Your iPhone just got less secure. Blame the FBI • Hacker News Board

Re: Your iPhone just got less secure. Blame the FBI

#141

Post by ikeboy » Wed, Mar 30, 2016, 4:27 PM UTC

woodman wrote: post #127

ikeboy wrote: post #77

Earlier quoted context omitted.

They were willing to hand over the phone to Apple and allow all work to take place on Apple premises. How does that affect other phones?

So have you not heard that this would set a legal precedent? Apple would get pestered until they finally create an automatic gateway for turn key security breaking, not unlike the wiretap portals setup by telecoms - or the frequently abused youtube DMCA mechanisms.

It only sets a precedent that they can give phones to Apple and have them unlock them, as long as it's possible for them to do so. If Apple decides to build a general backdoor and hand it to the government that's entirely their decision.

Re: Your iPhone just got less secure. Blame the FBI

#142

Post by zamalek » Wed, Mar 30, 2016, 4:30 PM UTC

studentrob wrote: post #137

zamalek wrote: post #131

Earlier quoted context omitted.

> That hurts the government's ability to advance their own technological capabilities and understanding. I take it that nobody in The White House uses an iPhone, or at least I hope not. Institutionalized ignorance to the degree of shooting oneself in the foot is concerning - far more concerning than the existence of this specific vulnerability.

Tons do. Watch the Congressional hearing [1]. Some representatives hold theirs up when they begin talking. [1] https://youtu.be/g1GgnbN9oNw

I know I'm stating the obvious here but it needs to be stated: The White House is therefore completely okay with this weapon in, as one example, terrorists' hands. Is this a new war or terror strategy or something, placing weapons into the foes' hands?

Re: Your iPhone just got less secure. Blame the FBI

#143

Post by function_seven » Wed, Mar 30, 2016, 4:30 PM UTC

cptvideo2 wrote: post #121

fixermark wrote: post #100

Earlier quoted context omitted.

It's much easier to understand when you realize that Monty never reveals that one of the closed doors contained the car. That asymmetry of action leads to the asymmetry of probabilities; your initial choice constrained his choices when he takes action.

Well, Monty doesn't know (or care about) your choice. He's 'constrained' by the fact that his 'probability' is 100%: he knows where the goats and car are.

He does care. 2/3 of the time, your choice forces his. If you choose a goat, Monty doesn't have a choice. He can only reveal the other goat.

The other 1/3 of the time, you're right, he doesn't care, because he can choose any of the remaining doors at random.

Re: Your iPhone just got less secure. Blame the FBI

#144

Post by wolf550e » Wed, Mar 30, 2016, 4:32 PM UTC

tptacek wrote: post #120

bertil wrote: post #63

Earlier quoted context omitted.

My understanding is that “disclosure” is a nuanced thing, time-wise: responsible disclosure is to mention the vulnerability to someone who can and is intent to fix it first, give them the time to write, test and send a patch, and then publish it. Publishing it earlier sound very unreasonable, especially before handing the details to the manufacturer. I am not familiar with what Schneier said 15 years ago, though. He…

There is no such thing as "responsible disclosure". That's a term invented by vendors to coerce independent researchers into doing free work for them. Semantic drift has somewhat legitimized the term, but I think it's important we remember why it was conjured in the first place.

How would you call Google Project Zero's 90 day policy?

Re: Your iPhone just got less secure. Blame the FBI

#145

Post by intrasight » Wed, Mar 30, 2016, 4:33 PM UTC

I don't blame either of them. But I do blame users who put confidential information on their phone with the expectation that it will remain so.

Re: Your iPhone just got less secure. Blame the FBI

#146

Post by wyldfire » Wed, Mar 30, 2016, 4:34 PM UTC

There's a typo in the URL for the "process" link in "They even have a process for deciding what to do when a vulnerability is discovered."

Should be https://www.whitehouse.gov/blog/2014/04/28/heartbleed-unders...

It's interesting that the government (at least this part: " Special Assistant to the President and Cybersecurity Coordinator") recognizes the pros/cons:

> Disclosing a vulnerability can mean that we forego an opportunity to collect crucial intelligence ... Building up a huge stockpile of undisclosed vulnerabilities while leaving the Internet vulnerable and the American people unprotected would not be in our national security interest.

