Live data from Hacker News

The NSA Reportedly Has Total Access To The Apple iPhone

forbes.com

111–120 of 212 posts

Re: The NSA Reportedly Has Total Access To The Apple iPhone

#111
post #74

At least we know why Obama still uses a blackberry

Obama only uses a blackberry for show when he is in public.

The Whitehouse Communications Office is responsible for maintaining communications with the rest of the government, business and political contacts, and his family. In the event the president needs to take a call, an aide will direct him to a secure tent they setup nearby that is shielded against eavesdropping and electronic surveillance (see http://www.theage.com.au/world/barack-obamas-portable-secrec...). If it is a conversation where they do not expect sensitive topics to be discussed, they might give him a Sectera Edge that is routed over an encrypted satellite link back to the Whitehouse switchboard where the actual call is connected.

Re: The NSA Reportedly Has Total Access To The Apple iPhone

#112

Honestly, I don't really care. The NSA can read whatever they want of mine. I've heard the arguments about how you should care, even if you don't have anything to hide. And I find them persuasive on one level and simultaneously unengaging on another. By contrast, the parallels to fascist Italy and Nazi Germany and living in a turnkey fascist state are most unpersuasive. The one argument against what I've written that…

I've lived in both the United States and Germany for long periods of time. In general, these are two modern, democratic countries, not typical oppressive regimes, an 99% of the people have nothing to worry about 99% of the time.

The problem are the 1% who express the wrong ideas at the wrong time. I know people who have been put under surveillance or charged in court for things that are perfectly legal, or just minor infractions. Some examples from Germany:

One guy I knew made a poster protesting against nuclear power, and put it up near his university. About a year later he got a letter saying that the "proceedings against him have been terminated". He found out that the police suspected him of planning a terrorist attack against a nuclear waste transport. They bugged his cell phone, his apartment, and followed him and his friends for about a year, until they realized they have the wrong guy.

A friend of mine made a mistake of visiting a squatted house an being seen there. Later he went to a demonstration, got filmed by the police, and charged with something you could translate as "ring leadership" or "inciting a riot".

There also was a famous case last year where a pacifist pastor who visited a anti-nazi demonstration was charged with something similar [1]. (And of course there are numerous examples from the US.)

The thing is, the threshold invading people's privacy is getting lower and lower. Police or intelligence agencies will put you under surveilance if they just have a hunch. At the same time, persecutors are under really high pressure to "make a case". More and more they will rather convict an innocent on dubious grounds than admit a mistake. Actual quotes from judges (paraphrased): "we need to make an example", and "I don't know if the accusations are technically true, but if you were there [at the demonstration], you have to be guilty of something".

A situation like this is unworthy of a democratic society. As I said, stuff like this doesn't happen to 99% of the people. But you never know when you are in the 1%. I have to be afraid to say anything controverisal - I have firecrackers and vinegar at home, what if some overeager investigator decides I want to make a bomb out of it? And this kind of fear is what they call a "chilling effect" - people will stop using their democratic rights, their right to free speach and freedom of assembly and so on.

[1]: http://news.msn.com/world/german-pastor-faces-trial-over-ant...

Re: The NSA Reportedly Has Total Access To The Apple iPhone

#113

"one question has been paramount for privacy advocates: How do we, as a society, balance the need for security against the rights to privacy and freedom? " I hear this fallacy question again an again. It implies that giving total power to gobertment is "security". It is not. Giving total control to Stalin meant hundred of millions of Russians got murdered in terror, giving total power to Hitler or Mussolini from demo…

Stalin is a bad example. By forcing industrialization on the ussr, he has increased average life span of the population by something like 15 years ( measures in 1958) and enabled the ussr to defend itself against the Germany which saved countless lives, and increased living standards, education, female equality greatly.

In his case, and the case of Chinese communism, it somewhat debatable whether a strong government is preferable.

Re: The NSA Reportedly Has Total Access To The Apple iPhone

#114
post #82

Aren't we missing a critical point here?? > "The initial release of DROPOUTJEEP will focus on installing the implant via closed access methods." [2007] OK, we knew this much already. I remember seeing a number of stories on how law enforcement can pull data off an iPhone, etc. Not really much new here. > "A remote installation capability will be pursued for a future release" Here is the interesting bit. You don't put…

Enterprise profiles offer complete control over an iPhone in iOS7, including bypassing password, installing apps and so on. In theory one needs to install a profile by hand, but I don't see why it wouldn't be possible to do it remotely with the right vulnerabilities. Some devices can come from the factory with an ID that auto-enrolls them with an EDM profile, including after OS reinstalls. I don't remember if Apple can push profiles, but I think it can.

