

I'm planning to get a BP2, and I am considering getting a Turing Phone, too, to compare, but it is a lot of money to spend just to try our a Turing Phone too. (This is why I am looking forward to reading reviews on the new Turing Phone. Will they be as aggressive with OS/Firmware updates as the BP1 has had?)

[TheCotMan]

Still no BlackPhone 2 available for purchase. One item I found again with searching:

URL1 = http://support.whispersystems.org/cu...314-blackphone
Question asked about "Red Phone" being made available in Amazon App store answered as:

Masha Kolenkina Aug 20, 2014 05:29AM UTC Open WhisperSystems Agent
Not at this time. RedPhone and TextSecure both currently use Google’s GCM framework for push notifications and signalling.
RedPhone and TextSecure will work on the Blackphone, but only if Google Play is installed.

The unofficial demo at their DEF CON vendor booth showed "Google Play" app installed in one of the spaces. (Assuming they continue with the past work, the primary "Silent Space" would want to run with only a pure "Silent Store" and collection of apps from Silent* while other spaces (like Amazon Apps Store) can load other stores and more risky apps. If this is the case, and Google Play can run there (and as shown in their online images for BlackPhones 2)

URL2 = https://www.silentcircle.com/blog/pr...e-first-world/
Discussion about "SilentOS 2.0"

Blackphone 2 (which features the latest Silent OS, 2.0) will be our first device to feature Google Play and the Google apps and services

One device, with regular security updates, and support for the Silent* suite of apps, plus other stuff like RedPhone, textSecure / Signal, and other tools may make it useful, allowing people that use either of these to communicate with me.

Still have to wait until December for a competitor called "Turing Phone" to see what they are going to delver.

[Dark Tangent]

Hey Cot, could you post for me what you would like to see improved with the BP? Features, added, etc?

For me:
- Browser by default that let's you type in a url
- Feature request to allow you in network settings to select "4g / LTE" only, or "3G / 4G" only to help with downgrade attacks.
- Feature request to allow you to select "no roaming to another carrier besides the one you select" to prevent you from roaming to another provider.

[TheCotMan]

Hey Cot, could you post for me what you would like to see improved with the BP? Features, added, etc?

For me:
- Browser by default that let's you type in a url
- Feature request to allow you in network settings to select "4g / LTE" only, or "3G / 4G" only to help with downgrade attacks.
- Feature request to allow you to select "no roaming to another carrier besides the one you select" to prevent you from roaming to another provider.

Features I would like in BP2 which are MOSTLY NOT going to be preset:
* Dual SIM support
* Widest possible global frequency support for voice and data for 3G and 4G, user-selectable for country/region so as to not use more power than needed unless travelling to those regions, and then refinement of which frequencies to support when in whichever region specified.) If this is supposed to be a business phone, make it for global business.
* User-visible DB of network nodes used in the past, and GPS location, with support to participate with other in a global DB of GPS location and address --- an extra check to see when an access point or cell tower by address appears in a place it was not expected and notice when a new tower appears in a place frequented often. Have this available as a file that can be downloaded from the device and read. Kind of like war driving but for carrier towers.
* Support for full disk encryption on external SD using common methods in linux for device encryption, so SD can be mounted on full desktop/laptop and read. (I talked with the people at the booth, and they said SD encryption is coming, but won't be in the first BP2 release and did not specify how it would work.)
* 2 USB ports: one in host-mode and the other not, to allow for charging and connecting to external devices at the same time without special cables
* Hardware and OS support to disable all data-channels on USB and call it "safe charge" -- like USB condom but built into phone. If supported by hardware and OS, then exploit by USB/Evil-Maid/JuiceJacking becomes more difficult.
* A non-sealed battery (BP1 has a non-sealed battery, to allow for customer upgrade from a place like Mugen if they ever made a larger battery, while BP2 has a sealed battery)
* Google Play support but not in the primary "space." (they claim this will be supported)
* Support from primary space to "halt" other spaces and all apps/processes but keep state, so as to later resume each space as desired at a future date/time
* Support for RedPhone/TextSecure (Signal) in the GooglePlay space (I don't know if this will work in BP2)
* QuickCharge 3.0 (This will ship with QuickCharge 2.0: the QuicklCharge thing allows for variations in amps and volts to charge batteries, but requires communication with device on what voltage/amperage to send, and claims this charging is faster than conventional 2.0 or even 2.4 amp with standard USB voltage, without harming battery leading to a bulging battery.)
* Support for 2 kinds of user-selectable "screen off" : double-press power quickly to 'force screen off, override any apps with "force screen on" as a power-save mode, but still allows for incoming text/phone calls' and does not lock the screen, and then the conventional single-tap power button which locks the screen and does the same as above.
* Built-in app that can perfom tcp-dump like files for all wirelress interfaces to sniff data from all radios, and dump to SD card, for analysis in wireshare or other tools. (Running tools from a shell on a phone is difficult without a full keyboard and mouse, and support for wireless carrier sniffing/dump has been a problem in the past. I've used tcpdump on android before using the phone and the on-screen keyboard iand it worked well for many interfaces, but not all.)
* Robust proxy support to allow for granular controls, or even multiple proxies for difference protocols or file-types. Example: multiple external malware scanners for live content based on filetype.
* Auditing: Support for an "lsof" like listing that tracks the files that each app usually opens, and provides a report on how many times each file has been opened by each app, and then after a training period, reports anomalies to past behavior, and support for immediate notification is any app (other than those selected) attempts access to critical files specified by the user. Having OS track and store auditing information like this, could allow other apps to consume these and provide reports, but security would require the OS provide this, not a user-space app. For example, it could "log" these to a "proc file" of a "device special file" and an app could connect to these to get live feeds. This kind of feature could really slow things down, so make it possible to enable/disable support for this by the user.

