Don't they just need to tell people to switch away from 4 or 6 digit pins and use longer passwords?
I wish Apple would start pushing passphrases. Easy enough to remember, plenty strong, already usable with the current system on iphones.
Apple Is Said to Be Working on an iPhone Even It Can’t Hack
11–20 of 415 posts
Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack
#12What is to stop the DOJ from requiring them to produce a phone that has a hardware backdoor? If they are required to produce a software backdoor then building an iphone which is immune to such vulnerabilities seemingly solves that problem but I don't see the leap towards compelling Apple to build vulnerabilities into hardware as a large one. I'm not well versed in security so excuse me for my ignorance but what if th…
What if another agency already has an NSL in place requiring exactly the same (backdoor, weak crypto params, weak by design secure enclave) and they simply are under a gag order to talk about?
Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack
#13that's the endgame of government surveillance requests: it's increasingly in a company's best interest to have the best security possible so they can't be compelled to hack their own devices.
Surely it is a company's best interests to have 'good enough' looking security to serve their PR purposes while also secretly providing government access to maximise government kudos and all the benefits that would entail?
The counter-argument would be that that opens you up to catastrophic exposure when Snowden 2.0 releases the data.
Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack
#14that's the endgame of government surveillance requests: it's increasingly in a company's best interest to have the best security possible so they can't be compelled to hack their own devices.
Isn't the endgame rigged hardware which allows only to passively eavesdrop on everyone without telling anyone?
Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack
#15What is to stop the DOJ from requiring them to produce a phone that has a hardware backdoor? If they are required to produce a software backdoor then building an iphone which is immune to such vulnerabilities seemingly solves that problem but I don't see the leap towards compelling Apple to build vulnerabilities into hardware as a large one. I'm not well versed in security so excuse me for my ignorance but what if th…
The DoJ doesn't really have the power to do that. They can get a judge to issue a warrant to search an existing device, and the judge can in some circumstances compel other parties to cooperate in that search. But generally any requirement that Apple insert a generalized backdoor into a product will need to come from new legislation.
Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack
#16They're presumably already 99% of the way there. If the Secure Enclave can be updated on a locked phone, all they need to do is stop allowing that, right? To me, the more profound consideration is this: if you use a strong alphanumeric password to unlock your phone, there is nothing Apple has been able to do for many years to unlock your phone. The AES-XTS key that protects data on the device is derived from your pas…
> if you use a strong alphanumeric password to unlock your phone, there is nothing Apple has been able to do for many years to unlock your phone Is this true even if you use Touch ID?
If the has been switched off or if >48h passed since the last unlock.
Also remember that rubber-hose cryptanalysis is always an option.
Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack
#17The problem with software is that none have been 100% secure yet... I doubt that Apple will be able to achieve that in the near future. Someone should send a phone to John Mcafee at the very least [1][2] ...
1. http://www.pcgamer.com/john-mcafee-on-his-fbi-iphone-hack-of...
2. http://arstechnica.com/staff/2016/02/mcafee-will-break-iphon...
edit: added source #2; see Google for additional sources...
Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack
#18that's the endgame of government surveillance requests: it's increasingly in a company's best interest to have the best security possible so they can't be compelled to hack their own devices.
Surely it is a company's best interests to have 'good enough' looking security to serve their PR purposes while also secretly providing government access to maximise government kudos and all the benefits that would entail?
You really have to pick one side or the other, unless you're extremely good at keeping a secret and deceiving outside researchers. That's a much higher level of difficulty than simply creating a secure system.
Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack
#19They're presumably already 99% of the way there. If the Secure Enclave can be updated on a locked phone, all they need to do is stop allowing that, right? To me, the more profound consideration is this: if you use a strong alphanumeric password to unlock your phone, there is nothing Apple has been able to do for many years to unlock your phone. The AES-XTS key that protects data on the device is derived from your pas…
> if you use a strong alphanumeric password to unlock your phone, there is nothing Apple has been able to do for many years to unlock your phone Is this true even if you use Touch ID?
Does TouchID have any protections against your finger unlocking your phone post-mortem?
Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack
#20They're presumably already 99% of the way there. If the Secure Enclave can be updated on a locked phone, all they need to do is stop allowing that, right? To me, the more profound consideration is this: if you use a strong alphanumeric password to unlock your phone, there is nothing Apple has been able to do for many years to unlock your phone. The AES-XTS key that protects data on the device is derived from your pas…
> if you use a strong alphanumeric password to unlock your phone, there is nothing Apple has been able to do for many years to unlock your phone Is this true even if you use Touch ID?
Probably not. If you're dead, they probably have your fingers. If you're alive, they can compel you to unlock the device with your fingerprint.
The only point I'm making is that Apple already designed a cryptosystem that resists court-ordered coercion: as long as your passcode is strong (and Apple has allowed it to be strong for a long time), the phone is prohibitively difficult to unlock even if Apple cuts a special release of the phone software.