Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Justice Department Wants Data from About 12 Other iPhones

wsj.com

Post reply on HN
Print view View original

21–30 of 101 posts

Re: Justice Department Wants Data from About 12 Other iPhones

#21

Post by [deleted] »

nefitty wrote: post #7
wildmusings wrote: post #4

Earlier quoted context omitted.

That's not a justified fear. Requiring Apple to backdoor all phones is not similar at all to requiring Apple to help hack particular phones, that they have the capability to hack, in response to court orders.

You're telling me you would trust that software to remain in the hands of trusted actors? In 2015, alone, the IRS was breached, LastPass, the director of the CIA, Hacking Team, even Kaspersky Labs was breached! There can be no absolute guarantee that this backdoor would remain safe indefinitely. That is just the most blatant problem, not to mention the overt displays of cynicism and misuse of authority by the NSA as…

[deleted]

Re: Justice Department Wants Data from About 12 Other iPhones

#22

Post by [deleted] »

nefitty wrote: post #7
wildmusings wrote: post #4

Earlier quoted context omitted.

That's not a justified fear. Requiring Apple to backdoor all phones is not similar at all to requiring Apple to help hack particular phones, that they have the capability to hack, in response to court orders.

You're telling me you would trust that software to remain in the hands of trusted actors? In 2015, alone, the IRS was breached, LastPass, the director of the CIA, Hacking Team, even Kaspersky Labs was breached! There can be no absolute guarantee that this backdoor would remain safe indefinitely. That is just the most blatant problem, not to mention the overt displays of cynicism and misuse of authority by the NSA as…

[deleted]

Re: Justice Department Wants Data from About 12 Other iPhones

#24

Post by rebootthesystem »

I had a really bad experience with an iPhone update and a password storage app.

I had been running my iPhone on iOS 8.x. No need to update to 9.x.

The day finally came when I was forced to allow the update.

Now, without my knowledge the update also enabled automatic updates of apps. All apps were thus updated to their latest versions without my explicit consent.

I chose the app I am using to keep hundreds of account passwords specifically because they DID NOT transmit anything over the internet at the time I got it. I could do what they called "wifi sync" to synchronize and backup my database to the desktop version of the same software running on my PC within the same network.

Well, with the forced update "wifi sync" went away and now the only option is "internet sync". I did not realize this whe the app ran through and synchronized to my PC.

So now the dilema. This fucking company is doing this because they want to sell cloud storage for your data and force you into an annual subscription in order to be able to "internet sync". And, of course, the huge violation of the security of my data which, up until the unauthorized automatic update, had been kept private and never left my network.

Not only do I have to find a new password and data vault that will not try to take ownership of my data and pull a bait-and-switch after, I also need to change every simgle password I have due to my database now being in their cloud.

Unbelievable.

Re: Justice Department Wants Data from About 12 Other iPhones

#25

Post by lazaroclapp »

wildmusings wrote: post #13
nefitty wrote: post #7

Earlier quoted context omitted.

You're telling me you would trust that software to remain in the hands of trusted actors? In 2015, alone, the IRS was breached, LastPass, the director of the CIA, Hacking Team, even Kaspersky Labs was breached! There can be no absolute guarantee that this backdoor would remain safe indefinitely. That is just the most blatant problem, not to mention the overt displays of cynicism and misuse of authority by the NSA as…

So would it be okay for the FBI to have to bring the phone to Apple?

Only if you think Apple should be an unhackable "trusted actor".

Let's face it, the fact that Apple can be compeled to create this bypass is a civil rights issue, but the fact that it can create it at all is already a security bug. One that, in their defense, they seem to be trying to patch a step at a time in newer versions of their devices.

Re: Justice Department Wants Data from About 12 Other iPhones

#26

Post by nefitty »

wildmusings wrote: post #13
nefitty wrote: post #7

Earlier quoted context omitted.

You're telling me you would trust that software to remain in the hands of trusted actors? In 2015, alone, the IRS was breached, LastPass, the director of the CIA, Hacking Team, even Kaspersky Labs was breached! There can be no absolute guarantee that this backdoor would remain safe indefinitely. That is just the most blatant problem, not to mention the overt displays of cynicism and misuse of authority by the NSA as…

So would it be okay for the FBI to have to bring the phone to Apple?

