Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

techdirt.com

Post reply on HN
Print view View original

191–200 of 364 posts

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#191

Post by vonklaus »

tptacek wrote: post #105
vonklaus wrote: post #95

Earlier quoted context omitted.

Interesting. Let's take this current tech you described and apply it to this situation, what happens. You did some unspeakable act and you are dead. * You have securely enabled touchID Even if you have 10 tries, barring using random appendages your phone can be unlocked right? Edit: on my phone so far it is password OR touchID. Making this easily defeatable with the physical device and my: 1. Hand if I am dead or ali…

All I'm really saying is that the complexity of your passcode matters a lot in this scenario, so anything you can do to increase it will tend to pay off.

I am not saying you're wrong. I was hoping there was a way to provide more security that I overlooked, however that doesn't seem to be the case.

Most people likely use their dominant hand, probably thumb maybe pointer. In this threat model, someone lifts your phone and opens it with a fingerprint. Assuming they can completely replicate a print and get one (fairly non trivial assumption) they could probably get through with 5 tries.

Genuine question: How secure would you rate:

* TouchID

* 6 char password

* numeric 4 digit pin

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#193

Post by philip1209 »

ars wrote: post #188
philip1209 wrote: post #167

Earlier quoted context omitted.

Specifically regarding question 5 - how does the burden of proof work? How do statues of limitations apply?

There is no burden of proof. Apple says it's corrupted that's about it. I'm sure the other party will ask for details. If they don't believe Apple they'll explain that to the Judge and he'll go from there, but otherwise no one will demand proof of anything. I don't see how statues of limitations is connected to the question.

re: statue of limitations - if we are talking exponential levels of difficulty to crack vs. exponential increases in computing power (Moore's law) I wonder whether "we won't have the computing power to crack this for X years, so a statute of limitations of (X-1) years to solve this means that we are functionally unable to answer the question within the allotted time" becomes defensible as a reason to call something "impossible", i.e. it's improbable to solve during the statue of limitations

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#194

Post by deegles »

[deleted] wrote: post #168
ars wrote: post #157

Earlier quoted context omitted.

1: Yes. 2: Yes. 3: No, but they will probably be the ones asked anyway, and then yes, they would be legally required. 4: Apple. 5: What's the question? Is the question will they be compensated? Then yes. 6: They can't. They don't own their stock. Bad PR is not a good enough reason. You are treating the court like a mathematical proof and finding edge cases. I used to as well. But courts don't work that way at all - t…

[deleted]

Ah yes, that worked great for Asimov.

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#195

Post by tlrobinson »

tptacek wrote: post #4

Remember, this is an iPhone 5C, which doesn't have Touch ID or the Secure Enclave; the security model for this phone is significantly different from that of more recent iPhones. On phones with a Secure Enclave, the wipe-on-failures state is managed in the coprocessor (which runs L4), and is not straightforwardly backdoor-able. If you're worried about the police brute-forcing your phone, enable Touch ID and set a pass…

So all the FBI has to do is desolder the flash chips and hope it was a weak passcode?

Seems like they're just hoping to use this as an opportunity to set a precedent. Never let a serious crisis go to waste?

Also hasn't Apple been able (and previously willing) to unlock pre-Secure Enclave phones for law enforcement for... ever?

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#196

Post by jbapple »

BWStearns wrote: post #189
jbapple wrote: post #160

Earlier quoted context omitted.

In response to your (first?) edit: > The woman in the couple declared it right before the shooting[0]. I'm not questioning that she declared allegiance. I'm asking if she was in private contact with anyone. If you were responding to that, can you show me where that is in the NYT article you linked? I don't see it. > Do you want a notarized letter from the deceased? Let's try to keep this civil, please. > Do you reall…

You keep switching between legal and normative requirements. We disagree on the 4th amendment in the same way that scientists and climate change deniers disagree about global warming. You have a fringe understanding of it with no support from the relevant literature and your arguments about it are poorly structured, deny evidence, and rely on intentionally misunderstanding context and terms of art. The legality of se…

> You keep switching between legal and normative requirements.

If I did so, it was a mistake. My reference to the 4th Amendment, for instance, should have said "how the 4th Amendment ought to protect us". I did not mean to imply that I am trying to predict what warrants the justice system will or will not grant.