How is that for a starter?

What do you think about those?

Does anyone else have things they would like to see in the BlackPhone2 or nearly any other securtiy-centered phone?

[Dark Tangent]

I think that is a pretty thorough list. I was focusing more on UI related isses, but I like where you went with the expert command line asks.

I had forgotten to add:
- An easy way to list and manage, back up or remove the system trusted SSL or CA certificates that you may not necessarily trust.

[Dark Tangent]

I'm going to test their voice out minutes today, I'll let you know how it goes.

[TheCotMan]

I'm going to test their voice out minutes today, I'll let you know how it goes.

Using SilentPhone or their VPN and a VoIP call?

[Dark Tangent]

SilentPhone

Also the BP-2 starts shipping this Monday

[TheCotMan]

In addition to the Turing Phone ( http://www.theverge.com/2015/7/18/89...nds-on-preview ) there is a slashdot post about an article claiming BlackBerry will be entering the Android Market with their take on a security and privacy focused Android phone: http://slashdot.org/story/15/09/25/1...oid-smartphone and the story it links to: URL3 = http://www.securityweek.com/blackber...-reboot-effort

Last year there was little competition for security/privacy in smartphones outside of BlackPhone. One article claims TuringPhone ship starting in December of this year.

The Canadian firm said it would begin selling "Priv," described as "a flagship handheld device that will run on the Android operating system with BlackBerry security," expected to be available later this year.

If Turing Phone and Priv are true to their release dates, before the end of the year, there will be 3 Android-based phone vendors claiming security and/or privacy in their smartphone. Do you think Blackberry will be able to make a go of it? Will this help restore any market-share of the smartphone market? It has been a long time since I heard someone refer to a BlackBerry phone as a "CrackBerry" to describe the addictive nature of their once famous phones in business.

Sun Tsu has an entire chapter on "Grounds of Contention" which includes many parts used as metaphors for new markets. The most widely references for new markets is the advantage of being in a market first. Being first does not guarantee being able to hold the ground/market. Nokia lost out to BlackBerry, which started to lose to iPhone, and looking at just market percent, lost to Android.

At a talk by Tim O'Reilly of O'Reilly & Associates, he was asked about Linux taking over the Windows market in the late 90's or early 2000. He said that he would expect a product to be about 10 times better than the thing it would displace before it could be displaced. Similar claims have been made about grounds of contention.

Security/Privacy is not something people can "see" in a product. If all products claim security/privacy, then how will users differentiate "better" when they vote with their dollars to buy one?

I asked SilentCircle their thoughts on competition from Turning and BlackBerry. ( https://twitter.com/TCMBC/status/647510016560263168 ) I do not expect a response beyond something like, "We believe our product s better then theirs because our [ideals || focus || ambition || understanding || faith-based-concept] is better than theirs." This has a long history of working very well in many markets. Put forward confidence in something, and touch on something semi-religious (faith) and build a cult. (I'm looking at you Apple, with Steve Jobs.) Will the same approach work with security professionals? Will it not matter because security professionals will be a minority of their expected consumer?

[TheCotMan]

So, I got a BlackPhone 2. It really does have the *option* for Google Play, and you get google stuff if you enable google support when setting up your phone, and then login to a google account. Space support is also present. RedPhone and TextSecure both work. (I assume that the Silent* Suite of apps also works, but I will test that later.)

It looks like you can choose to skip google support in the primary space, and then enableit in analternate space.

