PDA

View Full Version : Encrypted (log free) Email client

cyberpine
03-24-2008, 02:15 PM
Is there an email client for RIM devices that can assure me that there won't be logs anywhere on the corporate server that show details about my email recipients, subjects, body or attached files?

Presuming email servers like (yahoo, gmail, msn) serve up email... is there any way that an email client can talk to such servers or a special server with there own form encryption so that BES and corporate server only see a URL and some encrypted serialized string for communication to and from the client software??


Is this technically possible? Does it exists?

Thanks.
jeremyckitching
03-24-2008, 02:25 PM
I don't believe there is an email client available that does this, especially if the BlackBerry is connected to a BES.
Sith_Apprentice
03-24-2008, 02:29 PM
i think if you start using that, and your company does Audit messages, they will just block everything but the BES messaging. they have auditing set up for a reason (if applicable), and if they want to know the info, they will find a way. being able to encrypt on top of the BES, and prevent the BES from accessing that info will pretty much nullify the purpose of the BES.
djm2
03-24-2008, 03:54 PM
Sounds like a good way to call attention to yourself and make the powers that be that employ you question whether they want to continue to employ you. Are you looking to get fired so you can claim unemployment?
kjjb0204
03-24-2008, 05:31 PM
There still seems to be some differing thoughts on whether or not a BES admin can see your BIS emails or internet data. According to The Duck, BES admin can't see your BIS...

http://www.blackberryforums.com/general-8800-series-discussion/120665-bes-related-question-my-8830-a.html
hdawg
03-24-2008, 05:33 PM
There still seems to be some differing thoughts on whether or not a BES admin can see your BIS emails or internet data. According to The Duck, BES admin can't see your BIS...

http://www.blackberryforums.com/general-8800-series-discussion/120665-bes-related-question-my-8830-a.html

The monkey agrees with the duck.
Thatzmister2u
03-24-2008, 05:35 PM
There still seems to be some differing thoughts on whether or not a BES admin can see your BIS emails or internet data. According to The Duck, BES admin can't see your BIS...

http://www.blackberryforums.com/general-8800-series-discussion/120665-bes-related-question-my-8830-a.html

Juwaack is correct. They cannot log your incoming BIS messages but they can force all replies to those emails to be sent via the BES server which is subject to logging and auditing if they choose. And when you choose reply...it includes the original incoming BIS message and logs the whole think via the BES server. Bottom line is if you don't want your Boss to see it don't do it.

E-
kjjb0204
03-24-2008, 05:35 PM
Sith, your thoughts on this? Can a BES admin see your BIS emails and internet browsing? Duck and Monkey disagree I think. I have no idea....
penguin3107
03-24-2008, 05:36 PM
The penguin agrees with the duck and the monkey.

There is no facility in BES that will allow a BES administrator to log or audit incoming BIS messages.
End of story.

BES admins can block incoming BIS messages so they don't reach the device.
Additionally, they can set a policy which will force all outbound mail sent from the device, including replies or forwards from BIS accounts, to be sent using the BES account.
Sith_Apprentice
03-24-2008, 05:37 PM
wouldnt that second policy allow them audit BIS messages that are sent?
hdawg
03-24-2008, 05:39 PM
wouldnt that second policy allow them audit BIS messages that are sent?

At that point, they are no longer considered BIS messages as they're routed through the BES; and are stored on the corporate messaging server ... giving all the mail administrators access to the message.

The message would no longer come from or look like it came from a BIS mailbox; I would think an end user would realize this when they see replies go to their corporate mailbox ... but lusers can be lusers.
d_fisher
03-24-2008, 05:48 PM
Can a BES admin see your... internet browsing?Specifically a BES admin can not see what your browsing. But, if they have an IT policy that only allows browsing via the BES supplied browser then all traffic would pass to your corporate proxy. Then your browsing would be logged just like it is if you use your web browser from work. If you use the carrier supplied browser on the BlackBerry then the administrators can not see anything.
hdawg
03-24-2008, 06:28 PM
Specifically a BES admin can not see what your browsing. But, if they have an IT policy that only allows browsing via the BES supplied browser then all traffic would pass to your corporate proxy. Then your browsing would be logged just like it is if you use your web browser from work. If you use the carrier supplied browser on the BlackBerry then the administrators can not see anything.

