"This is a specific case where the government is asking for access to information. They are not asking for some general thing, they are asking for a particular case" --Bill Gates
Have something to say, Bill?
Justice Department Wants Apple to Unlock Nine More iPhones
161–170 of 314 posts
Re: Justice Department Wants Apple to Unlock Nine More iPhones
#162Earlier quoted context omitted.
Apple does not have the key for that phone. No one does. What the FBI is asking Apple to do is write software that will turn off the "wipe after 10 wrong passcodes" feature of iOS, so that the passcode can be brute-forced. Setting aside the government's interest in such a tool, imagine the interest from hackers. Consider that in 2011, someone hacked into RSA to steal info about their tokens, just so that they could t…
If what you say is true, then I agree with you. Though I find it hard to believe that Apple doesn't already keep some sort key(s) to unlock individual phones or to turn off this "wipe after 10 wrong passcodes" feature. Facebook (and pretty much every other internet company on earth) keeps password hashes and salts in their databases - So in theory, the government could already brute force the vast majority of our per…
No need to brute force Facebook or most other hosted services, because very few of them store user data encrypted at rest.
Passwords control access to features of the web application, but employees of the company can just go around that and get the data off the server directly.
iPhones running iOS 8 or higher are different--they do encrypt data at rest, and create the key by combining device-specific info with the passcode that the user creates. So without that passcode, no chance to decrypt without brute forcing.
Re: Justice Department Wants Apple to Unlock Nine More iPhones
#163I know this is going to sound crazy, but there are parallels here between Apple vs. the FBI, and Superman vs. Batman. Superman represents an unchecked power, and Batman finds this unchecked power to be unacceptable as a risk, in case the power is ever used against humanity. Is this a subtle marketing ploy from DC Comics‽
Superman vs. Batman, they are making a new movie about that.
Superman caused a lot of damage in The Man of Steel movie and many people died as a result of his fight with Zod that ended up with him breaking Zod's neck and killing him. The movie could have gone a different way if he asked his Father's hologram about Zod, and any weaknesses he might have during the 24 hours he had to think over. Then use the craft he came to Earth with to destroy Zod's ship engines, defeating him without any property damage or killing innocent people.
But anyway Batman always has a plan in taking down any super powered being in case they go rouge or mind controlled. He stores them on his computer and makes technology or finds items that can weaken them or take away their powers.
For Superman he has a battlesuit and kryptonite. The battlesuit gives him strength and power to fight Superman and the kryptonite weakens Superman so Batman can fight him.
Yet in The Dark Knight, Batman used a program to use everyone's cell phone to create a spying device that gave hi the location of the criminals Joker employed and where the victims are. Sort of abusing his own powers for domestic spying and making cell phones insecure by infecting them with an exploit that installs his own backdoor to get access to the cameras etc to scan for things.
Re: Justice Department Wants Apple to Unlock Nine More iPhones
#164Earlier quoted context omitted.
This makes a lot of sense since the government could issue an order through FISA and afaik apple would be required to comply with it. The fact that they can resist the order and in a such a public way feels a little bit theatrical, given what we know about how these things work. I wonder how much of what's happening between apple and the fbi / rest of the government is the tip of the iceberg.
> The fact that they can resist the order and in a such a public way feels a little bit theatrical, given what we know about how these things work. I wondered that too. I read that Apple wanted to keep the debate quiet, and that it was the FBI who wanted to have a public debate. Anyway, here we are having the "public debate about security vs. privacy on computers" FBI sympathizers complain that some people are talkin…
> Anyway, here we are having the "public debate about security vs. privacy on computers"
What I think we're having is a debate about access vs. security.
The government wants access to be more important than information security.
Apple, and I guess people educated on the topic who aren't the government, want information security to be more important than access.
If one actor has a magic key to a system, n actors have that key because logic and the faliability of human systems. The government has proven too often that information security is not its chief concern, and we should expect they'll not perfectly protect the capability they're asking for as well.
Do we care to keep information safe, or "safe"? I think that's what the legislature is going to have to decide.
Re: Justice Department Wants Apple to Unlock Nine More iPhones
#165Might criminals, paranoids and privacy extremists wishing for their phones never to be cracked, just choose an 11 digit passcode? I hear this would take too long for a computer to crack.
Everyone else can choose a 4 digit code, and still enjoy very good security up until the point they are wanted by the FBI.
People are confusing the fight for unbreakable encryption with this new fight to keep manufacturer-specific passcode retry attempts nice and secure.
The very fact we have this dependency between the encryption and the retry system, is a weakness probably deserving of attention.
Re: Justice Department Wants Apple to Unlock Nine More iPhones
#166I still like BGs argument (and do consider myself a hacker haha)
"It is no different than [the question of] should anybody ever have been able to tell the phone company to get information, should anybody be able to get at bank records. Let’s say the bank had tied a ribbon round the disk drive and said ‘don’t make me cut this ribbon because you’ll make me cut it many times’.“
(https://www.yahoo.com/tech/bill-gates-says-apple-unlock-0451...)
