Justice Department Wants Apple to Unlock Nine More iPhones • Hacker News Board

Re: Justice Department Wants Apple to Unlock Nine More iPhones

#121

Post by zaroth » Wed, Feb 24, 2016, 5:38 AM UTC

vectorjohn wrote: post #85

ubernostrum wrote: post #71

Earlier quoted context omitted.

The legal question here is really whether the All Writs Act can be used to compel development of new products with specific features law enforcement desires, because that's what it boils down to: they want a custom iOS build with custom security-bypass features that can be loaded onto any phone they want to snoop into. And when framed like that -- government ordering a private company, without negotiation or contract…

How is it different than getting a phone company to install a wire tap? What you describe is not what's being asked for. What the FBI wants is a tool to get into this phone. They will definitely want to get into more phones in the future, but that's not the same as a single tool that gets into any phone. It can be a new one every time. If it wasn't possible to make such a tool, I'd be a lot more outraged. But it is.…

The difference is simply that telecommunications are heavily regulated (see CALEA) where if you want to be a service provider you have to provide wiretap functionality.

Personal computers in general are not covered by any such regulation. It is legal to create and use encryption on your own device without building in a government backdoor. For now.

Re: Justice Department Wants Apple to Unlock Nine More iPhones

#122

Post by abruzzi » Wed, Feb 24, 2016, 5:39 AM UTC

Shivetya wrote: post #13

Well the spin game is guaranteed to ramp up. Sycophants are already laying the ground that Apple and Cook would have to accept some of the blame in any upcoming terrorist attacks. I am amazed they haven't tried the kiddie porn route yet. Still another issue is, if they were compelled to create it they could be compelled to surrender it too. With that its a matter of weeks or months before it gets leaked to a criminal…

This is pure hypothetical, but I've wondered what would happen if apple were to lose in court, then make this custom iOS signed to work only on the specific phone in question, and provide the installer to the FBI with a bill for $5 million in development time. Then destroy all source on this special version, stating that they don't feel comfortable having that in their source tree since a rogue employee might leak it. Then the next time there is a phone to crack, they build the custom version again, an provide it to the FBI with another $5 million bill for services rendered since all development would have to be done from scratch. That would at least provide a bar that law enforcement would have to pay, rather than simply thinking once the cost is born once, future versions are cheap like $10k.

Re: Justice Department Wants Apple to Unlock Nine More iPhones

#123

Post by semi-extrinsic » Wed, Feb 24, 2016, 5:42 AM UTC

fooey wrote: post #109

It seems hard for me to believe that Apple now has at least 10 instances where the government is trying to force them to decrypt their phones, and this hasn't happened with Google or MS yet. I don't recall ever hearing a big standoff with MS refusing to decrypt a Windows desktop or server. Is encryption just that much more common on Apple devices? or is Apple just the first ones to make this all public?

Windows desktop full-disk encryption means Bitlocker, which is basically breakable by anyone who can google stuff and buy the right firewire cable:

https://github.com/carmaa/inception

Note that this is the open source, made by one guy in his spare time version, so it has some caveats. But I'll bet you dollars to donuts that the three-letter agencies have their own, more capable version.

Re: Justice Department Wants Apple to Unlock Nine More iPhones

#124

Post by tdaltonc » Wed, Feb 24, 2016, 5:42 AM UTC

fooey wrote: post #109

It seems hard for me to believe that Apple now has at least 10 instances where the government is trying to force them to decrypt their phones, and this hasn't happened with Google or MS yet. I don't recall ever hearing a big standoff with MS refusing to decrypt a Windows desktop or server. Is encryption just that much more common on Apple devices? or is Apple just the first ones to make this all public?

It wasn't apples choice really. This is just the first time they've been asked in a public trial. Who knows how many times they (and others) have been asked in a FISA court.

Re: Justice Department Wants Apple to Unlock Nine More iPhones

#125

Post by LeoPanthera » Wed, Feb 24, 2016, 5:48 AM UTC

fooey wrote: post #110

cft wrote: post #19

Note how Android unlocking demands never came up in this discussion. That's because the phones are vulnerable. I am a Nexus user.

Android hasn't come up, but more notable to me, why hasn't this come up over Windows machines? Bitlocker has been a thing for quite a while now. Has the FBI/DoJ never encountered an encrypted desktop or server before? or has it not been a problem when they have?

It has been widely speculated that Bitlocker has some kind of back door, or master key. It's a closed system you can never prove it either way.

Re: Justice Department Wants Apple to Unlock Nine More iPhones

#126

Post by fooey » Wed, Feb 24, 2016, 5:48 AM UTC

semi-extrinsic wrote: post #123

fooey wrote: post #109

It seems hard for me to believe that Apple now has at least 10 instances where the government is trying to force them to decrypt their phones, and this hasn't happened with Google or MS yet. I don't recall ever hearing a big standoff with MS refusing to decrypt a Windows desktop or server. Is encryption just that much more common on Apple devices? or is Apple just the first ones to make this all public?

