Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Message to Our Customers

apple.com

Post reply on HN
Print view View original

841–850 of 1001 posts

Re: A Message to Our Customers

#841

Post by progressive_dad »

nostrademons wrote: post #811
ghayes wrote: post #124

Earlier quoted context omitted.

> with the exception that providing an easy means to brute force a phone to the authorities sets a horrible precedent This is the entire concern (in my opinion and in my reading of Tim Cook's opinion). If the government can force Apple to backdoor this one iPhone (because terrorist), then they can force Apple to backdoor any iPhone for any person given a valid warrant, subpoena or otherwise granted power. Once the fl…

It's worse than that. There's no guarantee that "the government" is "your government". Imagine this scenario: 1.) Apple creates the custom iOS build for the FBI to use to decrypt this iPhone. 2.) China hacks into either Apple or the FBI and downloads this build. (We know they have the capability, because it's already happened. [1]) 3.) A visiting U.S. diplomat, politician, or military officer has his iPhone pickpocke…

> knowledge of how you would bypass the device encryption is locked up in the heads of several engineers there

WARNING — THIS Apple Engineer IS CLASSIFIED AS A MUNITION --rsa--------------------------------8-^1[d2% Sa2/d0La1=z\U$n%0]SX$k"[$m]\EszlXx++p|dc`,s/^.|\W//g,print pack('H' ,$_)while read(STDIN,$m,($w=2*$d-1+length($n||die"$0 [-d] k n\n")&~1)/2) -------------------------------------8<------------------------------------- TRY: echo squeamish ossifrage | rsa -e 3 7537d365 | rsa -d 4e243e33 7537d365 FEDERAL LAW PROHIBITS TRANSFER OF THIS APPLE ENGINEER TO FOREIGNERS

Re: A Message to Our Customers

#842

Post by lawnchair_larry »

leesalminen wrote: post #834
mapmap wrote: post #827

Earlier quoted context omitted.

"I don't want to be deposed" I'm not familiar with that phrase. What does it mean in this context?

A deposition in the American judicial system is a legal proceeding in which a witness provides testimony to the courts. The witness may be examined by members of either sides legal team. This is a routine proceeding in civil cases. [0] Interestingly, people usually don't want to be deposed when they have something to hide. [0] http://litigation.findlaw.com/filing-a-lawsuit/what-is-a-dep...

No, people don't want to be deposed because they want to do their job and mind their own business, instead of get pulled in to a national spectacle, be inconvenienced with new travel plans that require child care arrangements or other disruptions, and potentially face stressful scrutiny on record.

Re: A Message to Our Customers

#843

Post by jonathankoren »

leesalminen wrote: post #834
mapmap wrote: post #827

Earlier quoted context omitted.

"I don't want to be deposed" I'm not familiar with that phrase. What does it mean in this context?

A deposition in the American judicial system is a legal proceeding in which a witness provides testimony to the courts. The witness may be examined by members of either sides legal team. This is a routine proceeding in civil cases. [0] Interestingly, people usually don't want to be deposed when they have something to hide. [0] http://litigation.findlaw.com/filing-a-lawsuit/what-is-a-dep...

> Interestingly, people usually don't want to be deposed when they have something to hide.

You know who really talks a lot about their rights? Terrorists.

Re: A Message to Our Customers

#844

Post by sandworm101 »

berkeleynerd wrote: post #779

A friend of mine at Apple reported multiple Black Vehicles (Lincoln Town Cars and Escalades) with at least one having MD License Plates at the Apple Executive Briefing Center this morning between 11AM and Noon. Occupants had ear pieces and sun glasses and were accompanied by a CHP (California Highway Patrol) cruiser and three motorcycle escorts. I suppose it's possible this was a quick (less than 1 hour) VIP stop but…

Many Apple employees are not allowed to refuse. I suggest that any employee, especially those on any sort of work visa or with any connection to the military/intel community, seek legal advice prior to signing or saying anything. There are big forces involved here that will not hesitate to squash/fire/blacklist little people.

Re: A Message to Our Customers

#845

Post by tlrobinson »

ajross wrote: post #639
d_theorist wrote: post #619

Earlier quoted context omitted.

