Chinese Android smartphone firm: It packs a dedicated crypto chip Chinese smartphone manufacturer Gionee has released a device with a dedicated encryption chip it calls "equivalent to a black box" that offers the "most advanced" mobile data protection to date. Experts we asked were sceptical about the claims, which at minimum show that improved security is becoming a differentiator in the …
i.e. basically a separate on chip computer running its own OS, that supports key storage, along with a dedicated encryption block to encrypt everything on the filesystem.
Apple publishes a 60 page iOS security guide that explains how theirs all works in great detail, so you can see where it protects you and where there is still room for improvement. Unless these guys do the same, you just have to trust that they got the software right. Given how hard it is to "get the software right" when it comes to encryption (just ask the openssl developers) just because it includes hardware support to do a better job than other Android phones doesn't mean it actually does.
Claiming security that's "equivalent to a black box" based on just promises is no better than being shipped a big black box from which growling sounds are heard that's labelled "not a tiger".
Nah, am highly skeptical myself.
Maybe El Reg can get hold of a demo unit or two and see if any attempt can be made at accessing encrypted data?
It should be really simple... one of the staff members should turn on encryption, and dump a shedload of Dabbsy/Simon/whatever articles onto the phone. Once that is done and finished, another staff member should "blag" the phone, and try to access the data contained thereon...
While that is done, the same should be done to other smartphones that boasts encryption and all that kind of bells and whistles... should be good to have a handy comparison between the various contenders on the market.
No you're not, but not through choice. The only network available in this area (Central Maine USA) uses CDMA and those are a bit like rocking horse shit... rare. Even when you find one the operator then throws up barriers to actually getting the damn thing registered on their network, I just find it easier to outright buy a "previously owned" handset from the cellphone company so as not to be paying $750 over 2 years for one. One of the perils of living in a free market economy where everyone and their brother is either operating or striving to operate in a monopolistic manner.
You either unlock your key stored in that chip with your pin, or you combine your pin and the key on the chip to create the key to access your data. In both cases you can trivially get around any security by just uncapping the chip, something that rivalling Pay-TV operators have done for years. Sure that'll cost you a couple of thousand Euros, but that's nothing for a larger criminal investigation. You simply cannot protect data from physical access, at least not for that kind of budget and with the comfort of not loosing it when your device thinks its manipulated. (or the battery is dead)
Plus of course for us in the west it doesn't matter if that device sends all its data to China. China has no juristiction over me. China cannot send me to prison easily, China simply cannot use this kind of information against me. Since western governments are skeptical of China, they won't cooperate with them to harm me personally. In contrast my government actively helps the US government to spy on everyone in my country.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
