Live data from Hacker News

Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

techdirt.com

171–180 of 364 posts

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#171

Earlier quoted context omitted.

If you shoot a bunch of people while declaring allegiance to an organized group known for shooting bunches of people then I think that pretty clearly demonstrates that reading your communications has a pretty high likelihood of turning up something useful in preventing future incidents. If this doesn't clear your hurdle for reasonable search then what would? To be clear, I don't think the order to Apple is necessaril…

...pretty clearly demonstrates that reading your communications has a pretty high likelihood of turning up something useful in preventing future incidents. It sounds like common sense, I guess, but has that ever worked, actually? Similar "prevention" rationale is offered for governments to spy on virtually all telecom all the time, now. But this shooting happened anyway.

> Similar "prevention" rationale is offered for governments to spy on virtually all telecom all the time, now. But this shooting happened anyway.

1) Anyone with a plan promised to stop all terrorist attacks is lying to you, stupid, or both. You can't have a free society and a 0% chance of political violence.

2) Yes, searching the possessions and communications of dead terrorists unsurprisingly are substantially more likely to lead to useful criminal leads than reading your metadata. A warrant to read this person's stuff isn't unreasonable in the slightest, an order forcing apple to do shit might be but that's a procedural thing unrelated to the core issue of "is there a good reason to read this person's stuff"

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#172
post #168
post #157

Earlier quoted context omitted.

1: Yes. 2: Yes. 3: No, but they will probably be the ones asked anyway, and then yes, they would be legally required. 4: Apple. 5: What's the question? Is the question will they be compensated? Then yes. 6: They can't. They don't own their stock. Bad PR is not a good enough reason. You are treating the court like a mathematical proof and finding edge cases. I used to as well. But courts don't work that way at all - t…

[deleted]

That would be terrible

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#173
post #164
post #155

Earlier quoted context omitted.

I'm assuming you are referring to quantum computing for it's speed computations? That wouldn't make a different here. They have only X amount of tries before the phone locks them out. It is the number of tries that is the issue here.

From my understanding, if you had for example a 128-qbit quantum computer, it would be able to crack any 16 character password in a single operation.

Nope. For general search operations (modeling your 128-bit cipher as a black box) the best we know how to do is Grover's algorithm, which gives you a quadratic speed up. Your 128 bit problem is now a 64 bit problem (which is of course still quite good).

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#174
post #4

Remember, this is an iPhone 5C, which doesn't have Touch ID or the Secure Enclave; the security model for this phone is significantly different from that of more recent iPhones. On phones with a Secure Enclave, the wipe-on-failures state is managed in the coprocessor (which runs L4), and is not straightforwardly backdoor-able. If you're worried about the police brute-forcing your phone, enable Touch ID and set a pass…

Law enforcement can legally force you to unlock your phone with your fingerprint, but cannot force you to reveal your passcode. http://pilotonline.com/news/local/crime/police-can-require-c...

That's not correct. This is still an open question. Some courts have went one way, some the other way.

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#175

Earlier quoted context omitted.

I don't know about that but I'd be fairly certain a court would just order you to unlock the phone regardless of whether it's your finger locking it or a password.

In the USA the courts treat passwords as testimony, and in most cases you can invoke your 5th amendment right and refuse to provide passwords or encryption keys, given the state does not already know the contents of the device. This same protection does not extend to physical keys, which I think fingerprints would fall under. http://www.uclalawreview.org/the-fifth-amendment-encryption-...

Interesting being Australian I don't have a 5th amendment to protect me. Also my understanding is that at least in Australia you'd likely be charged with obstruction of some sort, does that not fly in the US?

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#177

Earlier quoted context omitted.

It sounds like since the UID is fused it cannot be erased; it's probably the GID that's erased, and it sounds like the GID is known to Apple.

but fuses can be blown. Simply by blowing one of the fuses the key will change. Even a single bit change means it's useless to authorities.

The fuses are only "blown" (i.e. the UID is burned into the chip) at manufacturing time, not when the device is erased.

When a device is first set up (or wiped) a random key is created and encrypted by the Secure Enclave with a key derived from the user's passcode and the device's UID. Since only that particular device's Secure Enclave has access to the UID the user's passcode can't be brute forced by any other computer, which enables the Secure Enclave to enforce policies like the passcode attempt delay and incorrect passcode attempt. If the device needs to be wiped the random key is simply erased by the Secure Enclave.

(Also, if you only changed 1 bit that would mean you only had to try 2 possible keys...)

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#178
The article at Errata Security [1] is better. There is an HN submission for it [2], but it hasn't drawn any attention.

In particular, it addresses technical issues not covered in the Techdirt article that are relevant to many of the existing comments here on HN.

[1] http://blog.erratasec.com/2016/02/some-notes-on-apple-decryp...

[2] https://news.ycombinator.com/item?id=11115251

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#179
post #38
post #13

Earlier quoted context omitted.

After five failed fingerprint attempts, your password is required to unlock the phone. That seems pretty safe to me. If you're ever ordered to unlock the phone, just touch an unregistered finger to it. Fingerprint sensors aren't foolproof. It'd be hard to prove you deliberately sabotaged the effort. Though, one feature I'd like would be to register a distress fingerprint. Then I could touch say... my left index finge…

If you do this on purpose after asked to unlock your phone you will probably be charged with destruction of evidence or something like that. However, while a court is (afaik) able to ask you to put your finger on the fingerprint reader, you do not need to tell them which of the fingers the correct one is. So instead of purposely using a wrong finger, I'd ask the court to explicitly tell me which of my fingers I shoul…

Why not just turn the phone off instead.

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#180

Why no one is attacking on hardware level? Cut the processor to get the GID and UID, dump the flash, pregenerate rainbow tables with pin, power flash chip externally and give the codes ... Yeah it is expensive, but I would not be surprised if there aren't such labs that could provide such service. Why does FBI goes trough such pains?

While I'm also curious why this isn't possible (as per everyone else's comments), the phone in question doesn't even have the same level of security so does it even have a dedicated chip with the GID and UID?
Post reply on HN