I've not yet tested some of the other VPN Software I've used, but I was able to get it to work on BlackPhone 1, so it should work now.

I asked SilentCircle if BlaclPhone 1 will be upgraded from PrivatOS to SilentOS to get this support, but have no reply yet.

[TheCotMan]

I've been comparing/contrasting BlackPhone 1 with BlackPhone 2:

The radio problem I was seeing in BlackPhone 1 is not happening (yet) in BlackPhone 2, and even though both use the same carrier, BlackPhone 1 shows zero bars in many places that BlackPhone 2 shows 2 or more bars. This could be clever coding like what we saw from Apple with their iPhone antenna problem, but I would more likely guess that this is because of the frequencies/bands supported in the new phone and new hardware/design. This is a plus. I'm able to use it as a phone.

The problem in BlackPhone 1, where if I have no carrier signal for too long, and then I return to a place with strong signal from carrier I've been several times in the past, BlackPhone 1 still reports zero bars. Even if I leave the phone plugged in to power, screen on, for 2 or 3 days, the icon for radio signal still reports zero bars. It is not until I enable "Airplane Mode" then after a few seconds disable "Airplane mode" that it finds the carrier again, and shows 4 or 5 bars.

On BlackPhone 2? It takes more effort to find spaces with zero bars, but even after keepign both BP1 and BP2 at zero bars for "too long" BP2 find my service provider quickly, while BP1 remains "stuck" for hours (or days) until I cycle Airplane Mode, or power cycle it.

BlackPhone 2 is much more closely tied with google, and this is something that "Execs" will like if they are asked to use it.

If you get a BP2, you should try to make sure you have unmetered WiFi access, as a bunch of Google apps immediately begin downloading updates.

The Silent* suite of apps available fromthe SilentStore also have updates, but there seems to be a problem with trying to update those in parallel, so upgrade those one at a time.

With BP1, on WiFi, running network and screen intensive apps, power drain over conventional USB power (5Volts, 500 mA) is enough to not lose battery/charge.
With BP2, on WiFi, running network and screen intensive apps, power drain is greater than conventional USB provides, so the battery begins to drain. This is not hte case when using the special "QuickCharge" AC adapter; phone can charge battery and allow for running screen and network intensive apps.

BP1 PrivatOS 1.1.x supported "Spaces" but we were limited to 3, and there were no google apps. SideLoading of the Amazon App store and 2 others were supported, but required users to side-load APK. These were documented on their site and discussed earlier in this thread. Google's App Store "Google Play" was not officially supported.

BP2 SilentOS 2.0 supports "Spaces" but has revised them by purpose. Your primary Space, the one you start with is "Owner" Then you can add:
* Silent Space
* Personal Space
* Managed Space

I'm guessing "Silent Space" is for the pure Silent* experience separate from google. When created, there are no google apps in that space.
I'm guessing "Personal Space" is like the conventional "Space" we saw in BP1 to allow for side-loading of Amazon or other APK
I'm guessing "Managed Space" is for organizations that want their employees to run their "super secret" apps, data, access, and credentials in a "Managed Space" that the organization can manage. I am also guessing this is done through another Silent* product: https://www.silentcircle.com/product...ions/services/ "Silent Manager"

BP1: Based on Android 4.4.2
BP2: Based on Android 5.1.1

In BP2, the BlackPhone app "Security Center" has a profile option "Privacy level" which allow for 3 settings for app installs wanting access: Deny, Allow, Ask. I switched to "Ask"

RedPhone, textSecure, OpenVPN, Google Authenticator all work on BP2. All except "OpenVPN" did not work in any supported method on BP1.

Enabling "Developer Options" works on both BP1 and BP2 -- same method.

So far, from a non-technically inclined user view, such as a CEO, or people that are not security professionals, BlackPhone 2 is like most any other modern Android phone, but with more granular controls, and support for "managed space" which may help corps when devices are "lost" or stolen.

Though BP1 had much better isolation away from google and their data-mining ways, I did not see it being adopted by many people outside of security circles.

BP2 has a chance at being used by "the masses" (if they can afford it.)

I suspect that the to-be-released "Turing Phone" and "BlackBerry Priv" will use the same google-supported kind of "fork" for "enterprise" and corporate use.

Back to original topic on BlackPhone 1, there was an update to PrivatOS to PrivatOS 1.1.12:
URL1 = https://support.blackphone.ch/custom...-release-notes

PrivatOS 1.1.12 release notes
Last Updated: Oct 02, 2015 07:23PM UTC
This release addresses new vulnerabilities in libutils and the Stagefright media library reported by Joshua Drake and Zimperium, covered by CVE-2015-6602. This release also addresses additional security vulnerabilities in other components.

