Your iPhone just got less secure. Blame the FBI

Post by runjake » Wed, Mar 30, 2016, 3:26 PM UTC

llamataboot wrote: post #50

dahart wrote: post #17

Is this just FUD? Simply confirming the vulnerability seems likely to lead to it being plugged, whether or not the FBI reveals their methods, in effect doing the opposite of what the title suggests.

How can it be plugged, if Apple doesn't know what it is?

Post by snowwrestler » Wed, Mar 30, 2016, 3:27 PM UTC

studentrob wrote: post #12

The FBI's refusal to detail the flaw will just add to the pile of miscommunications between technologists and the government. That hurts the government's ability to advance their own technological capabilities and understanding. Every day, they're getting better at shooting themselves in the foot and widening that communication gap. I see nobody out there capable of bridging it. Not Tim Cook, not the EFF, not Obama,…

Post by exelius » Wed, Mar 30, 2016, 3:28 PM UTC

npsimons wrote: post #74

exelius wrote: post #62

Earlier quoted context omitted.

> Funny to call it reporting when it's more of an editorial by the renowned security researcher Bruce Schneier. I respect Bruce and he's done a ton of great work, but I obviously disagree with him on this point. I do not believe governments (especially ones engaged in clandestine surveillance operations) have an obligation to share security vulnerabilities with companies. But neither do those companies have an obliga…

> I do not believe governments (especially ones engaged in clandestine surveillance operations) have an obligation to share security vulnerabilities with companies. So I take it then you don't believe in a government "for the people"? Like it or not, Apple is legally a person, and even tossing that aside, we know that many of Apple's customers are American citizens, and this whole idea of "keeping knowledge from you…

Post by adekok » Wed, Mar 30, 2016, 3:28 PM UTC

wrsh07 wrote: post #45

exelius wrote: post #19

This is bad reporting. The iPhone did not get less secure. It has always had this security hole. I, like many others here on HN, believe the vulnerability to be related to the lack of a secure hardware biometric / encryption module. If this is the case, then your iPhone probably did not get less secure -- such exploits would only work on iPhones prior to the 5S (I think? The 6 series phones are covered for sure). Bas…

Funny to call it reporting when it's more of an editorial by the renowned security researcher Bruce Schneier. However, I'll defend his point: take the Monty Hall problem [ https://en.wikipedia.org/wiki/Monty_Hall_problem ]. The probabilities change, even when a door you didn't pick [and doesn't hold the prize] is opened. I think this is a fair analogy. We've now gained knowledge about the existence of a vulnerability…

Post by stcredzero » Wed, Mar 30, 2016, 3:30 PM UTC

exelius wrote: post #64

ethbro wrote: post #56

Earlier quoted context omitted.

> This is bad reporting. I felt the same way when I hit the article link, but changed by mind when Bruce Schneier made the more nuanced argument. Of course the vulnerability already existed. That's not what he has a problem with: the problem is that now there is a commercially-known but secret vulnerability. Which is a different thing than an unknown vulnerability. Newer hardware revisions, etc etc, but the biggest i…

I guess the part I disagree with him on is that I actually expect the US government to act like malware authors. They've shown an affinity for the tactics before (using surveillance software, stingrays, etc) so it's at least perfectly consistent. I have no expectations that the relationship between law enforcement and technology companies will improve. I guess I've just accepted this situation as the "new normal".