Just to clarify; even if you don't use a corporate proxy server, a BES Admin can scrape MDS logs ... or use something like Dave Mabe shows us in BlackBerry Hacks (http://www.oreilly.com/catalog/blackberryhks/toc.html) ... "Track MDS HTTP Requests" if you use the MDS Browser (typically labeled BlackBerry Browser).
cyberpine
03-25-2008, 06:21 PM
Thank you! very informational.

Any way to tell if internet traffic is passing through the corporate Proxy?
Is that a typical or likely configuration?

And if I'm not using the default RIM email client, but rather a third party client like Yahoo Go 3.0, what kind of information do you suppose is in the logs?
What about attached file names in emails?

So what I'm gathering from you guys is that baring a major effort, there is likely no typical or standard way for BES admins to see what emails you received or sent? what they contain and what filenames were attached.

Is there any way for me to see what http activity an application has done through the phone? If the application is pulling files from an email server, what kind of http information can I expect to see?

Thank you.
penguin3107
03-25-2008, 06:31 PM
Am I the only one who is hoping that cyberpine's BES admin is a member here and reads these threads?
Thatzmister2u
03-25-2008, 06:33 PM
Am I the only one who is hoping that cyberpine's BES admin is a member here and reads these threads?

Ha! Ha! Ha! Now thats funny!
Sith_Apprentice
03-25-2008, 06:36 PM
well with over 100k active members, and 14 million BB customers world-wide (a little over 90k BES's in the world) its a good possibility!
Thatzmister2u
03-25-2008, 06:40 PM
Am I the only one who is hoping that cyberpine's BES admin is a member here and reads these threads?

Wait Penguin....didn't you realize that he is on YOUR BES???? ;)
penguin3107
03-25-2008, 06:42 PM
Wait Penguin....didn't you realize that he is on YOUR BES???? ;)

If that were true, he wouldn't have made this far into the topic. He'd be busy filling out paperwork at the NY Department of Labor. ;)
cdoggLBC
03-25-2008, 10:36 PM
What about PINs / BB Messenger in the case that an encryption key is not set on the BES (i.e. you can BB Msg people outside of your company)? Are these messages still routed through the BES or straight to the Blackberry network?
cyberpine
03-25-2008, 11:19 PM
Am I the only one who is hoping that cyberpine's BES admin is a member here and reads these threads?

yo.. I'm not trying to hack anything okay. Harmless here. I'm just trying to avoid having to carry two blackberries around and save $100/mo .. one for work and now one just for the booty call emails I don't want to miss. Know what I mean? Two blackberries are NOT better than one.

I would appreciate any help from this clearly talented and knowledgeable bunch (xoxox). ahhh. lol
penguin3107
03-26-2008, 05:42 AM
What about PINs / BB Messenger in the case that an encryption key is not set on the BES (i.e. you can BB Msg people outside of your company)? Are these messages still routed through the BES or straight to the Blackberry network?

They can be audited by BES even if a peer-to-peer encryption key is not set.
hdawg
03-26-2008, 06:28 AM
What about PINs / BB Messenger in the case that an encryption key is not set on the BES (i.e. you can BB Msg people outside of your company)? Are these messages still routed through the BES or straight to the Blackberry network?

What penguin3107 said ...

They are NOT routed through the BES, but your BB can have an IT Policy assigned to it that sends the data (PIN / SMS / Call logs) back to the BES for auditing
cyberpine
03-26-2008, 09:22 AM
What penguin3107 said ...

