Silly question, but what would you suppose Apple would do if this were a branch of the Chinese govt asking for this?
Justice Department Wants Apple to Unlock Nine More iPhones
201–210 of 314 posts
Re: Justice Department Wants Apple to Unlock Nine More iPhones
#202Earlier quoted context omitted.
> "[...] to more easily break into [...] That's where your analogy breaks down. This hardly makes it easier. If North Korea or FBI or NSA or a criminal organization wanted to break into your iPhone, and this backdoor existed and was distributed, they would have to externally flash it with firmware and then hook up a controller that tricks the digitizer so that they can brute force the passcode, trying each one synchr…
Yes, else this would be happening. The passcode is not the complete key, and there's a reason the Secure Enclave is named that way.
The 5C has no secure enclave.
Re: Justice Department Wants Apple to Unlock Nine More iPhones
#203The discussion about encryption is getting completely out of context, like 'encryption' is something magical. We're talking about cracking a 4 digit access code of a phone, which is extremely easy. Apple knows this, that's why they set a digital booby trap which fires after 10 tries. So the real discussion should be, "Can the government force a company who placed a booby trap, to remove that same trap if needed?" Whe…
> We're talking about cracking a 4 digit access code of a phone, which is extremely easy.
Technically, it's obviously not just a 4-digit access code that prevents FBI to unlock the phone, otherwise they wouldn't demand Apple to produce the whole new version of their iOS and setup them special access only to enable that.
And even more important, the legal basis they claim to have is the "we can do anything" sentence from 1789:
https://news.ycombinator.com/item?id=11165699
There's nothing about the obligation of companies to do something specific there, certainly not about changing their own products or making the new ones.
Re: Justice Department Wants Apple to Unlock Nine More iPhones
#204I've already made my legal and political opinions in other threads on the topic and won't rehash them here, especially since so many other people are making the points better than I did.
However, here's something I haven't thought of, though I sort of hate to boil the thing down to a business proposition. The fact is that iPhone is a massive business. What all is a company allowed to claim as "burden" in the discussion of undue burden?
Let's say the FBI wins, and Apple is forced into this. Then the narrative in the mind of the public is that Apple has back-doored their phones and made them insecure.
Apple loses literally billions of dollars per quarter for some amount of time until they can repair the PR damage.
Is the loss of, say, 50 billion dollars in revenue over the next calendar year something a reasonable person would call "undue burden?"
What about other ancillary effects that cost either direct money or productivity? There are rumors of something like an iPhone 6c that is scheduled to be released perhaps soon. (Supposedly a revamped 4" phone like the 5s but with the latest hardware) After all this hubbub about a potentially insecure 5c, who is going to go buy a 6c without wondering if it has the same problems?
Casual tech watchers don't understand the nuts and bolts of this situation. They hear some things, read some things and go along with the popular media consensus.
If the alleged 6c were actually going to be launched in a couple of months, the branding, production, packaging, marketing would all have been bought and paid for already.
Does having to recalibrate the launch of a new product and all the costs that might incur count as "undue burden?"
Etc., etc. Maybe they need a significant portion of the iOS team to do this, and the work causes delays in the next version of iOS, iPhone 7 has to get pushed back for release and misses the holiday quarter, again, lost sales accounting for billions.
I think the potential impact on Apple's bottom line could honestly be taken into consideration of burden. Curious about what other people think. Is money just not talked about in these considerations?
Re: Justice Department Wants Apple to Unlock Nine More iPhones
#205> Apple has in a number of cases objected to the Justice Department’s efforts to force its cooperation through a 1789 statute known as the All Writs Act
And the full (!) text of All Writs Act is just:
https://en.wikipedia.org/wiki/All_Writs_Act
--
"(a) The Supreme Court and all courts established by Act of Congress may issue all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law.
(b) An alternative writ or rule nisi may be issued by a justice or judge of a court which has jurisdiction."
--
Note it's not any law that regulates any form of encryption or communication security or what some company has to do to help some law enforcement procedures, a lot of laws with such topics were fought about, proposed, discussed and introduced through the years, like CALEA. This is just "we can demand anything we want."
The issue is, should this Act be allowed to be used in such contexts. A precedent can even make unnecessary the current process by which the laws are being made. Note there's nothing specific in that sentence from 1789. Who needs laws if anything goes?