The main point here is that neither the government nor Apple could guarantee that this backdoor software would remain safe. If the FBI brought the phone to Apple to update the custom OS, the software would then exist, which is inherently a dangerous situation. Furthermore, suddenly a precedent is set wherein Apple is obliged to continue unlocking phones for the government with custom created software. I sincerely doubt any organizations involved would tolerate the continual creation and destruction(can data be truly destroyed?) of customized OS's each time the government needed access to a phone. That means, the incentive is to create and maintain this backdoored version of the OS, setting up the exact vulnerability Apple is trying to fend off.

Basically, this project, from whatever angle it is approached, has a non-zero chance of backfiring dramatically thus risking the security and privacy of millions of iPhone users throughout the world.

Re: Justice Department Wants Data from About 12 Other iPhones

#27

Post by microtonal »

wildmusings wrote: post #13
nefitty wrote: post #7

Earlier quoted context omitted.

You're telling me you would trust that software to remain in the hands of trusted actors? In 2015, alone, the IRS was breached, LastPass, the director of the CIA, Hacking Team, even Kaspersky Labs was breached! There can be no absolute guarantee that this backdoor would remain safe indefinitely. That is just the most blatant problem, not to mention the overt displays of cynicism and misuse of authority by the NSA as…

So would it be okay for the FBI to have to bring the phone to Apple?

Don't you see the slippery slope here? Next, the German or French police will knock on Apple's door. When they get access, China, Russia, and others will line up next.

Moreover, who says that the FBI or some other agency will stop after this iPhone, or the next 12 iPhones. Why not push to get their own signing key after they succeed in this case? They will try to get as far as possible.

We live in 2016. many of our devices with our private data are directly addressable from anywhere in the world. Intentionally weakening encryption and security in any way is a dangerous proposition.

It's good that Apple fights this tooth and nail. Sure, it may align up with their PR. I don't care, it benefits every citizen of the net who wants privacy and security.

Re: Justice Department Wants Data from About 12 Other iPhones

#28

Post by nefitty »

abecedarius wrote: post #15
nefitty wrote: post #11

Earlier quoted context omitted.

This could be possible if at setup time the user was asked to create their own key, which any update would have to be signed with. This would then unburden Apple of having the "master key" needed to sign software updates, but would create an extra hoop for users to jump through to update their phone. I'm sure we've all experienced putting off a necessary update to software because of the inconvenience it would cause.…

Presumably you could set up to automatically sign anything signed by Apple, if that tradeoff suits you.

The security issue of Apple being vulnerable to being compelled to create signed backdoors would still remain, in that case.

Re: Justice Department Wants Data from About 12 Other iPhones

#29

Post by the8472 »

avn2109 wrote: post #8

Question for HN in general: Is it possible in principle (for Apple or someone else) to construct a smartphone that can accept software/firmware updates, but that Apple cannot push malware to at some later time? E.g. can we implement all security functionality in hardware/burn it into the silicon? Or accomplish the same ends by some other means? Intuition says "no," because "security functionality" is sort of nebulous…

That's not necessary. Simply tying the encryption to a strong password instead of a 4-digit PIN would have been sufficient to prevent a firmware update to a locked device from weakening security, at least in this particular case.

Throw in a memory-hard key derivation function to make parallel brute-force more expensive.

Re: Justice Department Wants Data from About 12 Other iPhones

#30

Post by [deleted] »

wildmusings wrote: post #13
nefitty wrote: post #7

Earlier quoted context omitted.

You're telling me you would trust that software to remain in the hands of trusted actors? In 2015, alone, the IRS was breached, LastPass, the director of the CIA, Hacking Team, even Kaspersky Labs was breached! There can be no absolute guarantee that this backdoor would remain safe indefinitely. That is just the most blatant problem, not to mention the overt displays of cynicism and misuse of authority by the NSA as…

So would it be okay for the FBI to have to bring the phone to Apple?

[deleted]
Post reply on HN