Re: Justice Department Wants Apple to Unlock Nine More iPhones
#167Earlier quoted context omitted.
This is dangerously naive. You think the government can't do something illogical? You just wait for it. You think the government can't outlaw the use of something, even if it's an ineffectual half-measure that does more harm than good? Were you alive during the "War on Drugs"?
If you studied history they passed prohibition that banned alcohol. It did not work as bootleggers and gangsters would make their own alcohol and sell it at hidden clubs. Stores would sell fruit juice next to sugar and yeast and all the customer had to do was find a way to mix them to make alcohol. They eventually had to repeal Prohibition. When they banned drugs, they did the same thing. It is prohibition all over a…
Maybe if normals care enough about privacy to make a big deal out of any attempt to breach privacy it would be different.
but as it is they just shrug and say "i got nothing to hide"
smh
Re: Justice Department Wants Apple to Unlock Nine More iPhones
#168The article describes the Justice Dept. doing exactly what has been so widely predicted on HN and elsewhere. Doesn't seem like good timing on the government's part to publicly announce the intention to seek numerous iPhone "unlockings". Rather it plays into Apple's argument about unleashing a torrent of court-ordered demands which will have adverse consequences for security. Legal minds should weigh in, but I'm think…
It makes total sense that the givernment would use it's forensic capabilities whenever the need arises. The question at hand is: "can the All Writs Act compel a company to proactively defeat its own security measures?" The answer will apply to all cases. The more important question is "Should the government be able to access citizen's digital data with a court order? And if so, how can that be enabled without comprom…
> The more important question is "Should the government be able to access citizen's digital data with a court order? And if so, how can that be enabled without compromising the general security of the device?
The government already does have access to these citizens' data. That data simply has the quality of having been encrypted.
If I have printed encrypted text and lock it in my home safe, when the government gets a court order to search my house, they'll have complete access to those documents. They can't compel me to decipher those documents though, it's on them to break the encryption.
It's the same situation here. Here, Apple may be able to perform that decription service for the government.
The question to me is, should the government be legally able to press a person or firm into service?
Re: Justice Department Wants Apple to Unlock Nine More iPhones
#169Earlier quoted context omitted.
And if the Apple master key is ever revealed or stolen, everyone's phone can be decrypted. So yeah, this plan still compromises the general security of the device.
As is the case with Apple's software certifier key. AFAIK this is what we currently have to assume since Apple doesn't specify how the update process for the secure enclave works. If this is the case it doesn't change anything, the certifier key is already like a master key.
Replacing the firmware (Secure Enclave or not) with a version that doesn't include rate-limits and auto-wipe isn't the same as having a crypto backdoor. Right now, your data is still protected by the complexity of your passphrase. This is not true for your scenario.
Re: Justice Department Wants Apple to Unlock Nine More iPhones
#170Earlier quoted context omitted.
It makes total sense that the givernment would use it's forensic capabilities whenever the need arises. The question at hand is: "can the All Writs Act compel a company to proactively defeat its own security measures?" The answer will apply to all cases. The more important question is "Should the government be able to access citizen's digital data with a court order? And if so, how can that be enabled without comprom…
> "Should the government be able to access citizen's digital data with a court order? And if so, how can that be enabled without compromising the general security of the device? IMO yes and here is how I'd implement this given a secure enclave: 1) Have Apple generate a device specific key that unlocks the device without pass code. 2) The key gets encrypted with an Apple held master key and printed on the inside of th…
4) The process for accessing the data on a specific device becomes simple - law enforcement needs to be in possession of (A) the device and (B) a court order. Apple will decrypt the key if forced by court order.
I think, we can assume that up till now, Apple has its private keys protected on some disconnected machine in a HSM, perhaps multiple HSMs, that are only accessible with very restricted access. When there is a gold iOS build, some of the key personal will go through a security procedure to get the build signed.
Now suppose that such a procedure is put in place. And you get requests from US courts and Western European courts[1]. Once it's there, there will probably be hundreds, perhaps thousands of daily requests. It suddenly becomes undoable to keep the same security procedures. More people need access to the master key to handle all the requests for which there is a court order. Or even worse: there has to be an semi-automated procedure to handle such requests.
In any case, any such procedure will weaken the security of iOS devices significantly. Since Apple's master key is so extremely valuable, it will be an extremely attractive target for attacks (in the semi-automatic scenario); or it's easier to find a corrupt person to leak the keys.
Since people store anything from personal photos, access to bank accounts, to business plans on their phones, we should move into the direction of making crypto systems stronger, not intentionally weakening them.
[1] Let's avoid the slippery slope that this would trigger for not-so-nice regimes for a moment. Although, once such a backdoor is there, it will happen.