Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Message to Our Customers

apple.com

Post reply on HN
Print view View original

131–140 of 1001 posts

Re: A Message to Our Customers

#131

Post by jumpwah »

chimeracoder wrote: post #103
noja wrote: post #91

Earlier quoted context omitted.

Nobody builds their Android from source. Nobody uses Cyanogenmod. And nobody runs Android on a phone where the entire stack is open source and blob free. Anyone who does is a rounding error.

> And nobody runs Android on a phone where the entire stack is open source and blob free. > Anyone who does is a rounding error. I'm actually curious if there is literally anyone who uses no proprietary software, including the radios and the SoC, on their Android device. My bet is that there's not even a single device out there for which this is possible. (If there is, I'd love to see it.)

It's not possible because pretty much all baseband processors (radios) run nonfree software.

Re: A Message to Our Customers

#132

Post by tomaskafka »

abritishguy wrote: post #48
zobzu wrote: post #28

What im reading is that apple can remote install an update that disable encryption. They dont want to do it. But that they have the capability is a bit scary.

It doesn't say anything about remote install - in fact it says "physical possession" several times.

Come on. It can be iOS update that waits until you enter the code or use touchID - and then sends the keys or decrypted data somewhere.

Re: A Message to Our Customers

#133

Post by SideburnsOfDoom »

microtonal wrote: post #80
SideburnsOfDoom wrote: post #33

Earlier quoted context omitted.

That is hard, we know. But it is not impossible for those with time, resources and willingness to think outside the box. For instance, signing keys can and have been stolen, on the principle of "if you can't brute-force it, hack in and take it". http://arstechnica.com/security/2013/02/cooks-steal-security... http://blogs.adobe.com/security/2012/09/inappropriate-use-of... http://www.androidauthority.com/ssl-added-remo…

That is hard, we know. But it is not impossible for those with time, resources and willingness to think outside the box. I assume that Apple has a hardware security module for key generation and storage, perhaps even custom-designed and built, to prevent key extraction/copying. Of course, in the end you have to trust Apple that only a limited number of employees have access to such hardware, that they have proper aud…

If there's one thing that we have learned over the last few years from Snowden et al, we have learned that it is safe to assume that these state actors will be trying all the avenues that you or I can think of, and spend years discovering new ones that we have not thought of.

Re: A Message to Our Customers

#134

Post by rdl »

As far as I'm aware, the most proper attacks here are, in order of cost:

0) Find some errata. Apple presumably knows as much as anyone except NSA. Have plausible deniability/parallel construction.

1) OS level issues, glitching, etc. if the device is powered on (likely not the case). Power stuff seems like a particularly profitable attack on these devices.

2) Get Apple, using their special Apple key, to run a special ramdisk to run "decrypt" without the "10 tries" limit. Still limited by the ~80ms compute time in hardware for each try.

(vs. an iPhone 5S/6/6S with the Secure Enclave:)

3) Using fairly standard hardware QA/test things (at least chip-level shops; there are tens/hundreds in the world who can do this), extract the hardware key. Run a massively parallel cluster to brute force a bunch of passphrases and this hw key, in parallel. I'd bet the jihadizen is using a shortish weak passphrase, but we can do 8-10 character passphrases, too. They may have info about his other passphrases from other sources which could be useful.

While I'm morally against the existence of #3, I'm enough of a horrible person, as well as interested in the technical challenge of #3, that I'd be willing to do it for $25mm, as long as I got to do it openly and retained ownership. In secret one-off, $100mm. I'd then spend most of the profits on building a system which I couldn't break in this way.

Re: A Message to Our Customers

#135

Post by venomsnake »

ghayes wrote: post #124
hosay123 wrote: post #109

Earlier quoted context omitted.

What it sounds like is they've been asked to prepare a new OS release that allows an unlimited number of attempts to enter the passphrase via some network link. The press release is written to sound like without a software release, it wouldn't be possible to mount this kind of attack, however attacks like this are generally possible regardless of having some specially modified and signed OS image: for example, by cut…

> with the exception that providing an easy means to brute force a phone to the authorities sets a horrible precedent This is the entire concern (in my opinion and in my reading of Tim Cook's opinion). If the government can force Apple to backdoor this one iPhone (because terrorist), then they can force Apple to backdoor any iPhone for any person given a valid warrant, subpoena or otherwise granted power. Once the fl…

That is the whole point of warrants. If apple made iphone with unlocked bootloader it would have been really impossible.

Re: A Message to Our Customers

#136

Post by nicky0 »

rms_returns wrote: post #21

This is quite unlike Apple. Is this the same company that insists on keeping its source proprietary and is always against FOSS? The idea that you care for your users' privacy and still like to keep control on them by not giving them the freedom to modify source-code is not what I buy.

This Apple?

http://www.opensource.apple.com

https://github.com/apple

Re: A Message to Our Customers

#137

Post by evanosaurus »

chimeracoder wrote: post #103
noja wrote: post #91

Earlier quoted context omitted.

Nobody builds their Android from source. Nobody uses Cyanogenmod. And nobody runs Android on a phone where the entire stack is open source and blob free. Anyone who does is a rounding error.

> And nobody runs Android on a phone where the entire stack is open source and blob free. > Anyone who does is a rounding error. I'm actually curious if there is literally anyone who uses no proprietary software, including the radios and the SoC, on their Android device. My bet is that there's not even a single device out there for which this is possible. (If there is, I'd love to see it.)

That's the current state of affairs. I know of no baseband manufacturer who has ever offered (nor seemed open to the idea of releasing) source for their chips.

Basebands aside, the rest of the device is somewhat feasible to see being open.

Re: A Message to Our Customers

#139

Post by eva1984 »

sberder wrote: post #98
eva1984 wrote: post #39

It makes sense for them. If they put a backdoor in iPhone for US government, they are effectively thrown out of Chinese market. Interesting enough, what will Apple do if Chinese government demand they to decrypt/put backdoor in exchange of staying in the market?

I was about to mention the Chinese case, the Chinese government asking foreign companies to install means of control and access in their products. Does that mean that apple will not provide such means or disable security for phones sold on the Chinese market? That would be surprising given the potential size of this market.

They will probably produce some China-only version to please the government. A open letter like this, will instantly end their relationship with the government, they won't even attempt to do it.

Re: A Message to Our Customers

#140

Post by [deleted] »

Oletros wrote: post #47
epaga wrote: post #2

Huge props to Apple - here's hoping against hope that Google, Facebook, and Amazon get behind this. One thing I was wondering is how Apple is even able to create a backdoor. It is explained toward the end: "The government would have us remove security features and add new capabilities to the operating system, allowing a passcode to be input electronically. This would make it easier to unlock an iPhone by “brute force…

> Huge props to Apple - here's hoping against hope that Google, Facebook, and Amazon get behind this. Why against hope?

[deleted]
Post reply on HN