A Message to Our Customers • Hacker News Board

Re: A Message to Our Customers

#711

Post by kentonv » Wed, Feb 17, 2016, 6:53 PM UTC

davidhariri wrote: post #625

I'm no security expert, but how would Apple access previously encrypted data with a different version of iOS? Doesn't having that ability imply they already have a "back-door"? Could someone explain what I'm missing here or is it more that that would be a one-off solution and the FBI is asking for a global, remote, no apple needed solution...

If you read the letter carefully, you'll notice it talks about brute-forcing the password. I guess the assumption is that the password is brute-forceable, but the FBI is unable -- or unwilling -- to write their own software to do it. This seems surprising to me; you'd think the FBI could employ a few hardware hackers for this. Maybe they are only pushing the issue for political reasons -- actual jihadist terrorist attacks on US soil don't happen very often, better milk it for all it's worth?

Re: A Message to Our Customers

#712

Post by herbst » Wed, Feb 17, 2016, 6:55 PM UTC

autoreleasepool wrote: post #691

Wow this made my day. I think my faith in Apple's privacy concerns got a much needed revitalization. Privacy and encryption are the number one reason I stick with iPhone and Mac with File Vault. It was always hard to completely trust them after PRISM. However, that was arguably a different Apple. This stance against the government come poetry reaffirms my faith in the genuineness of Apple'e encryption efforts and Tim…

If this is your main reasons to choose a OS you clearly should use Linux then ;)

Re: A Message to Our Customers

#713

Post by justin_oaks » Wed, Feb 17, 2016, 7:00 PM UTC

tosseraccount wrote: post #297

epaga wrote: post #2

Huge props to Apple - here's hoping against hope that Google, Facebook, and Amazon get behind this. One thing I was wondering is how Apple is even able to create a backdoor. It is explained toward the end: "The government would have us remove security features and add new capabilities to the operating system, allowing a passcode to be input electronically. This would make it easier to unlock an iPhone by “brute force…

Let's get behind Google, Facebook and Amazon to protect our privacy?

Let's get behind Google, Facebook, and Amazon in their desire to not to hand over our data to the government.

Even with as much data as each of them has, it's still better that the data isn't given to yet another party (the government, or each other).

Re: A Message to Our Customers

#714

Post by __jal » Wed, Feb 17, 2016, 7:10 PM UTC

stevehawk wrote: post #572

ChuckMcM wrote: post #549

Earlier quoted context omitted.

".. what this means is that even Apple can't break into an iPhone with a secure passphrase (10+ characters) and disabled Touch ID - which is hackable with a bit of effort to get your fingerprint." That is not exactly true. They wrote the OS, they designed the phone, they know where the JTAG connectors are. Cracking the phone apart and putting is logic board up on a debugger would likely enable them to bypass security…

"From what I understand Tim is doing, and I greatly admire, is trying to avoid a judicial requirement that they be able to do this on demand. The so called "back door" requirement, because he knows, as others do, that such a feature would be used by more than the intended audience, and for more than the intended uses, to the detriment of Apple's users." To be fair - the only reason he's doing it is because it would c…

Let's suppose you can see in to Tim Cook's heart and this is true.

So?

I understand wanting to know people's motivations, from both the perspective of predicting future action and just because we're nosy monkeys. But frankly, what's in Cook's heart doesn't matter. Actions do. And to date, in my view, he's done pretty much exactly the right thing on this issue all along.

Maybe he's defending customer privacy because he believes the Lizard People have religious objections to invading until all humans have Freedom of Math. It doesn't simply matter.

Re: A Message to Our Customers

#715

Post by callumlocke » Wed, Feb 17, 2016, 7:13 PM UTC

> "Specifically, the FBI wants us to make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation. In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession."

So there is already a backdoor. Apple are refusing to let the FBI use the backdoor.

The backdoor is the fact that Apple can push a firmware update that disables security features, without the device's password being entered at any point.

Re: A Message to Our Customers

#716

Post by tosseraccount » Wed, Feb 17, 2016, 7:14 PM UTC

justin_oaks wrote: post #713

tosseraccount wrote: post #297

Earlier quoted context omitted.

Let's get behind Google, Facebook and Amazon to protect our privacy?

Let's get behind Google, Facebook, and Amazon in their desire to not to hand over our data to the government. Even with as much data as each of them has, it's still better that the data isn't given to yet another party (the government, or each other).

Is it "our" data? Or is it their data? You don't think they share this with their business partners?

Re: A Message to Our Customers

#717

Post by mempko » Wed, Feb 17, 2016, 7:15 PM UTC

> Specifically, the FBI wants us to make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation. In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession.

The scary part here is that the iPhone data is really not that secure. If apple can overwrite the OS and get access to the data, this means the keys are stored on the phone somewhere, and not password protected, or "fingerprint" protected.

Re: A Message to Our Customers

#718

Post by erikbigelow » Wed, Feb 17, 2016, 7:17 PM UTC

kbenson wrote: post #650

13thLetter wrote: post #614

Earlier quoted context omitted.

Normally people on HN are much more skeptical about airy promises and assertions from corporate executives. I don't see what behavior on Tim Cook's part has indicated he's more to be trusted than anyone else.

I think the only problem here is the strongness with which it is worded. It would be fair to say one of the reasons he is doing it is because of stock price, but to assert the only reason he is doing it is to cast him as completely uncaring about security and privacy. Without evidence to back this up (in this case, evidence that he doesn't care about security and privacy), it's an attack on his character. It's entire…

He's an older gay man, I would be shocked if this didn't influence greatly his opinion in this realm. He's lived through some times that weren't too friendly to "his kind" that were open.

Re: A Message to Our Customers

#719

Post by agebronze » Wed, Feb 17, 2016, 7:19 PM UTC

This is just huge hypocrisy and full of lies. First of all, Apple CAN attempt to brute force the password. Compiling whatever new firmware is needed and signing it with their keys will not introduce any new backdoor like they claimed and lied to the public - the backdoor is already there, and it is their private keys. Just like that "backdoor" somehow end up at some bad guy's hand, so could their private keys.

I would agree with Apple if they wanted FBI to pre-submit all their guessed passcodes for brute force for apple to try, and for apple to have the sole responsibility for that, so that getting said "backdoor" (which really is nothing more than a door handle) will be as hard as getting their private keys, and governments will not keep the said backdoor in their hands. I would also agree if Apple claimed they don't want to be able to crack devices at a judge's order (although that would be against the law - so they can't claim that).

But this is NOT what Apple said. This whole letter is just one big PR bulshit. They CAN brute force a passcode. They failed enforcing significant delay incurred when failing a passcode attempt - even tho this issue was already known for YEARS (will give citation if needed) when apple designed the discussed iPhone 5C - and they also failed requiring passcode to update the device. They already have their convenient backdoor in place in the form of their private keys.

Re: A Message to Our Customers

#720

Post by tgsovlerkhgsel » Wed, Feb 17, 2016, 7:21 PM UTC

function_seven wrote: post #649

mkaziz wrote: post #634

Earlier quoted context omitted.

Why would it cause a significant drop? Where would those people go?

Not saying I necessarily agree (or disagree), but the premise is that right now iOS phones are the only ones that do security right, out of the box. They're worth the premium price for that feature. As soon as they no longer have that edge, there's no reason to choose them over any commodity Android device, so sales would drop as they lose their differentiating feature.

Honestly, I doubt that a significant number of people is buying the iPhone for its security features.