Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Message to Our Customers

apple.com

Post reply on HN
Print view View original

591–600 of 1001 posts

Re: A Message to Our Customers

#591

Post by cromwellian »

There's a simple way to defeat Apple's argument. The judge could simply ask Apple to flash the new firmware on that phone, let the FBI run the brute force under their supervision and obtain the contents they need, and then flash back a non-compromised version of the OS.

The government would never have access to a phone with a compromised version of an OS that they could use to repeat this trick. Rather, the government would have to obtain court orders and have forensics done under supervision.

This isn't a backdoor and doesn't affect consumers, and sets a really high bar to trying to scale this for the government because it requires Apple as the gatekeeper every time to agree to do the one-off hack.

The cynic in me thinks that this letter is more about brand image. Apple wants to claim they can't hack their own phones, even if the government asks, but clearly in the case of the iPhone 5C it IS possible for them to do it, and this creates a contradiction with their public marketing and privacy position. If they didn't release this open letter, then simply complying with the judges order would make them look bad.

Re: A Message to Our Customers

#592

Post by greenpizza13 »

stevehawk wrote: post #572
ChuckMcM wrote: post #549

Earlier quoted context omitted.

".. what this means is that even Apple can't break into an iPhone with a secure passphrase (10+ characters) and disabled Touch ID - which is hackable with a bit of effort to get your fingerprint." That is not exactly true. They wrote the OS, they designed the phone, they know where the JTAG connectors are. Cracking the phone apart and putting is logic board up on a debugger would likely enable them to bypass security…

"From what I understand Tim is doing, and I greatly admire, is trying to avoid a judicial requirement that they be able to do this on demand. The so called "back door" requirement, because he knows, as others do, that such a feature would be used by more than the intended audience, and for more than the intended uses, to the detriment of Apple's users." To be fair - the only reason he's doing it is because it would c…

"To be fair - the only reason he's doing it is because it would cause a significant drop in sales for Apple devices."

That's not being fair at all. To say the only reason he is doing it is to protect iPhone sales doesn't speak to Tim's character. Of course he cares about sales, but he also cares about privacy.

Re: A Message to Our Customers

#593

Post by hunterjrj »

at-fates-hands wrote: post #457

The easy solution to this is to have the gov send Apple the phone. They break into themselves and then hand back the phone with the pass code turned off and whatever software they need to install to do it removed, leaving no trace of how they actually did it. Win/Win No software backdoor is created, the FBI gets its data and we all go on with our lives. Why are we spending so much time gnashing teeth over something t…

Chain of custody. The guv would need to be able to prove, in a court of law, who touched it and when, for what purpose, etc. Handing it off to Apple in good faith would make it inadmissible as evidence in a trial.

You could argue that Apple could allow an official to be present while work is being done on the phone, but then Apple risks having it's (to-be-developed) method being viewed and/or captured by said official. Very risky.

Re: A Message to Our Customers

#595

Post by ccvannorman »

cromwellian wrote: post #591

There's a simple way to defeat Apple's argument. The judge could simply ask Apple to flash the new firmware on that phone, let the FBI run the brute force under their supervision and obtain the contents they need, and then flash back a non-compromised version of the OS. The government would never have access to a phone with a compromised version of an OS that they could use to repeat this trick. Rather, the governmen…

1) Merely creating the software/firmware in the first place is extremely dangerous, allowing for a failure point of any engineer or custodian of the firmware to leak it, destroying everything.

2) The strong precedent will be set that governments can get whatever they want from our devices by whatever means necessary, and it will only get worse.

Re: A Message to Our Customers

#596

Post by aeonflux »

codezero wrote: post #506
johnward wrote: post #493

Earlier quoted context omitted.

There is no way to recover a phone if you lose the passcode?

If you have access to the iTunes account you can do a physical backup with iTunes and then erase and restore that backup. It won't be pin protected.

Not even sure what you mean by "iTunes account"?

Re: A Message to Our Customers

#597

Post by imh »

andreyvit wrote: post #419
hasenj wrote: post #397

Earlier quoted context omitted.

It's stated very clearly that they can push an update to an already existing device that would make it possible to retrieve "encrypted" data from said device. If the data was truly encrypted, the concept of pushing an update or creating a master key would not be possible.

They state that they can push an update that makes brute-forcing possible by disabling software-enforced delays between attempts. Apple's security PDF says that the iteration count is calibrated so that one attempt takes 80ms in hardware, so that's the hard limit on the brute forcing speed, regardless of any updates Apple releases. This means that a long alphanumeric passphrase is secure, but a 6-digit passcode could…

It's so weird how hard it is for the brain to handle exponential growth. I was amazed that a 4-digit password can be cracked so quickly at 80ms a pop, but you're right. Just for the hell of it, here's how long it would take for different length passcodes for digits, digits plus letters (case insensitive), and digits plus letters (case sensitive):

    # characters  [0-9]         [0-9a-z]            [0-9a-zA-Z]
    1             0.8 seconds   2.9 seconds         5   seconds
    2             8   seconds   1.7 minutes         5.1 minutes
    3             1.3 minutes   1   hour            5.3 hours
    4             13  minutes   1.6 days            2   weeks
    5             2.2 hours     8   weeks           2.3 years
    6             22  hours     5.5 years           140 years
    7             1.3 weeks     200 years           9   thousand years
    8             13  weeks     7   thousand years  550 thousand years
    9             2.5 years     260 thousand years  34  million years
    10            25  years     9   million years   2   billion years

Re: A Message to Our Customers

#598

Post by sre_ops »

andreyvit wrote: post #427
germanier wrote: post #366

Earlier quoted context omitted.

Not if the check and wiping is done in hardware as claimed by Apple for newer devices than the one in question here.

Secure Enclave is not really ‘hardware’; despite being isolated from the main OS and CPU, it is still software-based and accepts software updates signed by Apple.

That's just plain incorrect. To update code accessing SE one needs to have a phone accept the updates which require having phone in a state equal to owner unlocking the phone.

Re: A Message to Our Customers

#599

Post by will_be_ironman »

cromwellian wrote: post #591

There's a simple way to defeat Apple's argument. The judge could simply ask Apple to flash the new firmware on that phone, let the FBI run the brute force under their supervision and obtain the contents they need, and then flash back a non-compromised version of the OS. The government would never have access to a phone with a compromised version of an OS that they could use to repeat this trick. Rather, the governmen…

If Apple doesn't fight this, a precedent will be set, allowing for the government to compel companies to release user information or ways of circumventing encryption in the future.

2) the government doesn't need to have access to the firmware for it to become dangerous, the sheer fact that this can be created is dangerous. What's to stop a determined, hacker from doing the same thing in the confines of his/her bedroom once it's confirmed that this is possible?

Re: A Message to Our Customers

#600

Post by sre_ops »

jandrese wrote: post #499
ryaniscool wrote: post #489

Earlier quoted context omitted.

The government wants Apple to disable the auto-erase after so many unlock attempts. Apple argues in this letter that with modern computing power, this amounts to a backdoor. The details of the gov't request are in another story on the HN front page https://www.techdirt.com/articles/20160216/17393733617/no-ju...

The encryption key used on the root filesystem is too hard to brute force. It's not based on some crappy password that a human created, it's some hash value stored in the hardware. In a scenario like that it is easy to create a key that would require all of the computers working till the heat death of the universe to crack.

This phone does not have SE. It is purely software and Apple can defeat it easily. This is the exact attack vector that was addressed by Apple in the phones with SE.
Post reply on HN