A Message to Our Customers

Post by jsmthrowaway » Wed, Feb 17, 2016, 5:29 PM UTC

peeters wrote: post #605

nroach wrote: post #601

Earlier quoted context omitted.

The problem is that once created, it would be easier for future warrants to ask Apple to simply re-perform the same trick it's done in the past. Apple's core argument is that allow this once opens the door to doing it repeatedly because right now Apple doesn't have the toolchain to do this. Once the toolchain exists, its deployment is trivial.

> The problem is that once created, it would be easier for future warrants to ask Apple to simply re-perform the same trick it's done in the past. That's not a problem at all. The issue is how the existence of the tool affects warrantless access. Where did we get the idea that it's bad in itself for law enforcement agencies to be able to break crypto when they have a warrant?

Post by imh » Wed, Feb 17, 2016, 5:30 PM UTC

mikeash wrote: post #545

I'm clearly in the minority here, but I don't really understand Apple's position here, nor do I understand why everyone is rallying behind them. Apple built hardware which was not particularly secure. The software defaults to a four-digit PIN. They attempt to mitigate this by adding an escalating interval between entries, and by optionally wiping the phone after too many failed tries, but this is not set in stone and…

Post by davidhariri » Wed, Feb 17, 2016, 5:31 PM UTC

Post by cmyr » Wed, Feb 17, 2016, 5:33 PM UTC

kevinchen wrote: post #607

ChuckMcM wrote: post #549

Earlier quoted context omitted.

".. what this means is that even Apple can't break into an iPhone with a secure passphrase (10+ characters) and disabled Touch ID - which is hackable with a bit of effort to get your fingerprint." That is not exactly true. They wrote the OS, they designed the phone, they know where the JTAG connectors are. Cracking the phone apart and putting is logic board up on a debugger would likely enable them to bypass security…

> They wrote the OS, they designed the phone, they know where the JTAG connectors are. Cracking the phone apart and putting is logic board up on a debugger would likely enable them to bypass security. When a passcode is entered, the SoC queries the Secure Enclave with the passcode. If the passcode is correct, the Secure Enclave responds with the decryption key for the flash storage. The best Apple could do is sign a…

Post by tedmiston » Wed, Feb 17, 2016, 5:36 PM UTC

imh wrote: post #597

andreyvit wrote: post #419

Earlier quoted context omitted.

They state that they can push an update that makes brute-forcing possible by disabling software-enforced delays between attempts. Apple's security PDF says that the iteration count is calibrated so that one attempt takes 80ms in hardware, so that's the hard limit on the brute forcing speed, regardless of any updates Apple releases. This means that a long alphanumeric passphrase is secure, but a 6-digit passcode could…

It's so weird how hard it is for the brain to handle exponential growth. I was amazed that a 4-digit password can be cracked so quickly at 80ms a pop, but you're right. Just for the hell of it, here's how long it would take for different length passcodes for digits, digits plus letters (case insensitive), and digits plus letters (case sensitive): # characters [0-9] [0-9a-z] [0-9a-zA-Z] 1 0.8 seconds 2.9 seconds 5 sec…