Live data from Hacker News

Your iPhone just got less secure. Blame the FBI

washingtonpost.com

151–160 of 255 posts

Re: Your iPhone just got less secure. Blame the FBI

#151

Earlier quoted context omitted.

It seems to me that Tim Cook and the FBI understand each other very well. They just don't care about the same things. Former CIA and NSA Director Michael Hayden clearly understands the issues. I saw an interview where he stated that the FBI was correct to want access (it makes their job easier) and that we shouldn't give it to them (he understands that a backdoor will be used in ways other than intended). The point b…

Public officials answer to a different standard than private citizens who run companies. The oath of the FBI is not to make their own jobs easier. It is to maintain public security. If the Director of the FBI cannot do that effectively, then that is a blemish on the record of President Obama who appointed Comey. There's a definite need for someone to step up and say that on balance, we are more secure without trying…

> The oath of the FBI is not to make their own jobs easier. It is to maintain public security.

Actually, this is their oath:

    I [name] do solemnly swear (or affirm) that I will support and defend the Constitution of the United States against all enemies, foreign and domestic; that I will bear true faith and allegiance to the same; that I take this obligation freely, without any mental reservation or purpose of evasion; and that I will well and faithfully discharge the duties of the office on which I am about to enter. So help me God.
(source: https://www2.fbi.gov/publications/leb/2009/september2009/oat...)

Their oath is to the Constitution, and the duties of their office are to investigate federal crimes. The Constitution does not mandate that they share everything they know, but neither does it make it as easy for them to do their jobs as they might like.

The Constitution includes certain rights which make it more difficult for them to investigate crimes than they would prefer; it is also silent in some areas which some of us might wish it spoke more loudly on.

Re: Your iPhone just got less secure. Blame the FBI

#153

Earlier quoted context omitted.

If one of the doors is shown to not have the prize , the odds are now 1/2 when the choice of reveal door is made randomly. That's because 1/3 of the time, you're not even offered the chance to switch, since it's pointless. I'll run the trials here. Assume the first two doors have the goat, and the third door has the car. Pick Reveal Switch? Outcome ---- ------ ------- ------- 1 2 Y 3 Car 2 1 Y 3 Car 3 1 N 3 Car 3 2 N…

But in the actual game, you are always given the chance to switch. Here are the possible outcomes of the game, with the third column being what the contestant should do to win: You Pick Car Switch? ------- ----- ------ 1 1 N 2 1 Y 3 1 Y 1 2 Y 2 2 N 3 2 Y 1 3 Y 2 3 Y 3 3 N Without knowing anything else, switching means that you win 2/3 of the time.

Your comment (EDIT: Sorry, not yours, but parent) was talking about a random flip of coin determining which door Monty shows. That's not the actual game. If Monty is randomly showing a door without regard to goat/car, then you have to also consider the scenarios where he reveals a car and you lose early.

Re: Your iPhone just got less secure. Blame the FBI

#154

Earlier quoted context omitted.

Well, Monty doesn't know (or care about) your choice. He's 'constrained' by the fact that his 'probability' is 100%: he knows where the goats and car are.

What? Of course his action is based on your choice. If a has the car and b and c have goats, and you pick b, he opens c. And if you pick c, he opens b...

You’re right. I forgot that you had to tell him which door you wanted to open (instead of just saying that you've decided on a door - like the FBI as just SAID that they've cracked the iPhone5). But it doesn’t matter because Monty was always going to open one of the two goat doors, and the one that he opens doesn’t matter to the 1/3 probability that you picked the car door. Your probability of getting the car ALWAYS doubles when you switch (even though you still may not get it).

Re: Your iPhone just got less secure. Blame the FBI

#155
post #24

I am sure they just hired some interns to code = 0000 While code_is_valid not true: enter code reboot device code++ Edit: I am pretty sure there's a delay in code execution registering a wrong pin hence by rebooting the phone, the wrong pins won't get detected.

