Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Is Said to Be Working on an iPhone Even It Can’t Hack

nytimes.com

Post reply on HN
Print view View original

161–170 of 415 posts

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#161

Post by asdf_qwerty_vbm »

r00fus wrote: post #26
w1ntermute wrote: post #8

Earlier quoted context omitted.

> if you use a strong alphanumeric password to unlock your phone, there is nothing Apple has been able to do for many years to unlock your phone Is this true even if you use Touch ID?

If they have access to a live finger for the TouchID, sure they can bypass - but they could do that with the $5 guaranteed coercion method as well [1]. Copying a good fingerprint from a dead finger or a randomly placed print is not easy [2]. It's hard, doable but you get 5 tries so if you screw up, you have thrown away all the hard work of the print transfer. All bets are off if the iPhone is power-cycled. Best bet i…

  All bets are off if the iPhone is power-cycled.
Except, you don't have explicit control over the iPhone's battery, so how do you know if the power is actually cycled?

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#162

Post by matt_wulfeck »

themagician wrote: post #10
w1ntermute wrote: post #8

Earlier quoted context omitted.

> if you use a strong alphanumeric password to unlock your phone, there is nothing Apple has been able to do for many years to unlock your phone Is this true even if you use Touch ID?

TouchID disables itself after 48 hours and requires the password again.

Or if the phone runs out of batteries and restarts.

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#163

Post by ubernostrum »

karmelapple wrote: post #102
abalone wrote: post #50

It's important to emphasize something: iCloud will always be "backdoored", by design, and backing up to iCloud is what most users should and will be doing. The reason iCloud data will always be accessible by Apple, and thus governments, is not because Apple wants to make it accessible to governments. It's so that Apple can offer customers the very important feature of accessing their own data if they forget or otherw…

> When someone passes away, for example, it would be a terrible compounding tragedy if all their photos from their whole life passed away along with them, because they didn't tell anyone their password or where they kept the backup key. So Apple wants and needs to provide an alternative way to recover the account. (For example, they will provide access to a deceased person's account if their spouse can obtain a court…

Over the past few years services have been slowly starting to phase in a way to specify a person who can "inherit" access to your account in the event of your death. I know Facebook has it fully set up now (you can go into your security settings and specify a "Legacy Contact"), and I expect that in the near future it'll be a standard part of any service that intends to operate long enough for this to become a worry.

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#164

Post by joering2 »

This is one of those moments I wish Jobs was still here.

Had he lost to the DOJ, here is what would (might) have happened:

- he would gladly unlocked this phone and bill DOJ for the time spent on redesigning IOS

- going forward, he would label each phone's box in red letters: CONTAINS GOVERNMENT-REQUIRED BACKDOOR (I doubt Gov can forbid him from doing that)

- he would then stop selling devices in Apple stores directly and only allow to order them in stores with direct home delivery from Apple website hosted and operated outside USA.

- all the shipping would be done directly from China by-passing US-tax system all together.

- shortly after he would remove the backdoor IOs for devices that are not directly sold on US soil

That would be a big fat middle finger to the DOJ.

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#165

Post by ubernostrum »

russell_h wrote: post #15
n0us wrote: post #5

What is to stop the DOJ from requiring them to produce a phone that has a hardware backdoor? If they are required to produce a software backdoor then building an iphone which is immune to such vulnerabilities seemingly solves that problem but I don't see the leap towards compelling Apple to build vulnerabilities into hardware as a large one. I'm not well versed in security so excuse me for my ignorance but what if th…

The DoJ doesn't really have the power to do that. They can get a judge to issue a warrant to search an existing device, and the judge can in some circumstances compel other parties to cooperate in that search. But generally any requirement that Apple insert a generalized backdoor into a product will need to come from new legislation.

Actually the FBI's current argument is very close to saying that the All Writs Act has no limits, and can compel literally anything the FBI thinks would "help" them with investigations.

