71–80 of 364 posts
I don't see that this requires Apple to do anything in particular with whatever passcodes the FBI submits.
bool tryPasscode (string passcode) { return false; }
Reasonable cost of service: $5?
Earlier quoted context omitted.
I'm sorry, but I don't understand what you're getting at here. The legitimate concern is prevention of future attacks. They may have collaborated with people who were never apprehended on the attack that actually happened.
> They may have collaborated with people who were never apprehended on the attack that actually happened. Right, but we don't go searching everyone's papers just in case they are conspirators. If Alice punches Bob in the face, then is hit by a bus and dies, we don't go searching through all of Alice's stuff just in case there might have been someone else involved with the Bob-punching incident, right? Is there any ev…
If what Apple's security guides claim is true, "unreasonably burdensome" should be an easy standard to meet on practical technical feasibility grounds. The issue is whether they'll want to challenge this on non-technical grounds.
Why wouldn't the FBI just clone the phone disk contents and crack the encryption on more dedicated systems?
Are there tools to dump and resume iPhone/Android states? Could easily dump state, null "tryCounter++", and resume cracking?
Earlier quoted context omitted.
In the USA the courts treat passwords as testimony, and in most cases you can invoke your 5th amendment right and refuse to provide passwords or encryption keys, given the state does not already know the contents of the device. This same protection does not extend to physical keys, which I think fingerprints would fall under. http://www.uclalawreview.org/the-fifth-amendment-encryption-...
It would seem to me that the "fingerprint = key" analogy is flawed. Physical keys can be trivially copied, and even reverse engineered from the locking mechanism. A key is a physical object that is required to disengage a lock. A fingerprint, when used on an electronic lock of this kind, is not a key. It's attributable to one person only, not trivially duplicated, and not able to be reverse engineered from a locking…
Not quite sure it is though. If they already arrested them, they already have the fingerprint don't they? That is different than key and is different than password.
Why wouldn't the FBI just clone the phone disk contents and crack the encryption on more dedicated systems?
Apple has gone so far as to disable JTAG access so they can't read the keys even with a hardware debugger.
Earlier quoted context omitted.
In the USA the courts treat passwords as testimony, and in most cases you can invoke your 5th amendment right and refuse to provide passwords or encryption keys, given the state does not already know the contents of the device. This same protection does not extend to physical keys, which I think fingerprints would fall under. http://www.uclalawreview.org/the-fifth-amendment-encryption-...
It would seem to me that the "fingerprint = key" analogy is flawed. Physical keys can be trivially copied, and even reverse engineered from the locking mechanism. A key is a physical object that is required to disengage a lock. A fingerprint, when used on an electronic lock of this kind, is not a key. It's attributable to one person only, not trivially duplicated, and not able to be reverse engineered from a locking…
If you can compel a suspect to stand up on a lineup, or produce id, there's no reason why the court shouldn't be able to compel you to produce a finger.
In technical terms, the finger is really a "something you have" second authentication factor. If you think of it on those terms, it's more like looking at someone's Hardware token than compelling a password disclosure.
Earlier quoted context omitted.
Can someone answer this? Raw read the memory to an external device and then brute force that shit using super computers until it cries.
If you can break AES... then the NSA would love to have a word with you :P The FBI is going after the lowest hanging fruit, the users password that was used to create the crypto key.
Earlier quoted context omitted.
Yeah I've got the same question. Is there some hardware safeguard that prevents copying the memory itself? You'd think the first rule of crypto forensics is to work on a copy.
Even if there were no such safeguard, you'd still have to break AES encryption...
A thought experiment: Let's say the government makes hardware encryption standards in the style of FedRAMP that sets standards for preventing tampering by foreign governments. Then, imagine that a consumer electronics company voluntarily makes all devices comply with this standard. Could a court attempt to compel the company to defeat the standards which the government set as tamper-proof against governments? A secon…