A Message to Our Customers • Hacker News Board

Re: A Message to Our Customers

#361

Post by Majestic121 » Wed, Feb 17, 2016, 1:26 PM UTC

DanBC wrote: post #326

Majestic121 wrote: post #317

Earlier quoted context omitted.

You can go through each and every physical object I own or even was in contact with, but you won't find any of my passwords

What happens to all your stuff when you die?

I guess my family will take care of my physical stuff. For the online part, some of it can probably be handled through support (facebook, etc...), and the rest will stay as is until it is deleted for lack of use. Or never deleted. Both are okay.

Leaving a physical trace of my passwords is not only bad practice from security point of view, but quite useless since I know them. Also, my online accounts are useless if I can't use them because I'm dead, so I don't really care if no one can access them anymore. What happens to important things such as banking is already dealt with.

Re: A Message to Our Customers

#362

Post by JoeAltmaier » Wed, Feb 17, 2016, 1:30 PM UTC

Majestic121 wrote: post #361

DanBC wrote: post #326

Earlier quoted context omitted.

What happens to all your stuff when you die?

I guess my family will take care of my physical stuff. For the online part, some of it can probably be handled through support (facebook, etc...), and the rest will stay as is until it is deleted for lack of use. Or never deleted. Both are okay. Leaving a physical trace of my passwords is not only bad practice from security point of view, but quite useless since I know them. Also, my online accounts are useless if I…

I just got a Facebook birthday notification for my cousin, who died three years ago. So, that has some impact on me and others in our extended family. Maybe that's ok, maybe it'll get weirder at some point; but its definitely something to think about.

Re: A Message to Our Customers

#363

Post by droopybuns » Wed, Feb 17, 2016, 1:30 PM UTC

Applying an update to break encryption would violate chain of custody and render the information obtained inadmissible in court.

Re: A Message to Our Customers

#364

Post by fnordfnordfnord » Wed, Feb 17, 2016, 1:31 PM UTC

datashaman wrote: post #265

jupp0r wrote: post #249

Earlier quoted context omitted.

It's kind of hard to social engineer dead people, though.

dead people were once alive. go through their pockets or their apartment.

With a $5 dollar wrench? What's that going to get you?

Re: A Message to Our Customers

#365

Post by bmoresbest55 » Wed, Feb 17, 2016, 1:31 PM UTC

As much as I would love to believe in Apple (and any other large tech company), a part of me still thinks that maybe they are working with the government in this letter. The FBI knows that the average US citizen does not want to be hacked. What is to stop the FBI from allowing Apple to say these things and put on a show publicly while simultaneously giving over the 'master key' anyway?

Re: A Message to Our Customers

#366

Post by germanier » Wed, Feb 17, 2016, 1:32 PM UTC

0942v8653 wrote: post #347

OJFord wrote: post #344

Earlier quoted context omitted.

> no way to stop a dedicated attacker from brute-forcing it Wipe after x incorrect? Can't stop the attacker, but you can make it futile, surely.

Nope. If the attacker (Apple in this case) can replace the OS, they will just do so before the phone gets wiped—replacing the OS will remove that wipe feature.

Not if the check and wiping is done in hardware as claimed by Apple for newer devices than the one in question here.

Re: A Message to Our Customers

#367

Post by kabdib » Wed, Feb 17, 2016, 1:33 PM UTC

I'm betting there are similar vulnerabilities in the current "Apple doesn't have the keys" versions of iOS and the hardware. For instance, do a similar mandated firmware update to the secure enclave, and now you get unlimited guesses at a PIN.

edit:

Ah, I've found a couple of sources claiming that the secure enclave wipes its keys if its firmware is updated. Makes sense.

Re: A Message to Our Customers

#368

Post by tossaway1 » Wed, Feb 17, 2016, 1:33 PM UTC

epaga wrote: post #2

Huge props to Apple - here's hoping against hope that Google, Facebook, and Amazon get behind this. One thing I was wondering is how Apple is even able to create a backdoor. It is explained toward the end: "The government would have us remove security features and add new capabilities to the operating system, allowing a passcode to be input electronically. This would make it easier to unlock an iPhone by “brute force…

What do you want thone other companies to get behind? They don't manufacture phones like Apple does, right...?

Note that this letter says: "When the FBI has requested data that’s in our possession, we have provided it."

Seels like that detail is getting very little attention in this announcement. Really? If the FYI requests any data, they hand it over...?

Re: A Message to Our Customers

#369

Post by 0942v8653 » Wed, Feb 17, 2016, 1:33 PM UTC

charlieegan3 wrote: post #346

0942v8653 wrote: post #334

Earlier quoted context omitted.

It's not a backdoor, it's a frontdoor. In cryptography, there's no way to make repeated attempts more computationally expensive. The lockout just an extra feature Apple put on, that Apple could easily remove. If we're going to have 4- and 6- digit PINs, there is no way to stop a dedicated attacker frome brute-forcing it. None.

You can't make crypto behave slower on repeated attempts but you can still make each attempt more expensive. For example: https://en.m.wikipedia.org/wiki/Pepper_(cryptography)

True. But Apple, with such a focus on UX, cannot reasonably afford more than ~200 millisec when checking a password; and still it scales linearly, so the solution for concerned users still involves creating a more complex password. Doubling the amount of time it takes to hash a password will have the same effect as adding 1 more bit of entropy to the password, which can easily be beaten by adding a single character to it.

Re: A Message to Our Customers

#370

Post by rhaps0dy » Wed, Feb 17, 2016, 1:34 PM UTC

pweissbrod wrote: post #343

threatofrain wrote: post #175

Earlier quoted context omitted.

I'm afraid I'm too skeptical to get the same assurances as you. Apple accuses the FBI of playing language games with the term "backdoor", but I think Apple has done the same. The fact that they can push weak OS updates to a locked phone is the backdoor . This means that they can already comply with the court order, and they likely will. This letter covers them from PR damage.

+1. If it is possible to push software updates to a "locked" phone then is this not tantamount to remote code execution with root privileges, and hence the BACKDOOR ALREADY EXISTS? "Locked" seems like an improper term for such a scenario. I applaud apple for appealing this case to the public however there is a HUGE HUGE difference between "we can't unlock" and "we shouldn't unlock". This distinction will likely be lo…

You probably meant "this is tantamount". Otherwise, I don't understand what you're saying. Are you claiming the backdoor already exists, or that it does not?