BLACKBIRD

Security

Start with the limit

What Blackbird does not protect against comes first, followed by what it does.

The limit

Only Secret Chats are end-to-end encrypted

Normal chats travel over HTTPS and are stored in a form the server can read. Whoever administers that server is technically able to read them, and they stay there until deleted. When the other person's app is closed, the notification goes through Google's push service with the sender's name and a short preview. That is true of every chat you do not start as a Secret Chat.

A Secret Chat is end-to-end encrypted: it is locked on your phone and can be unlocked only on the other person's phone. It is opt-in, one conversation at a time. If you want everything you send protected from whoever runs the server without having to choose, use a messenger that encrypts every chat end to end, such as Signal. If your aim is to leave advertising and tracking behind, Blackbird is built for that.

Secret Chats

What a Secret Chat protects

Start one from the new-chat button in the app. Both people need Blackbird 5.3.0 or newer.

Locked on the phone

Text, replies, photos, videos, voice notes, files and their names are encrypted on your phone with keys that never leave it. The encryption is vodozemac, the open-source Olm library from the Matrix project, which has been independently audited.

Nothing readable on the server

The server passes on scrambled data and deletes it as soon as the other phone has it. Anything never collected is deleted after 30 days.

Private notifications

The push through Google carries no name and no text. The phone fetches the message itself and shows only “New secret message”.

Verify each other

Compare a 60-digit security code, or scan the QR code on the other phone. If the codes match, nobody is in the middle. If a code changes, the chat ends and the app warns you.

One phone each

A Secret Chat lives only on the two phones in it, in an encrypted database left out of backups. Lose the phone, sign out or uninstall, and it is gone.

What it does not hide

The server still sees who is talking to whom, when, roughly how big each message is, and your IP address. Screenshots are blocked, but a photo of the screen is still possible. A GIF is loaded from KLIPY when it is shown.

Accounts

Sign-in

Hashed, not stored

A password is kept as a one-way hash and cannot be recovered from it.

Codes expire

Each sign-in code works once, expires after a short time, and is voided after five attempts.

One identity

A username and an email each belong to one account, held by a constraint in the database.

Clean expiry

An expired session returns you to the sign-in screen, never to a partly signed-in state.

Updates

Every update is checked before it installs

Blackbird updates from our own website, not from an app store. So every new version passes the same checks on its way to your phone, and a file that fails any of them is thrown away.

  1. Sealed by us

    Every release is signed with our private key. Android only lets an update replace your app if it carries that same signature.

  2. Published on our server

    Only we can publish a release, and our server only offers files stored on our own website, nowhere else.

  3. Checked on your phone

    After downloading, your phone calculates the file’s unique checksum and compares it with the one our server published. If a single byte differs, the file is deleted.

  4. Installed when you say so

    Nothing installs silently. Android shows its own install screen, and the update goes in only when you tap Install.

  5. A tampered file never gets in

    A swapped or damaged file fails the check, is deleted, and never reaches the install screen.

Infrastructure

Where it runs

One server in Germany, behind automatically renewed certificates. The database is not exposed to the internet.

This site loads everything from its own domain, with no CDN, font service or analytics, and a content security policy has the browser enforce that.

Reporting

Report a security issue

Write to buildsevaa@gmail.com with enough detail to reproduce it. There is no bug bounty, but reports are read, and fixes appear in the release notes.