Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

techdirt.com

Post reply on HN
Print view View original

251–260 of 364 posts

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#251

Post by cant_kant »

The key parts of the Federal order:

"Apple's reasonable technical assistance shall accomplish the following three important functions:

(1) it will bypass or disable the auto-erase function whether or not it has been enabled;

(2) it will enable the FBI to submit passcodes to the SUBJECT DEVICE for testing electronically via the physical device port, Bluetooth, Wi-Fi, or other protocol available on the SUBJECT DEVICE and

(3) it will ensure that when the FBI submits passcodes to the SUBJECT DEVICE, software running on the device will not purposefully introduce any additional delay between passcode attempts beyond what is incurred by Apple hardware.

Apple's reasonable technical assistance may include, but is not limited to: providing the FBI with a signed iPhone Software file, recovery bundle, or other Software Image File ("SIF") that can be loaded onto the SUBJECT DEVICE.

The SIF will load and run from Random Access Memory and will not modify the iOS on the actual phone, the user data partition or system partition on the device's flash memory. The SIF will be coded by Apple with a unique identifier of the phone so that the SIF would only load and execute on the SUBJECT DEVICE.

The SIF will be loaded via Device Firmware Upgrade ("DFU") mode, recovery mode, or other applicable mode available to the FBI. Once active on the SUBJECT DEVICE, the SIF will accomplish the three functions specified in paragraph 2. The SIF will be loaded on the SUBJECT DEVICE at either a government facility, or alternatively, at an Apple facility; if the latter, Apple shall provide the government with remote access to the SUBJECT DEVICE through a computer allowing the government to conduct passcode recovery analysis.

If Apple determines that it can achieve the three functions stated above in paragraph 2, as well as the functionality set forth in paragraph 3, using an alternate technological means from that recommended by the government, and the government concurs, Apple may comply with this Order in that way."

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#252

Post by BWStearns »

tremon wrote: post #241
BWStearns wrote: post #189

Earlier quoted context omitted.

You keep switching between legal and normative requirements. We disagree on the 4th amendment in the same way that scientists and climate change deniers disagree about global warming. You have a fringe understanding of it with no support from the relevant literature and your arguments about it are poorly structured, deny evidence, and rely on intentionally misunderstanding context and terms of art. The legality of se…

The point of a search is to gather evidence, requiring the evidence that would be the result of a search is obviously a non-starter as a system. That kind of reasoning allows wholesale collection of communications data by the NSA and other agencies. Since that practice has been widely criticized, there must be something missing from your argument.

> evidence that would be the result of a search

No one is advocating warrantless searches or not requiring reasons for warrants.

If I want to get a warrant to see who you're calling, it is inherently a broken system that requires the list of people that you called as cause to obtain that warrant.

Any kind of reasoning allows wholesale collection of communications if you misread it properly.

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#253

Post by zimpenfish »

phn wrote: post #250
BurningFrog wrote: post #39

Earlier quoted context omitted.

The countermeasure is for the authorities to push your finger of their choice by force. Thumb and index finger should cover 98% of people.

What if I bite the skin off my fingers? God this conversation is turning into an horror movie.

Pineapple juice might be easier.

https://en.wikipedia.org/wiki/Bromelain

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#254

Post by tremon »

BWStearns wrote: post #252
tremon wrote: post #241

Earlier quoted context omitted.

The point of a search is to gather evidence, requiring the evidence that would be the result of a search is obviously a non-starter as a system. That kind of reasoning allows wholesale collection of communications data by the NSA and other agencies. Since that practice has been widely criticized, there must be something missing from your argument.

> evidence that would be the result of a search No one is advocating warrantless searches or not requiring reasons for warrants. If I want to get a warrant to see who you're calling, it is inherently a broken system that requires the list of people that you called as cause to obtain that warrant. Any kind of reasoning allows wholesale collection of communications if you misread it properly.

Ah, so you do agree with the premise that there must be compelling evidence to warrant a search?

In that case, all you(pl.)'re haggling over is the "price point" of how much evidence is required to support how invasive a search. I'm unsure how that results in the kind of heated debate that seems to happen here.

Oh well...

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#255

Post by bardworx »

chenster wrote: post #232
hguant wrote: post #131

Earlier quoted context omitted.

Blackberry's collapsing business model.

Why is that?

Poor sales, major benefit of blackberry overshadowed by other services (BBM), late to adjust to the times, etc.

I doubt you were suggesting that BB's downfall is rooted in their encryption, however. In the slim case that it did, they didn't speak up about backdoors and letting .gov into their devices until 2015, way after their market share has shrunk.

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#256

Post by kondro »

gambiting wrote: post #244
kondro wrote: post #228

Earlier quoted context omitted.

Passcodes are only 4 or 6 digits.

The encryption key is calculated from your passcode + the AES key etched into the chip inside the phone. There's no way to read that key directly, unless you do some crazy chip imaging where you read the actual electron state of the memory - could be done, but the chance of corrupting that memory is very high, and if they read even one bit wrong then the entire key is useless. So there are two ways to go about this -…

5C doesn't have dedicated HSM.

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#257

Post by BWStearns »

tremon wrote: post #254
BWStearns wrote: post #252

Earlier quoted context omitted.

> evidence that would be the result of a search No one is advocating warrantless searches or not requiring reasons for warrants. If I want to get a warrant to see who you're calling, it is inherently a broken system that requires the list of people that you called as cause to obtain that warrant. Any kind of reasoning allows wholesale collection of communications if you misread it properly.

Ah, so you do agree with the premise that there must be compelling evidence to warrant a search? In that case, all you(pl.)'re haggling over is the "price point" of how much evidence is required to support how invasive a search. I'm unsure how that results in the kind of heated debate that seems to happen here. Oh well...

I got trolled :(

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#258

Post by hueving »

froo wrote: post #216
kriro wrote: post #198

Earlier quoted context omitted.

Sidenote: Fingerprints should most certainly not be used as passwords at all and only serve as usernames (imo). Mostly because it's pretty hard to change your fingerprint which is a desirable feature for passwords ;)

If one is really paranoid, register only a toe print. I've currently got my right big toe registered to my phone as an experiment and it works as often as finger scanning

A penis works as well. It makes checking email on the bus awkward though

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#259

Post by hueving »

froo wrote: post #216
kriro wrote: post #198

Earlier quoted context omitted.

Sidenote: Fingerprints should most certainly not be used as passwords at all and only serve as usernames (imo). Mostly because it's pretty hard to change your fingerprint which is a desirable feature for passwords ;)

If one is really paranoid, register only a toe print. I've currently got my right big toe registered to my phone as an experiment and it works as often as finger scanning

A penis works as well. It makes checking email on the bus awkward though

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#260

Post by fab13n »

headmelted wrote: post #219

For me, the most interesting question I would have is absent from the article. The court is basically ordering Apple to produce new firmware that doesn't block brute forcing. If Apple were to comply, who keeps this firmware after the fact? There's no mention of this at all, but if the firmware image stays with the FBI then the implications are much more profound with regard to privacy.

They specify that the FW will be locked to the unique device's ID, so it won't be usable on any other one.

But once it's established that it can be required from Apple, Apple has to comply, and Apple effectively does comply, other judges in other cases will be able to request other FW, hard-coded against other IDs, as needed.

The middle-term solution to this is for Apple's security team to protect against this threat model, and implement encryption in such a way that _they_ can't bypass it under constraint. I'm not an Apple customer and I don't follow their products closely, but I understand that iPhones 6 already are harder to bypass than iPhones 5.

Post reply on HN