Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

techdirt.com

Post reply on HN
Print view View original

341–350 of 364 posts

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#341

Post by chopin »

headmelted wrote: post #313
chopin wrote: post #249

Earlier quoted context omitted.

>The SIF will be coded by Apple with a unique identifier of the phone so that the SIF would only load and execute on the SUBJECT DEVICE. If I understand the cited order correctly the firmware is ordered to be constructed in a way that it runs only on the target phone.

I do wonder though that had Apple not predicted this exact scenario ahead of time (likely), how would they control this? It's unlikely they can rely on hardware protections to provide this device locking, so is it the case that they would build the unique identifier into the image. Optimistically some obfuscation could help but are the FBI/CIA/NSA really more than a few hops away from opening the binary image in a he…

I agree with you that this will be difficult or maybe impossible to implement. However the court has foreseen the upthread argument as the order shows.

As many here I believe that once this backdoor exists it will be somehow exploited (at the very least by further orders).

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#342

Post by thoughtcroft »

nanocyber wrote: post #141

I thought this was an excellent write-up regarding how the iOS security platform (recent iPhone models) works from someone obviously in the know, as posted in the forums of Apple Insider. (Source: http://forums.appleinsider.com/discussion/191851 ) " Apple uses a dedicated chip to store and process the encryption. They call this the Secure Enclave. The secure enclave stores a full 256-bit AES encryption key. Within th…

There is a back door already called iCloud Backups. Because if turned on, all the user data is sent to a remote server and it can be restored to a different phone. So that data is obviously not encrypted using the same highly secure hardware based encryption.

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#343

Post by BWStearns »

Lawtonfogle wrote: post #299
BWStearns wrote: post #110

Earlier quoted context omitted.

Think about what we want as a society though. If you did commit a crime, we want to convict you. The reason the 5th protects you from compelled self-incrimination is to prevent unjust interrogation and investigation techniques from the cops[0], not to make the overall likelihood of conviction lower, although it incidentally has this effect. From a policy standpoint the ideal world would be one where all criminals are…

>If you did commit a crime, we want to convict you. There are too many bad laws out there. If I meet a bad guy, I can defend myself. If I cross the government, I'm doomed. I much rather support things that increase my likelihood of meeting a bad guy that I can defend myself against while reducing my ability to cross the government and being doomed without recourse. This is the whole reason I justify that it is better…

It is unjust to jail Rick for jay walking and ignore that Morty jay walks. A system of partial enforcement is not intrinsically more just because we haven't jailed Morty. It's actually unjust because if Morty is free to jay walk then how can we justify locking up Rick if jay walking is the crime? We probably just like Rick less.

Partial enforcement is a practical reality because we're willing to accept the injustice of partial enforcement rather than live in an Orwellian police state (a decision I'm thrilled with!).

> There are too many bad laws out there.

That's the point! If bad laws stay on the books and aren't generally enforced then they can be enforced capriciously as punitive weapons by government officials. If bad laws are fully enforced, they won't stay on the books for very long.

This is why it is in the best interest of a society to have as high an enforcement rate as possible before increasing false positives. It discourages bad laws from existing in the first place and surviving in the second.

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#344

Post by sandworm101 »

Armisael16 wrote: post #318
sandworm101 wrote: post #92

Earlier quoted context omitted.

They would fingerprint the reader, and you, to get a rough idea of which finger is a likely candidate. Even an extremely partial print should be enough to narrow it down to 4 or 5. The reality is that all right-handed people hold phones in their left and so use fingers on their right hand. Lefties do the reverse. So it is already down to five candidates ... which might have something to do with why apple picked that…

...where on earth did you get that idea from? I'm right-handed and both hold and unlock my phone with the fingers on my right hand.

It depends on the size of the phone. My too open/unlock my phone with the same hand that holds it (pattern unlock). But my phone is tiny. As a phone gets larger so does the likelihood that it is manipulated with two hands. Having the scanner below the screen also requires some dexterity when used single-handed, increasing the likelihood that the thumb is the print finger.

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#345

Post by gcb0 »

gcb0 wrote: post #236
tlrobinson wrote: post #181

Earlier quoted context omitted.

Are you suggesting they can brute force AES-256? iOS's security is quite sophisticated: https://www.apple.com/business/docs/iOS_Security_Guide.pdf

well, now that you mention... i was commenting only on the article that says they wanted apple to remove the "wipe data after X tries"

actually, no. most people use 5 digits pins. why break anything other than that?

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#346

Post by ethbro »

ethbro wrote: post #284
superuser2 wrote: post #27

Earlier quoted context omitted.

In this case, the part where the phone's owner is dead.

Do dead guys not have functional fingerprints? (Yes, I really asked that. Yes, I'm really curious.)

Because I was interested and no one else chirped in, the answer is "Yes, but require some additional effort to obtain due to post-mortem stiffening."