BlackPhone PrivatOS had several other patches for StageFright before this one.

I really do like their aggressive patch for security issues. I hope this continues with BlackPhone2

Thanks for reading. Hope this helps someone. :-)

[TheCotMan]

There is an Update for BlackPhone 2, which was a bit tricky to get installed.

Details on the reason for upgrade are here: URL1=https://support.silentcircle.com/cus...ticles/2149289

Release notes - Silent OS 2.0a
Last Updated: Oct 09, 2015 10:18AM UTC
Overview:
This is a minor system update focused on patching specific and critical security issues.

Changes in this Version:

Security Fixes:

This release addresses new vulnerabilities in libutils and the Stagefright media library reported by Joshua Drake and Zimperium, covered by CVE-2015-6602.

While using WiFi, I did not get any notice of an upgrade. It was not until I was using my carrier's data plan that I was notified of the update. To get the upgrade to happen, I was told to reboot the phone, and then would be prompted to update the OTA Updater App. After updating that, nothing changed. A few more reboots, and still nothing. It was not until I turned off WiFi again that I was able to proceed. Once that dialogue appeared for download, I switched back to WiFi, re-enabled my VPN, and the download/upgrade proceeded.

This upgrade claimed to be about 800MB, and I did not want to hit my carrier's data plan with nearly 1 GB of data, when WiFi and VPN should work.

Procedure:
* Switched off VPN, and WiFi
* Rebooted phone
* Was informed of OTA Updater App Update, re-enabled WiFi and VPN, and downloaded/installed
* Nothing happened, revisited "Settings" -> "About Phone" -> "Updates" but still saw the same notice about reboot and new OTA Updater App update. The "Download" link did nothing.
* A few more reboots, then disabled VPN and WiFi, and a few seconds later, the screen under "Settings" -> "About Phone" - > "Updates" changed, and asked if I agree or cancel (download.)
* Switched back to WiFi and re-enabled VPN, and then selected Agree and download happened. (Approached 10 Megabytes/second, took about 8 minutes?)
* After download completed, there was a delay. Revisiting "Settings" -> "About Phone" -> "Updates" had a new screen with notice that it was preparing what it downloaded.
* Eventually that changed to offer "Install" as a link in the same place "Download" was displayed before.
* Tapping Install notified me of a reboot and install of OS upgrade.
* Reboot took a while longer before getting notifications (still booting) "Optimizing App X of 179" where X counter increased with time. Some indexed values took more than a minute. Finishing them all took about ~10 minutes
* After it finished, revisiting "Settings" -> "About Phone" -> "Updates" showed my phone was up-today date, and the "Check Now" actually did what it was supposed to, using WiFi, being on the VPN or not.

URL2=https://web.nvd.nist.gov/view/vuln/d...=CVE-2015-6602

libutils in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file, as demonstrated by an attack against use of libutils by libstagefright in Android 5.x.

[TheCotMan]

BlackPhone 2 had an update to SilentOS 2.0.1:

URL1=https://support.silentcircle.com/cus...ticles/2176986

Release Notes - SilentOS 2.0.1

Last Updated: Oct 29, 2015 08:22AM UTC

Security-related fixes

• Fixed a bug that could result in Security Center crashing when trying to wipe data in a particular space
• Fixed a bug related to the “app management” setting in Spaces
• Fixed a bug that could cause a looping notification when the power-off menu was launched
• Fixed a number of vulnerabilities in libstagefright: CVE-2015-6603, CVE-2015-6604, CVE-2015-3876, CVE-2015-6601, CVE-2015-6600, CVE-2015-6599, CVE-2015-6598, CVE-2015-3823, CVE-2015-3870, CVE-2015-3869, CVE-2015-3867, CVE-2015-3868, CVE-2015-3871, CVE-2015-3872, CVE-2015-3873, CVE-2015-3862, CVE-2015-6605
• Fixed CVE-2015-6607, vulnerabilities in SQLite that could allow arbitrary code execution
• Fixed CVE-2015-3878, a vulnerability in the media projection component that could allow unintended disclosure of user data via screenshots or screen recording