Windows desktop full-disk encryption means Bitlocker, which is basically breakable by anyone who can google stuff and buy the right firewire cable: https://github.com/carmaa/inception Note that this is the open source, made by one guy in his spare time version, so it has some caveats. But I'll bet you dollars to donuts that the three-letter agencies have their own, more capable version.

Well then, that's pretty gross.

Maybe this whole thing will turn out to be a giant Streisand Effect that gets even more people using encryption and call out the companies who aren't doing a good job.

Re: Justice Department Wants Apple to Unlock Nine More iPhones

#127

Post by huuu » Wed, Feb 24, 2016, 5:50 AM UTC

edraferi wrote: post #73

jrapdx3 wrote: post #65

The article describes the Justice Dept. doing exactly what has been so widely predicted on HN and elsewhere. Doesn't seem like good timing on the government's part to publicly announce the intention to seek numerous iPhone "unlockings". Rather it plays into Apple's argument about unleashing a torrent of court-ordered demands which will have adverse consequences for security. Legal minds should weigh in, but I'm think…

It makes total sense that the givernment would use it's forensic capabilities whenever the need arises. The question at hand is: "can the All Writs Act compel a company to proactively defeat its own security measures?" The answer will apply to all cases. The more important question is "Should the government be able to access citizen's digital data with a court order? And if so, how can that be enabled without comprom…

We also will wind up (already have) with more smart terrorists who hide data in better places. So the only people who lost are we (again).

Re: Justice Department Wants Apple to Unlock Nine More iPhones

#128

Post by awesomepantsm » Wed, Feb 24, 2016, 5:51 AM UTC

edraferi wrote: post #73

jrapdx3 wrote: post #65

The article describes the Justice Dept. doing exactly what has been so widely predicted on HN and elsewhere. Doesn't seem like good timing on the government's part to publicly announce the intention to seek numerous iPhone "unlockings". Rather it plays into Apple's argument about unleashing a torrent of court-ordered demands which will have adverse consequences for security. Legal minds should weigh in, but I'm think…

It makes total sense that the givernment would use it's forensic capabilities whenever the need arises. The question at hand is: "can the All Writs Act compel a company to proactively defeat its own security measures?" The answer will apply to all cases. The more important question is "Should the government be able to access citizen's digital data with a court order? And if so, how can that be enabled without comprom…

>Should the government be able to access citizen's digital data with a court order?

I don't think that's a good question at all. Regardless of the ruling, they aren't going to up and declare encryption illegal. You can't throw a legal requirement at math to stop working.

Re: Justice Department Wants Apple to Unlock Nine More iPhones

#129

Post by zaroth » Wed, Feb 24, 2016, 5:51 AM UTC

jMyles wrote: post #119

mrdrozdov wrote: post #112

Earlier quoted context omitted.

Apple can hypothetically upload an OS update enabling unlimited password attempts, so that the encryption key can be brute forced.

Right - so that means that the iPhone is already broken, no? ...and, more to the point: when phones come out that don't have this vulnerability, none of this will matter, right?

The specific technique/functionality they are asking for in this case most likely only works on the 5c, but there are also reports that the auto-wipe on the 6s which is handled by the secure enclave could also be disabled on a locked phone.

Even if both of these particular vulnerabilities are closed, it's almost a guarantee that additional vulnerabilities exist which Apple could be forced to exploit.

The next best example is perhaps police forcing Apple to wiretap iMessages in real-time. They have tried countless times and Apple has said they do not have the capability and refused to create it. But it is clearly technically possible from the design. Closing that vulnerability would require significant changes to the iMessage UX. Some people argue we can't trust Apple and they should make those changes in any case, but obviously Apple is willing to impose some level of trust in their own infra in order to gain UX advantages.

Re: Justice Department Wants Apple to Unlock Nine More iPhones

#130

Post by jondubois » Wed, Feb 24, 2016, 5:52 AM UTC

snowwrestler wrote: post #113

jondubois wrote: post #102

Earlier quoted context omitted.

What tool? Apple can just give the government the private key for that specific phone. Done. Everyone else is still safe. Safer, I might add. So long as there is a clear process for the government to get access to specific keys for specific phones. If Apple is CAPABLE of building such a tool (and use it for themselves), then I think the government should have access to it too.

Apple does not have the key for that phone. No one does. What the FBI is asking Apple to do is write software that will turn off the "wipe after 10 wrong passcodes" feature of iOS, so that the passcode can be brute-forced. Setting aside the government's interest in such a tool, imagine the interest from hackers. Consider that in 2011, someone hacked into RSA to steal info about their tokens, just so that they could t…

If what you say is true, then I agree with you.

Though I find it hard to believe that Apple doesn't already keep some sort key(s) to unlock individual phones or to turn off this "wipe after 10 wrong passcodes" feature.

Facebook (and pretty much every other internet company on earth) keeps password hashes and salts in their databases - So in theory, the government could already brute force the vast majority of our personal data from these websites.

At least with a phone, the government has to physically get a hold of it in order to brute force the phone and read the data.