For those curious, here's a Northwestern scan of an article in The Journal of Criminal Law from the 70s (thanks, internet!): http://scholarlycommons.law.northwestern.edu/cgi/viewcontent...

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#347

Post by Lawtonfogle »

BWStearns wrote: post #343
Lawtonfogle wrote: post #299

Earlier quoted context omitted.

>If you did commit a crime, we want to convict you. There are too many bad laws out there. If I meet a bad guy, I can defend myself. If I cross the government, I'm doomed. I much rather support things that increase my likelihood of meeting a bad guy that I can defend myself against while reducing my ability to cross the government and being doomed without recourse. This is the whole reason I justify that it is better…

It is unjust to jail Rick for jay walking and ignore that Morty jay walks. A system of partial enforcement is not intrinsically more just because we haven't jailed Morty. It's actually unjust because if Morty is free to jay walk then how can we justify locking up Rick if jay walking is the crime? We probably just like Rick less. Partial enforcement is a practical reality because we're willing to accept the injustice…

>Partial enforcement is a practical reality because we're willing to accept the injustice of partial enforcement rather than live in an Orwellian police state (a decision I'm thrilled with!).

False dichotomy. If all laws are fully enforced, bad laws will soon be done away with by popular demand. If the government won't do so willingly, then they will be forced to do so by the people.

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#348

Post by darawk »

nanocyber wrote: post #141

I thought this was an excellent write-up regarding how the iOS security platform (recent iPhone models) works from someone obviously in the know, as posted in the forums of Apple Insider. (Source: http://forums.appleinsider.com/discussion/191851 ) " Apple uses a dedicated chip to store and process the encryption. They call this the Secure Enclave. The secure enclave stores a full 256-bit AES encryption key. Within th…

In reading the IOS security guide, it's not clear to me that the device GID is actually left unrecorded. See here:

https://www.apple.com/business/docs/iOS_Security_Guide.pdf

> The UIDs are unique to each device and are not recorded by Apple or any of its suppliers. The GIDs are common to all processors in a class of devices (for example, all devices using the Apple A8 processor), and are used for non security-critical tasks such as when delivering system software during installation and restore.

The 'not recorded' explicitly refers only to UID, not GID. This means that in theory the GID is accessible and knowable to/by Apple. With this information, it should be possible to use a different processor in conjunction with the secure enclave that spoofs the correct GID.

Correct me if i'm wrong, but isn't this sufficient to bypass the time-delay and thereby unlock the phone?

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#349

Post by BWStearns »

Lawtonfogle wrote: post #347
BWStearns wrote: post #343

Earlier quoted context omitted.

It is unjust to jail Rick for jay walking and ignore that Morty jay walks. A system of partial enforcement is not intrinsically more just because we haven't jailed Morty. It's actually unjust because if Morty is free to jay walk then how can we justify locking up Rick if jay walking is the crime? We probably just like Rick less. Partial enforcement is a practical reality because we're willing to accept the injustice…

>Partial enforcement is a practical reality because we're willing to accept the injustice of partial enforcement rather than live in an Orwellian police state (a decision I'm thrilled with!). False dichotomy. If all laws are fully enforced, bad laws will soon be done away with by popular demand. If the government won't do so willingly, then they will be forced to do so by the people.

Can you clarify? I just said that bad laws would go away with full enforcement, which is the core of why it is good for a society to enforce its laws evenly and thoroughly.

I don't think there's any false dichotomy produced by simultaneously noting that on a practical level you will never achieve literally 100% enforcement of laws without some serious damage to civil liberties which is why we err on the side of partial enforcement as the lesser of two evils.

Edit: Is the issue is the use of the phrase "accept the injustice of partial enforcement"? I was trying to communicate that there is some injustice in not fully applying the law (the fact that some murderers go untried is unjust for instance). However we're willing to accept that because getting literally 100% enforcement would require things we don't want. When I say full enforcement as something to aspire to I'm not suggesting literally 100%, I'm referring to the way we roughly fully enforce murder laws and do not fully enforce drug laws. One of those crimes (more or less) gets treated as a crime regardless of who commits it, the other does not. I don't think we'd tolerate drug laws as they are if they were enforced with the same degree of universality as murder laws.

Re: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

#350

Post by tremon »

tremon wrote: post #283
tptacek wrote: post #263

Earlier quoted context omitted.

Exactly how do you know that the case is now "closed"? It sounds like you're just making an assumption. The state is too, but the cost of their assumption --- that there is valuable data to gather from the phone --- is very low, and the cost of your assumption, if you're wrong, is immense.

Please do keep up with the context :) I didn't feel the need to elaborate because my parent thought one word was sufficient, but let me state the full context to my thought process: > > > Do we have reason to believe that there is evidence of any pending crimes or any old unsolved crimes on the phone? > > 14 dead people and a stack of unused guns and bombs. > two dead attackers, stack confiscated. case closed. If the…

Nice. Next time I'll refrain from explaining myself.
Post reply on HN