They are NOT routed through the BES, but your BB can have an IT Policy assigned to it that sends the data (PIN / SMS / Call logs) back to the BES for auditing


Any way to check or confirm that is in place?

Does PIN/SMS/Call Logs include internet or email traffic?

Thanks.
hdawg
03-26-2008, 09:39 AM
Any way to check or confirm that is in place?

... ask your BES Admin. Unfortunately that is it.

Does PIN/SMS/Call Logs include internet or email traffic?

No, it is only PIN, SMS, and phone call logs. This does not include email / Internet Browser traffic.
cyberpine
03-26-2008, 10:03 AM
... ask your BES Admin. Unfortunately that is it.



No, it is only PIN, SMS, and phone call logs. This does not include email / Internet Browser traffic.

Sorry, so there is likely nothing in place that is logging email and internet traffic?? really?
hdawg
03-26-2008, 10:05 AM
Sorry, so there is likely nothing in place that is logging email and internet traffic?? really?

Traffic via BIS is not logged via a BES ... hence the reason a lot of companies block BIS traffic and / or force all routing of personal stuff through the BES.
djm2
03-26-2008, 10:08 AM
I suspect that it would be a good idea to simply ask your BES Admin about company policies regarding personal use of the BB. They may not care. If they do care, in all likelihood all of your efforts to keep things away from them will come to naught.
cyberpine
03-26-2008, 10:18 AM
Traffic via BIS is not logged via a BES ... hence the reason a lot of companies block BIS traffic and / or force all routing of personal stuff through the BES.

I guess I need to read up. Any way to tell if routing is through BES?

What exactly is BIS, the carrier?
hdawg
03-26-2008, 10:31 AM
I guess I need to read up. Any way to tell if routing is through BES?

What exactly is BIS, the carrier?

no way to tell (well except when you send email, if its routed through the bes you'll see it in your sent items and the from address will not be your personal one).

Honestly, I'd just ask. As long as your administrators are friendly people they should tell you what you can and cannot do. Just be nice, don't put them on the defensive, and don't blame them if some policy is put in place ... as most likely it wasn't their call.

BIS = BlackBerry Internet Service ... search for it a bit.
cyberpine
03-26-2008, 11:47 AM
no way to tell (well except when you send email, if its routed through the bes you'll see it in your sent items and the from address will not be your personal one).

Honestly, I'd just ask. As long as your administrators are friendly people they should tell you what you can and cannot do. Just be nice, don't put them on the defensive, and don't blame them if some policy is put in place ... as most likely it wasn't their call.

BIS = BlackBerry Internet Service ... search for it a bit.

wouldn't doing an online traceroute reveal something? wouldnt my device have an ip that is common to the BES server which is likely an internal server?

what about checking email headers on a messages sent from the device? no clues there?
djm2
03-26-2008, 12:28 PM
Why don't you just ask the admin what is up with your company's policies? If all you are worried about is making the next bootie call, then they may not have any problem with that -- unless you're doing the wife/daughter of the boss! At which point you'd really better get that traffic off a corporate BB.
cyberpine
03-26-2008, 12:46 PM
If i run whatsmyip website from a pc client inside the network and reverse dns, i see all sorts of company specific ip addresses.

if i do the same thing from the blackberry i dont any company IP addresses and the ip resolves to my carrier but does note that I am proxied. likely by my carrier.

Question, if not using BIS for internet, i would not see the carriers IP in the above test right?

Regarding email headers, I noticed if I send an emails from my blackberry using my internal company outlook account, the from ip in the header is the company ip, but if i send from a yahoo account, it's a yahoo account with no evidence of the company ip.

Can i conclude with all of this that email and http traffic is not going through BES, but rather BIS?

Again, im not trying to circumvent any security or policy, i just wanna know if it's safe for me to occassionally use the device for personal surfing and emailing.. or if i have to continue to carry two blackberries around.