More info on Zdziarski's blog.

Anyway, all devices with centralized managment like Android, iPhone, Blackberry can't be secured IMHO against such a capable adversary. When an actor can push stuff to the device it's hopeless.

Re: The NSA Reportedly Has Total Access To The Apple iPhone

#115
post #82

Aren't we missing a critical point here?? > "The initial release of DROPOUTJEEP will focus on installing the implant via closed access methods." [2007] OK, we knew this much already. I remember seeing a number of stories on how law enforcement can pull data off an iPhone, etc. Not really much new here. > "A remote installation capability will be pursued for a future release" Here is the interesting bit. You don't put…

>> "A remote installation capability will be pursued for a future release"

> Here is the interesting bit. You don't put this in a document unless you have a good plan on how to do it.

Well, you also put that sort of statement in a document because a manager you're presenting to asked you about it and you need to acknowledge it, but you don't have any plans to actually do it. Any questions about it can be answered with relatively vague platitudes and "conceptual architectures", and then the feature is left to quietly fade away in subsequent iterations of the backlog.

Re: The NSA Reportedly Has Total Access To The Apple iPhone

#116
post #95

Now the talk he gave was interesting, laying out some known and some new facts about the surveillance and automated attack capabilities of the NSA, particularity interesting is the targeting of infrastructure and their traffic injection systems. And he is right to make the point, that its particularly despicable that they actively sabotage infrastructure security, something everyone on this planet has to suffer from.…

> force backdoors unlikely > they are legally bound to publicly lie about it source?

http://www.theguardian.com/technology/2013/sep/09/nsa-sabota...

Re: The NSA Reportedly Has Total Access To The Apple iPhone

#117
post #27

Earlier quoted context omitted.

Why isn't Apple (or some other consumer group) in that market buying up the 0days? I want to see the price of 0days that compromise any longitudinal user information above $10 million. Idea: 0day markets are legalised [1]. Regulators require companies keep the average price of their 0days above a threshold or attach a warning to their product and marketing materials. This aligns the security interests of consumers wi…

I like the idea. I would donate towards a more secure AOSP. Unfortunately, no matter how much you sure up your phone's OS, there is still a massive, gaping hole in the form of the baseband processor. Until we have phones where the baseband is a tightly regulated slave processor, accessible only through a low-privelege mechanism (like a USB port), we can't really hope to have truly secure phones anyway.

One technical solution to this is encrypting the content of ram, using keys that cannot leave the processor. It's called TREZOR. Sorry no link, I'm on mobile . It doesn't work well with current phones but it should work well with cortex-a15 chips (assuming they won't be back doored against this, which is pretty hard to assume. But as far as I know, there isn't a realistic solution to back doored processors ).

Re: The NSA Reportedly Has Total Access To The Apple iPhone

#118
post #95

Now the talk he gave was interesting, laying out some known and some new facts about the surveillance and automated attack capabilities of the NSA, particularity interesting is the targeting of infrastructure and their traffic injection systems. And he is right to make the point, that its particularly despicable that they actively sabotage infrastructure security, something everyone on this planet has to suffer from.…

> force backdoors unlikely > they are legally bound to publicly lie about it source?

http://www.theguardian.com/technology/2013/sep/09/nsa-sabota...

Re: The NSA Reportedly Has Total Access To The Apple iPhone

#119

Earlier quoted context omitted.

They are a subset of random people, and one OP is less concerned about having his credentials than random people as a whole.

an interesting question GP raises... Who would you be more worried about having access to your email account and why? a. NSA b. a random criminal (unaffiliated with government) For me, the answer is not even close, but I'm more interested in understanding how others on HN process this.

The sets of a and b are not exclusive, until _you_ explicitly declared them to be exclusive.

Re: The NSA Reportedly Has Total Access To The Apple iPhone

#120

"one question has been paramount for privacy advocates: How do we, as a society, balance the need for security against the rights to privacy and freedom? " I hear this fallacy question again an again. It implies that giving total power to gobertment is "security". It is not. Giving total control to Stalin meant hundred of millions of Russians got murdered in terror, giving total power to Hitler or Mussolini from demo…

Stalin is a bad example. By forcing industrialization on the ussr, he has increased average life span of the population by something like 15 years ( measures in 1958) and enabled the ussr to defend itself against the Germany which saved countless lives, and increased living standards, education, female equality greatly. In his case, and the case of Chinese communism, it somewhat debatable whether a strong government…

Uh, Stalin is responsible for more suffering than possibly anyone in recent history. He probably killed more russian people than the german soldiers.

His policies screwed up a significant part of the world for decades.

Post reply on HN