Re: Your iPhone just got less secure. Blame the FBI

#147

Post by cmiller1 » Wed, Mar 30, 2016, 4:37 PM UTC

ryao wrote: post #112

cmiller1 wrote: post #49

Earlier quoted context omitted.

>The iPhone did not get less secure. It has always had this security hole. Although given the fact that it was made public that they found a security hole, won't that change the behavior of malicious actors? Now that it's known that a hole exists, more people will start looking for it, reducing security through obscurity.

Security by obscurity is an antipractice.

Sort of? You're not supposed to DEPEND on it as your only means security, but it certainly lowers the likelihood of something being broken into when combined with other methods of security.

Re: Your iPhone just got less secure. Blame the FBI

#148

Post by wyldfire » Wed, Mar 30, 2016, 4:41 PM UTC

exelius wrote: post #55

studentrob wrote: post #12

The FBI's refusal to detail the flaw will just add to the pile of miscommunications between technologists and the government. That hurts the government's ability to advance their own technological capabilities and understanding. Every day, they're getting better at shooting themselves in the foot and widening that communication gap. I see nobody out there capable of bridging it. Not Tim Cook, not the EFF, not Obama,…

I agree with you, and I think this will eventually lead to a world where governments are unable to exert meaningful influence on large corporations. We're already starting to get there; I have a feeling that if the supreme court had forced Apple to write a custom version of iOS that things could have gotten really messy very quickly -- there were rumors that Apple's entire iOS engineering team was ready to resign if…

> Fuck it, we're based in Ireland now

Apple has an enormous investment in their design team in Cupertino. It would be an enormous impact to their product development capability to start over somewhere else.

It's not enough to say "HQ is over here bro," court orders still work in California. Then again this whole All Writs effort to "build me a tool to help my investigation" seems to break new ground. Maybe it wouldn't even be enough to pack up and move all R&D out of the US (e.g. injunction on US sales until the foreign Apple company complies).

Re: Your iPhone just got less secure. Blame the FBI

#149

Post by function_seven » Wed, Mar 30, 2016, 4:43 PM UTC

noobie wrote: post #96

cjbprime wrote: post #72

Earlier quoted context omitted.

There's a mechanism that wipes the device after too many incorrect code attempts. Disabling this mechanism was the entire point of the FBI/Apple lawsuit.

I am pretty sure a reboot bypasses that mechanism.

Why would you be pretty sure of that? That would be totally braindead if a simple reboot bypassed the limit. It doesn't. There was a flaw in an earlier iOS version where you could reboot the phone a few milliseconds after an incorrect PIN, before the phone recorded the failure, but that was fixed some time ago.

Re: Your iPhone just got less secure. Blame the FBI

#150

Post by carleverett » Wed, Mar 30, 2016, 4:43 PM UTC

function_seven wrote: post #138

ghshephard wrote: post #123

Earlier quoted context omitted.

This is incorrect. Flipping a coin to "to chose the second door and sometimes show the prize." has no impact on the probabilities. The parent is correct - there is a 2/3 chance the prize exists under one of the other two doors, and if one of them is shown not to have the prize (through random flipping, deliberate selection, whatever) - then the final door now has a 2/3 chance to have the prize.

If one of the doors is shown to not have the prize , the odds are now 1/2 when the choice of reveal door is made randomly. That's because 1/3 of the time, you're not even offered the chance to switch, since it's pointless. I'll run the trials here. Assume the first two doors have the goat, and the third door has the car. Pick Reveal Switch? Outcome ---- ------ ------- ------- 1 2 Y 3 Car 2 1 Y 3 Car 3 1 N 3 Car 3 2 N…

But in the actual game, you are always given the chance to switch. Here are the possible outcomes of the game, with the third column being what the contestant should do to win:

   You Pick  Car   Switch?
   -------  -----  ------
       1      1      N    
       2      1      Y   
       3      1      Y
 
       1      2      Y
       2      2      N  
       3      2      Y

       1      3      Y     
       2      3      Y     
       3      3      N

Without knowing anything else, switching means that you win 2/3 of the time.