• Fixed CVE-2015-6596, vulnerabilities in the Mediaserver that could allow execution of arbitrary code
• Fixed CVE-2015-3865, a vulnerability in Android Runtime that could allow execution of arbitrary code
• Fixed CVE-2015-3879, a vulnerability in the media player framework that could allow elevation of privileges
• Fixed CVE-2015-3877, a vulnerability in Skia that could allow execution of arbitrary code
• Fixed CVE-2015-3874, vulnerabilities in Sonivox that could allow remote code execution
• Fixed a vulnerability in libcore that could allow remote code execution
• Fixed CVE-2015-1541, a vulnerability in AppWidgetServiceImpl that could allow unauthorized access to user data
• Fixed CVE-2015-3861, an out of bound memory read in part of libstagefright that could cause a crash of the mediaserver process
• Made improvements to default settings when creating new Spaces
• Addressed an issue related to Bluetooth management across Spaces. More information about this is available here. Silent Circle thanks Anders Plener of bugcrowd for reporting this issue
• Fixed an issue where the “Power button instantly locks” setting was not properly reflecting its current state
• Removed a notification making it appear that an active VPN would remain active across all Spaces on the device
• Removed weak RSA_EXPORT ciphers supported by openssl
• Disabled 512-bit Diffie-Hellman cryptography
• Removed SSL3 from the chromium project in the Silent Space
• Removed compromised certificate authority
• Fixed a vulnerability that could allow clicks to be passed through system overlays
• Fixed an issue related to Silent OS’s “unknown sources” timer
• Fixed CVE-2015-3860, a vulnerability in the Android lockscreen that can allow a user to bypass it by supplying a large amount of input

Non-Security Improvements, Changes, Fixes

• Addressed an issue that could prevent the Messenger app from sending SMS or MMS messages
• Replaced the previous app and notification icons for the Silent OS updater
• Added translations of the System Profiles menu to Silent OS. Changes "Silent" naming of default System Profile to "Mute" to avoid confusion between the "Silent" System Profile and the Silent Space
• Added APN settings for additional carriers
• Addressed an issue related to interference with Bluetooth connections
• Modem bugfixes and improvements
• Addressed an issue that caused problems using Wi-Fi channels 12 and 13
• Adjust and improved automatic power-off management to preserve long-term battery life
• Updated Silent OS settings to disable data when roaming by default.
• Reduced the number of steps necessary to enable or disable apps in a space through the Security Center
• Made improvements to the Silent OS AppUpdater
• Corrected a bug that could prevent the user from opening downloaded DRM content
• Corrected a bug that could result in multiple prompts to change a password in a managed space
• Addressed an issue that prevented the Clock app from creating visible notifications across Spaces (alarms, timers, etc.)
• Improved response time when placing a call using the native dialer
• Addressed a bug that could cause reboots following a long press of the power button
• Additional bug fixes and improvements

I am liking their listings of changes and mentions of CVE addressed. My BlackPhone 2 continues to be more stable and reliable with carrier communication and link than my BlackPhone 1.

[TheCotMan]

And now they have another update:

URL1= https://support.silentcircle.com/cus...ilentos-2-0-1a

Release Notes - SilentOS 2.0.1a

Last Updated: Nov 17, 2015 03:55PM UTC

Overview:

This is a minor system update focused on patching specific and critical security issues. It contains all the additional features brought in SilentOS 2.0.1.
Changes in this Version:

Security Fixes:

• Fixed buffer overflows in libstagefright (CVE-2015-3832, CVE-2015-3835)
• Fixed elevation of privilege vulnerability in libstagefright (CVE-2015-6610)
• Fixed elevation of privilege vulnerability in libmedia (CVE-2015-6612)
• Fixed information disclosure vulnerabilities in Mediaserver (CVE-2015-6611)

More stagefright-related fixes.

[astcell]

Secure phones should be renamed to vulnerabilities-not-yet-detected phones.

[TheCotMan]

Secure phones should be renamed to vulnerabilities-not-yet-detected phones.

All products are like that.

Where we are today is "security as a product" -- How quickly will your vendor get fixes included in the things you use?

This includes cars, phones, computers, and more.

I see the cost I am paying for a Blackphone is no in having secure phone, but having a phone that is designed with security as the most important feature, and then their effort to quickly fix stuff as it breaks. It is a gamble, but BlackPhone1 fixes were quick in response to known an unknown (unpublished) vulnerabilities.

The sealed battery is a bit annoying, but the really fast charge speed with their proprietary QuickCharge (or whatever it is called) is fast.

Someone else that has one (they can admit it here if they want) does not like the lack of support for a local address book. I like that BlackPhone2 works with OpenVPN, and Signal (replacement to RedPhone and Text Secure from Moxie and thoughtcrime.)

[TheCotMan]

http://www.infoworld.com/article/301...rity-hole.html

Another article on BlackPhone. This one is on details to a security vulnerability they claimed to have fixed in December, which could have allowed applications to talk directly to the communications services to send/receive SMS, phone calls, and mute phone speaker/ringer.

I do like these stories with details on what was found and fixed with BlackPhone. I'm still waiting on stories about competition with BlackPhone.