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#166

Post by dylan604 »

jameshart wrote: post #119
petra wrote: post #66

Earlier quoted context omitted.

Using a strong pin is pretty annoying, and a relatively visible signal when using the phone on the street etc, So it can be a good filter(maybe via street cams) to filter suspicious people - which isn't a bad goal for law enforcement.

Corporate email profiles on BYOD phones often enforce a long passcode requirement, so you've got a lot of Fortune 500 sales guys to screen out if you're stopping and searching anybody with a suspiciously long password.

I'm at a loss as to how alphabet agency can determine a weak passcode vs strong passcode was used. how does a pin get stored on the phone? surely, not plain text of a 4 digit pin. if they do any encryption to the 4 digit pin, how would it appear any different than a significantly stronger passcode?

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#167

Post by rtpg »

tptacek wrote: post #2

They're presumably already 99% of the way there. If the Secure Enclave can be updated on a locked phone, all they need to do is stop allowing that, right? To me, the more profound consideration is this: if you use a strong alphanumeric password to unlock your phone, there is nothing Apple has been able to do for many years to unlock your phone. The AES-XTS key that protects data on the device is derived from your pas…

I don't think "already fenced off if people were savvy" is really valid. That's the security equivalent of "no type errors if people were savvy", which is the same as "probably has type errors".

It was near-impenetrable, but it could have been inevitable if it weren't for the fact that Apple could push OS updates without user consent. They could have made it impossible for anyone to get in even if your pin was 1234, but didn't.

Kind of disappointing given their whole thing about the Secure Enclave. Bunch of big walls in the castle, but they left the servant's door unlocked.

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#168

Post by ubernostrum »

ianamartin wrote: post #147

What I want is a service that deletes all my online presence after I die. A deadswitch. All texts, messages, emails, facebook posts, pictures anywhere, everything . I want it all to go when I do. Hell, I want some of it to go now. After I'm gone, I want to leave no part of my existence on the internet. I realize that's not possible. But I want to minimize my footprint. It is totally possible for a local device. I hav…

I wrote about this a while back:

http://www.b-list.org/weblog/2013/jan/29/persistence/

Since then I've started noticing services rolling out the ability to specify someone to take over your account after you die, and I suspect the legal framework around wills and estates is robust enough that you could leave instructions (and have them enforced) to delete things.

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#169

Post by ewzimm »

mtgx wrote: post #158
ewzimm wrote: post #148

Earlier quoted context omitted.

From what's been said, it seems like it was made to be updated so that Apple could easily issue security updates. They've already increased the delay between repeated attempts at password entry. Probably they were worried about vulnerabilities or bugs that hadn't been found and wanted to maintain debugging connections to make repairs easier. A tamper-resistant self-destruct mechanism with no possibility of recovery i…

How much easier? If all they had to do to not have access to it themselves is to ask the user for his password when there's a new update, that's hardly that inconvenient...

I'm not saying that it was the right thing to do in hindsight, but I get a little nervous even when updating a small web server, so I understand the tendency to leave repair options open on something as big as iPhones. Real hardware-based security is about more than just about asking for a password. It means making the device unreadable if it's been disassembled or tampered with, and that could have unintended side-effects if any mistakes are made or something is overlooked. It's definitely worth pursuing considering the political situation the world is in right now.

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#170

Post by the_watcher »

cromwellian wrote: post #36

Any device that relies on hiding secrets inside the silicon itself is subject to hacking. Several secure-enclave like chips have been hacked in the past by using electron microscopes and direct probes on the silicon. If BlackHat conference independent security researchers have the resources to pull this off, Apple and the NSA certainly can. Exfiltrating the Enclave UID could be done by various mechanisms at the chip…

Isn't the point of their efforts to make it so that Apple doesn't know how to get into the phones? If someone from BlackHat or Defcon can get in, the FBI should hire that person if they want access. The reason Apple is doing this is so that if they are served a court order, they can just say "we don't know how"
Post reply on HN