This is not really true. The secure enclave is a separate computer. It doesn't get software updates. > possibly with the addition of a judicially compelled fingerprint scan or PIN brute force to get the encryption key out of whatever on-device escrow it's stored in This is the whole problem. The keys are in the SE. You can't brute force the PIN because the SE rate-limits attempts (and that rate limiting cannot be ove…

Is that really true? The enclave's firmware is in ROM and non-upgradeable? I'd always assumed it got a signed blob like everything else does. Obviously it's possible to design a system like that, I just haven't seen it reported anywhere that it actually works like that. Edit just to be clear: the requirement really is that the firmware be stored in a ROM somewhere, probably on the SoC. That's a lot of die space (code…

The "bootstrap security engine" could store a hash of the blob in it's secure flash storage, and only update the hash if the user enters their pin, then reload the firmware blob. If the stored hash and blob hash ever don't match on boot, wipe the keys.

Re: A Message to Our Customers

#846

Post by HappyTypist »

em3rgent0rdr wrote: post #802
fixermark wrote: post #483

Earlier quoted context omitted.

I can't disagree with your point of view; I merely point out that a world where everyone who wants a secure smartphone needs to own their own smartphone factory isn't a very practical world.

Only needs to have access to software source code, and presumably a way to verify the binaries match. Not an entire factory.

They also need to verify the hardware does what it's supposed to do, and the CPU doesn't have secret opcodes.

Re: A Message to Our Customers

#847

Post by programmarchy »

Merad wrote: post #700

What's the potential fallout on this case? I assume Apple is appealing the ruling - what happens if the ruling is upheld and Apple refuses to comply (unlikely IMO, but what if)? Could the DOJ target individual Apple engineers and order them to do it or face contempt of court charges?

Yeah, even if the DOJ ordered Apple the corporation, ultimately they would still have to force one or more Apple engineers to perform the task. That seems messed up. Would the Apple engineer at least have the option to quit?

Re: A Message to Our Customers

#848

Post by matthew-wegner »

rcthompson wrote: post #839

I see a lot of discussion about "Secure Enclave" and other hardware security features and such, and I'm not sure I see the relevance. Assuming that the data has already been properly encrypted, stored on disk, and purged from memory (by shutting down the phone) by a version of iOS that did not already contain a backdoor when the data was encrypted, there's no magic combination of hardware and software that can decryp…

Yes. The target phone, an iPhone 5C, lacks a Secure Enclave.

The password retry delay, and subsequent deletion of keys, is enforced by iOS here. Apple could provide some kind of software to allow for unlimited attempts (and an interface to do so in an automated way, which the FBI is specifically asking for).

On newer phones, the Secure Enclave contains the keys, and enforces both the retry delay and the deletion of its contents. There isn't a way around this without also upgrading/flashing the SE system (and it isn't even clear if Apple can do this in a way that preserves the keys).

Re: A Message to Our Customers

#849

Post by rudolf0 »

yung_badlady wrote: post #813
rudolf0 wrote: post #794

Earlier quoted context omitted.

Nothing. Bringing a bunch of special agents along with you to a meeting is intimidating, though. I suppose in their defense, they may be the particular agents working on the San Bernadino case, who arrived to explain exactly why they need the access or whatever.

> Bringing a bunch of special agents along with you to a meeting is intimidating Again, what is intimidating about that? The agency they were dealing with was the FBI, right? And that's the correct agency to deal with this matter, right? Well in the FBI, 'special agent' simply means any worker who does investigatory work.

You would expect the higher level officers and directors to be in plain clothes, normally.

Re: A Message to Our Customers

#850

Post by amalcon »

paraxisi wrote: post #836
leesalminen wrote: post #834

Earlier quoted context omitted.

A deposition in the American judicial system is a legal proceeding in which a witness provides testimony to the courts. The witness may be examined by members of either sides legal team. This is a routine proceeding in civil cases. [0] Interestingly, people usually don't want to be deposed when they have something to hide. [0] http://litigation.findlaw.com/filing-a-lawsuit/what-is-a-dep...

> Interestingly, people usually don't want to be deposed when they have something to hide. That's a pretty... er, dubious claim at best?

I mean, it's an accurate statement. It's just also true that people usually don't want to be deposed even if they have nothing to hide. The "when they have something to hide" part is just superfluous.
Post reply on HN