Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Message to Our Customers

apple.com

Post reply on HN
Print view View original

981–990 of 1001 posts

Re: A Message to Our Customers

#981

Post by mikeash »

thirdsun wrote: post #975
mikeash wrote: post #636

Earlier quoted context omitted.

I don't buy it. The FBI is not trying to dictate how Apple builds their devices. They want Apple to take measures to unlock one device. How do they get from that to "[the government] would have the power to reach into anyone’s device to capture their data"? Apple seems to be saying that if the FBI can ask Apple to install special software on one person's phone, then they can ask Apple to install special software on e…

Your response feels very naive or short sighted. Or both. If this goes through, you better believe that there will be court orders left and right, which can't be authentically argued against since Apple has already done it before.

Court orders for what, exactly?

If there are legitimate court orders for cracking the security on the phones of criminal suspects, I don't have a problem with that.

The problem would be if:

1. A court orders Apple to crack the security on a phone they cannot actually crack (presumably any A7+ phone), and imposes some punishment for failing to do the impossible.

2. A court orders Apple to modify the design of their phones to make sure they are always crackable.

Those would be huge problems. But I don't see how you get from here to there.

Re: A Message to Our Customers

#982

Post by dr_zoidberg »

tossaway1 wrote: post #616
dr_zoidberg wrote: post #380

Earlier quoted context omitted.

Would you complain about Apple handing in information to solve the murder of a loved one? Why is it always the "bad government" argument? It's not that it doesn't happen, but usually those requests are aimed towards more "mundane" cases. For example, I have friends who work in law (though not in the US), and the number 1 data request -which is revised by a judge, and only then given by companies- are call logs from t…

I'm all for supporting law enforcement efforts, but the wording seemed to imply that Apple hands over any requested info to the FBI, which seems excessive. But I was mainly pointing out that quote because it wasn't clear what lesson the parent commenter wanted Google, Facebook, and Amazon to be learning from Apple. I would have guessed it'd have something to do with protection of user data, but the letter says they t…

They probably refer that they have handed all the information they could in this specific case. There surely was some kind of authorization (from a judge perhaps -- US law is almost unknown to me) too.

As for the comment of Google, Facebook, etc, learning, I agree with you.

Re: A Message to Our Customers

#983

Post by xlynx »

tamana wrote: post #968
the8472 wrote: post #770

Earlier quoted context omitted.

I think you're missing my point here. Some people trot the argument that it's OK for the government to compel apple to deliver the backdoored firmware because the measures it would circumvent are not of cryptographic/information-theoretical nature. Then one could expand that argument by saying that compelling physical reverse-engineering is also OK because the devices are not built to be physically impossible (read:…

The devices ARE built to be physically impossible to open without destroying their contents.

In security, impossible usually means "there is no documented method yet".

Re: A Message to Our Customers

#984

Post by bigolebutt666 »

Wouldn't one assume that once the phone is powered up there is some kind of code at startup or scheduled that would query an apple update server about updates,fixes,etc. At that point it is reasonable that a company such as Apple would force certain updates into the phone whether the customer wanted that or not? All Apple would have to do is direct the phone to a phoney update site containing code that would dump RAM to an outside server. No other phones would be affected and the data would be retrieved

Re: A Message to Our Customers

#985

Post by bigolebutt666 »

Wouldn't one assume that once the phone is powered up there is some kind of code at startup or scheduled that would query an apple update server about updates,fixes,etc. At that point it is reasonable that a company such as Apple would force certain updates into the phone whether the customer wanted that or not? All Apple would have to do is direct the phone to a phoney update site(for this IMEI only)containing code that would dump RAM to an outside server. No other phones would be affected and the data would be retrieved. World saved!

Re: A Message to Our Customers

#986

Post by dclowd9901 »

r00fus wrote: post #958
dclowd9901 wrote: post #658

Earlier quoted context omitted.

It's definitely one of those rare times doing the right thing is also the most profitable thing.

It's not necessarily the most profitable thing. Apple is picking a fight with a very big adversary. This takes some serious backbone.

I promise you, even a protracted legal battle is far cheaper than significant global sales losses.

Re: A Message to Our Customers

#987

Post by zobzu »

ThatPlayer wrote: post #198
clort wrote: post #100

Earlier quoted context omitted.

if they can create it, they have the capability.

They never say they can create it. They say the FBI wants them to create it, which may or may not be possible and is not addressed in this letter.

you've noticed auto updates yes?

Re: A Message to Our Customers

#988

Post by astrange »

Karunamon wrote: post #577
xgbi wrote: post #281

Earlier quoted context omitted.

iTunes recovery mode? It allows to restore the OS, but also gives you other means to manipulate the device. Imagine if they simply hot-patch the lockscreen to allow any number of tries of password?

Recovery mode with DFU and the like results in a device wipe. There are many ways to redo the firmware, but every single one of them, by design, requires wiping the phone to implement.

You can reinstall a phone from recovery mode without erasing it.

https://support.apple.com/en-us/HT201263

Re: A Message to Our Customers

#989

Post by zimpenfish »

sametmax wrote: post #978
zimpenfish wrote: post #560

Earlier quoted context omitted.

With open source software, it doesn't appear that people can verify things are safe either given the long-term security issues with things like OpenSSL et al.

We found the bug in OpenSSL BECAUSE it was opensource. If it weren't, nobody would have seen it. Plus, with open source you can verify intent, which you can't with apple. Which provide a device getting your finger prints, all your phone numbers, internet search, bank details, some paiements, network communication, voice communications, text communications, localisation using GPS and wifi + hotspot + phone towers and…

> We found the bug in OpenSSL BECAUSE it was opensource.

Sure but they were there for years before anyone noticed. Same with PHP's Mersenne Twister code. Same with multiple other long-standing bugs. It's disingenuous to toss out "Oh, if only it was open source!" because reality tells us that people just plain -don't- read and verify open source code even when it's critical stuff like OpenSSL.

Re: A Message to Our Customers

#990

Post by typeformer »

imh wrote: post #597
andreyvit wrote: post #419

Earlier quoted context omitted.

They state that they can push an update that makes brute-forcing possible by disabling software-enforced delays between attempts. Apple's security PDF says that the iteration count is calibrated so that one attempt takes 80ms in hardware, so that's the hard limit on the brute forcing speed, regardless of any updates Apple releases. This means that a long alphanumeric passphrase is secure, but a 6-digit passcode could…

It's so weird how hard it is for the brain to handle exponential growth. I was amazed that a 4-digit password can be cracked so quickly at 80ms a pop, but you're right. Just for the hell of it, here's how long it would take for different length passcodes for digits, digits plus letters (case insensitive), and digits plus letters (case sensitive): # characters [0-9] [0-9a-z] [0-9a-zA-Z] 1 0.8 seconds 2.9 seconds 5 sec…

According to Snowden, the NSA can brute force at the speed of over a trillion guesses a second, of course, they would need to be able to disable other security features first.
Post reply on HN