> You have a fringe understanding of it

I think I mentioned the 4th amendment just the once. I have been trying to stick to normative arguments.

> The point of a search is to gather evidence, requiring the evidence that would be the result of a search is obviously a non-starter as a system.

I think this is a point where we truly disagree. I think a system can function in which some evidence that a search will yield results is required before the search is conducted. I do not think that the evidence must be airtight. Note that I am speaking about what I think is possible and just and right, not what the law says now or the justice system does now.

> The only way to read this in light of our previous discussion is that saying "I'm in ISIS!" and then shooting up a bunch of civilians is insufficient to prompt a post-mortem search of the attackers' affairs

Did the shooter say she was "in ISIS", or that she pledged allegiance to the leader? There might be a difference in this case. I have read that there is religious significance to a pledge of allegiance in ISIS's theology that might make a pledge indicative of ideological alignment and a membership "in ISIS" indicative of being in actual conversations with ISIS.

> Bravo sir, I have been well and properly trolled.

Please, let's try to be civil.

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#197

Post by Someone »

rhizome wrote: post #169
schrodinger wrote: post #123

Earlier quoted context omitted.

Courts care about precise distinctions of law (that's their purpose!). Seems clear that fingerprints aren't protected, basically the same thing as your face in terms of privacy given a good enough camera. But they would effectively be asking you the question "which finger did you use to lock this phone" to which you may plead the 5th.

It'll be contempt and possibly more if you don't unlock the device with your fingerprint. It's not hard, the "precise distinction of law," is "unlock this with your finger, whichever one does it." I don't know what complicated back and forth you're imagining, but it's never occurred in any case that I've heard of. they would effectively be asking you the question "which finger did you use to lock this phone" to which…

But, as Schrodinger says, this is not about your fingerprint; it is about a bit of information you have that the government does not have: which of your finger(s) this device knows about.

"A bit of information you have that the government does not have" is a password.

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#198

Post by kriro »

ggreer wrote: post #13
randyrand wrote: post #12

Earlier quoted context omitted.

Even if touch id, it would be of no use. TouchID requires a password after 48 hours. or after the device resets. Which is interesting. If you happen to use TouchID, is your best bet to hope a court will not be able to compel you to unlock it within 48 hours of arrest? That sounds very probable.

After five failed fingerprint attempts, your password is required to unlock the phone. That seems pretty safe to me. If you're ever ordered to unlock the phone, just touch an unregistered finger to it. Fingerprint sensors aren't foolproof. It'd be hard to prove you deliberately sabotaged the effort. Though, one feature I'd like would be to register a distress fingerprint. Then I could touch say... my left index finge…

Sidenote: Fingerprints should most certainly not be used as passwords at all and only serve as usernames (imo).

Mostly because it's pretty hard to change your fingerprint which is a desirable feature for passwords ;)

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#199

Post by kchoudhu »

bgentry wrote: post #130
frogpelt wrote: post #66

Who goes to jail if Apple flat out refuses?

Nobody would have to go to jail. They'd hold Apple in contempt and charge them a non-trivial sum of money for every day they refuse. If they continue refusing, the amount increases exponentially until the company is threatened with bankruptcy. In short: they can't refuse without a justified explanation of why they are unable to comply.

AAPL cash reserves as of Jan 2016: 217B.

Looks like the judge's district is about to make a metric shit ton of money!

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#200

Post by carboncopy »

rhizome wrote: post #169
schrodinger wrote: post #123

Earlier quoted context omitted.

Courts care about precise distinctions of law (that's their purpose!). Seems clear that fingerprints aren't protected, basically the same thing as your face in terms of privacy given a good enough camera. But they would effectively be asking you the question "which finger did you use to lock this phone" to which you may plead the 5th.

It'll be contempt and possibly more if you don't unlock the device with your fingerprint. It's not hard, the "precise distinction of law," is "unlock this with your finger, whichever one does it." I don't know what complicated back and forth you're imagining, but it's never occurred in any case that I've heard of. they would effectively be asking you the question "which finger did you use to lock this phone" to which…

> We already covered this in the link above: the 5th Amendment covers passcodes, not fingerprints.

No, it is you who is not understanding schrodinger's assertion. The secret knowledge of which finger unlocks it is in itself a passcode and subject to 5th Amendment protection.

Post reply on HN