Regarding your edit, that was true in the past, but Apple fixed it in iOS 8.2. Now the system makes sure to write the failure to nonvolatile storage before reporting it. Phones running older OSes could be exploited this way. There are even boxes you can buy that will do it for you automatically. You set it up to try a passcode, then cut the power on failure. But they don't work anymore, and this phone's OS was too new for it.

Re: Your iPhone just got less secure. Blame the FBI

#156
post #45

Earlier quoted context omitted.

Funny to call it reporting when it's more of an editorial by the renowned security researcher Bruce Schneier. However, I'll defend his point: take the Monty Hall problem [ https://en.wikipedia.org/wiki/Monty_Hall_problem ]. The probabilities change, even when a door you didn't pick [and doesn't hold the prize] is opened. I think this is a fair analogy. We've now gained knowledge about the existence of a vulnerability…

That was an excellent analogy.

> The FBI just revealed ...

It would be a better analogy if they had actually revealed anything, instead of just saying that they had. This was more like telling us which door had a car behind it and trusting us to believe them.

Re: Your iPhone just got less secure. Blame the FBI

#157
post #141

Earlier quoted context omitted.

So have you not heard that this would set a legal precedent? Apple would get pestered until they finally create an automatic gateway for turn key security breaking, not unlike the wiretap portals setup by telecoms - or the frequently abused youtube DMCA mechanisms.

It only sets a precedent that they can give phones to Apple and have them unlock them, as long as it's possible for them to do so. If Apple decides to build a general backdoor and hand it to the government that's entirely their decision.

> It only sets a precedent...

Yeah, it "only" sets a precedent that the government can compel a company to reverse all the work put into securing a product, no possible market driven unintended consequences there.

> If Apple decides...

Classic victim blaming, "decision" is the wrong word to use here. Constant negative reinforcement leads to conditioned responses - not decisions.

Re: Your iPhone just got less secure. Blame the FBI

#158
post #52

Schneier has never had a strong intuition for how software vulnerabilities work. In the 2000s, he wrote articles in his newsletter blaming eEye (a security research firm then the home of Derek Soeder, Barnaby Jack, Ryan Permeh, and the like) for publishing their vulnerability research. He is at turns anti-disclosure, pro-disclosure, and all points in between.

Disclosure to the vendor is very different from publishing a vulnerability. I don't see any inconsistency here.

Re: Your iPhone just got less secure. Blame the FBI

#159
post #141

Earlier quoted context omitted.

So have you not heard that this would set a legal precedent? Apple would get pestered until they finally create an automatic gateway for turn key security breaking, not unlike the wiretap portals setup by telecoms - or the frequently abused youtube DMCA mechanisms.

It only sets a precedent that they can give phones to Apple and have them unlock them, as long as it's possible for them to do so. If Apple decides to build a general backdoor and hand it to the government that's entirely their decision.

In fact, it also only sets precedent if they have to legally force Apple to do it. Apple could've used their discretion to comply in this particular case, avoiding courts, and avoiding legal precedents being set.

Re: Your iPhone just got less secure. Blame the FBI

#160

Earlier quoted context omitted.

If one of the doors is shown to not have the prize , the odds are now 1/2 when the choice of reveal door is made randomly. That's because 1/3 of the time, you're not even offered the chance to switch, since it's pointless. I'll run the trials here. Assume the first two doors have the goat, and the third door has the car. Pick Reveal Switch? Outcome ---- ------ ------- ------- 1 2 Y 3 Car 2 1 Y 3 Car 3 1 N 3 Car 3 2 N…

But in the actual game, you are always given the chance to switch. Here are the possible outcomes of the game, with the third column being what the contestant should do to win: You Pick Car Switch? ------- ----- ------ 1 1 N 2 1 Y 3 1 Y 1 2 Y 2 2 N 3 2 Y 1 3 Y 2 3 Y 3 3 N Without knowing anything else, switching means that you win 2/3 of the time.

I changed to rules so in "3, 1, Y" he might open door 3 and show you a car. At that point switching is a meaningless choice.
Post reply on HN