Live data from Hacker News

Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

techdirt.com

201–210 of 364 posts

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#201
post #156

Earlier quoted context omitted.

In my jailbreak days, the DFU update did indeed wipe the device. I don't know how it works.

Did it actually write zeros to the flash memory or did it leave the data sitting around somewhere?

The encryption key is deleted. All data can remain on the flash for years, but it's useless.

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#202

Earlier quoted context omitted.

That would be terrible

Why?

Even ignoring Godel - take the stuff that's been legal in the past & not anymore.

Slavery? Restricted Suffrage? Genocide? Witch trials? Heroin?

Or stuff that's been illegal before

Inter-racial marriage? Hemp? Gay marriage?

Due process isn't enough for a legal system to work - the law has to change & revocable Axioms aren't exactly a thing.

In fact, my sister goes on and on about Jurisprudence in such discussions - letter of the law and the spirit of it.

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#203
post #149

Earlier quoted context omitted.

But let's say that I/you killed your/my dog is not in question. The killer's notes on dog killing are relevant to the case. Your iOS notes are no closer to being part of your brain as a dead tree journal is. Other than (as someone else brought up) a hypothetical brain scanning technology that claims to reveal thoughts[0] I can't think of a category of digital evidence that is so substantively different from analogue…

If there's no question someone killed your dog, then you don't need to read what's in the phone, do you? There's a point to your analogy.

Oh yeah, sorry. Distinguishing between premeditation or not in order to charge and sentence properly. Without premeditation there may be no crime at all. I did not spell that out well and only touched directly on it in the first post. The point is that it's evidence and not really different than if I wrote it in my dead tree diary. I'm hobbled a bit here because I'm trying to make the very unsexy point that most electronic things are not unique because they're electronic (kinda like how "doing it on a computer" shouldn't be sufficiently novel to justify patent protection). The extent to which "devices becomes more and more an extension of the brain" is at the moment not far enough to justify unique treatment to your iOS notes.

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#204
post #107

Earlier quoted context omitted.

The court order refers to the need to load the custom OS image via DFU (device firmware upgrade) mode. I am not an iPhone user but I'm assuming that is exactly what the name implies. (some pre-boot recovery environment)

It's been a few years since I looked at DFU, but my impression was that installing a new OS via DFU would have the side-effect of erasing the device.

You could rewrite the bootloader and recovery firmware to really do anything. Resize some partitions and dual boot into a shell with some drivers for keyboard and wireless.

Basically jailbreak..

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#205
post #107

Earlier quoted context omitted.

The court order refers to the need to load the custom OS image via DFU (device firmware upgrade) mode. I am not an iPhone user but I'm assuming that is exactly what the name implies. (some pre-boot recovery environment)

It's been a few years since I looked at DFU, but my impression was that installing a new OS via DFU would have the side-effect of erasing the device.

That's probably the case for you and I, but I'm sure with sufficient knowledge of how DFU works (for example by employing the engineers who designed it) you can persuade it to only rewrite particular blocks, leaving the data intact.

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#206
post #4

Remember, this is an iPhone 5C, which doesn't have Touch ID or the Secure Enclave; the security model for this phone is significantly different from that of more recent iPhones. On phones with a Secure Enclave, the wipe-on-failures state is managed in the coprocessor (which runs L4), and is not straightforwardly backdoor-able. If you're worried about the police brute-forcing your phone, enable Touch ID and set a pass…

Also, don't use your actual fingerprint, since it's becoming harder to avoid giving it to the government, even if you're not a criminal.

What is the alternative approach?

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#207
post #188

Earlier quoted context omitted.

There is no burden of proof. Apple says it's corrupted that's about it. I'm sure the other party will ask for details. If they don't believe Apple they'll explain that to the Judge and he'll go from there, but otherwise no one will demand proof of anything. I don't see how statues of limitations is connected to the question.

re: statue of limitations - if we are talking exponential levels of difficulty to crack vs. exponential increases in computing power (Moore's law) I wonder whether "we won't have the computing power to crack this for X years, so a statute of limitations of (X-1) years to solve this means that we are functionally unable to answer the question within the allotted time" becomes defensible as a reason to call something "…

A statute of limitations prevents you from charging someone with a crime once some period of time elapses. It says nothing about how long you have to prove your case in court. That's more likely to run afoul of the right to a speedy trial.

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#208
post #188

Earlier quoted context omitted.

There is no burden of proof. Apple says it's corrupted that's about it. I'm sure the other party will ask for details. If they don't believe Apple they'll explain that to the Judge and he'll go from there, but otherwise no one will demand proof of anything. I don't see how statues of limitations is connected to the question.

re: statue of limitations - if we are talking exponential levels of difficulty to crack vs. exponential increases in computing power (Moore's law) I wonder whether "we won't have the computing power to crack this for X years, so a statute of limitations of (X-1) years to solve this means that we are functionally unable to answer the question within the allotted time" becomes defensible as a reason to call something "…

Statue of limitations is only until the court date. Once that starts there is no statue of limitations, even if the case takes years.

The closest I can think of is a right to a speedy trial, but that has so many exceptions (for example if the person is out on bail) that I couldn't say how a judge would rule in this scenario. Especially if it was the defendant causing the delay by refusing to reveal the password and making the prosecutor get it the hard way. (Not applicable in this case, might be applicable in another.)

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#209
post #118
post #13

Earlier quoted context omitted.

After five failed fingerprint attempts, your password is required to unlock the phone. That seems pretty safe to me. If you're ever ordered to unlock the phone, just touch an unregistered finger to it. Fingerprint sensors aren't foolproof. It'd be hard to prove you deliberately sabotaged the effort. Though, one feature I'd like would be to register a distress fingerprint. Then I could touch say... my left index finge…

>After five failed fingerprint attempts, your password is required to unlock the phone. How is that actually enforced? Is there an if statement and a counter somewhere? Couldn't that just be disabled by a sufficiently advanced attacker?

If they could do that, they could also read the memory for the encryption key stored in the enclave. No such attack exists that we know of.

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#210

Earlier quoted context omitted.

Also, don't use your actual fingerprint, since it's becoming harder to avoid giving it to the government, even if you're not a criminal.

What is the alternative approach?

Your toe?

I'm only half joking. I wonder if a knuckle or something would work.

Post reply on HN