Re: Justice Department Wants Apple to Unlock Nine More iPhones
#206I've already made my legal and political opinions in other threads on the topic and won't rehash them here, especially since so many other people are making the points better than I did. However, here's something I haven't thought of, though I sort of hate to boil the thing down to a business proposition. The fact is that iPhone is a massive business. What all is a company allowed to claim as "burden" in the discussi…
> Is the loss of, say, 50 billion dollars in revenue over the next calendar year something a reasonable person would call "undue burden?"
I wonder the same. In another comment in this thread I mention that it's not just undue burden here that is expected under AWA according to USA vs. New York Telephone, it is also expected that the FBI pay for any work they ask Apple to do.
Yahoo was forced to deal with many requests from the NSA in 2008, only those dealings were unknown to the public until recently. [1] The last 8 years have not treated Yahoo too well..
It seems when you fight the government on privacy, you lose. It's better if you roll over and wag your tail like Microsoft
[1] http://www.theguardian.com/world/2014/sep/11/yahoo-nsa-lawsu...
Re: Justice Department Wants Apple to Unlock Nine More iPhones
#207Earlier quoted context omitted.
The best respons is already a reality: iPhone 6 with Secure Enclave - or making it impossible to unlock the phone with a hack and with brute force. I hope Google and Microsoft follow suit, and make this a requirement for future versions of Android and Windows Phone.
Nope, Secure Enclave is updateable, even Apple said so.
Do we know what can the software running on the secure enclave do exactly? If the software itself doesn't have access to the master key (a.i. can't read it directly), and if the slow authentication is inherent from running the algorithm on the chip, rather than a having been slowed down artificially, then even an update to the secure enclave would not compromise the security of the system.
Do we know exactly what the secure enclave software can do and what it can't do?
Re: Justice Department Wants Apple to Unlock Nine More iPhones
#208Earlier quoted context omitted.
It makes total sense that the givernment would use it's forensic capabilities whenever the need arises. The question at hand is: "can the All Writs Act compel a company to proactively defeat its own security measures?" The answer will apply to all cases. The more important question is "Should the government be able to access citizen's digital data with a court order? And if so, how can that be enabled without comprom…
>Should the government be able to access citizen's digital data with a court order? I don't think that's a good question at all. Regardless of the ruling, they aren't going to up and declare encryption illegal. You can't throw a legal requirement at math to stop working.
Not only that, seeing "the government" as a single entity is at best naive.
Can a schoolteacher access a citizen's digital data with a court order? Can the FBI access a citizen's digital data with a court order? Can a court access a citizen's digital data with a court order?
Those questions are fundamentally different and have varying support in lawmaking.
Re: Justice Department Wants Apple to Unlock Nine More iPhones
#209Earlier quoted context omitted.
>I suspect we'll ultimately wind up with mainstream device manufacturers maintaining some kind of per-device master key that they turn over when ordered. It will be impossible to secure that database. Any number and size of bribes would be worth spreading around to gain a dump of it. Once I have a dump, you're up shit creek because you're faced with changing every key of every device you've ever sold to resecure them…
These kind of master keys already exists so it is not something hypothetical. I am talking about the private keys of trusted root certification authorities. If it would be as easy to get them as you say nobody would probably use TLS since it would be useless.
Well, TLS with "trusted" CAs is useless, for extreme threat models.
Re: Justice Department Wants Apple to Unlock Nine More iPhones
#210Earlier quoted context omitted.
http://recode.net/2016/02/21/what-if-san-bernardino-suspect-... "In a sweeping November report on encryption, Manhattan District Attorney Cy Vance wrote that Google can “reset the passcodes” on some Android phones without full encryption, when served with a search warrant. “This process can be done by Google remotely and allows forensic examiners to view the contents of a device,” according to the report."
Selective quoting FTW! It devolves into a he-said/she-said conversation. > "Google has no ability to facilitate unlocking any device that has been protected with a PIN, Password, or fingerprint," [Android’s security chief, Adrian Ludwig] wrote. "This is the case whether or not the device is encrypted, and for all versions of Android." Also note it talks about being able to unlock phones without full encryption. Which…
Two-thirds of Android devices in use are still running versions of Android older than L which allow Google to remotely bypass the unlock pattern on demand from the authorities. Companies are still releasing new low-end smartphones with these older Android versions - for example, Walmart recently started selling several $20 smartphones with Android 4.4