Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Your iPhone just got less secure. Blame the FBI

washingtonpost.com

Post reply on HN
Print view View original

161–170 of 255 posts

Re: Your iPhone just got less secure. Blame the FBI

#161

Post by allemagne »

Ideally (for the FBI), the FBI would order Apple to build a backdoor into their system. This is functionally the same as ordering Apple not to patch a known vulnerability. In turn, this is functionally the same (in the short term) as not disclosing a known vulnerability to Apple.

While the article's title is misleading, the FBI might as well be taking an active role in making the iPhone less secure. In communicating to the non-technical public, insisting on elaborating the difference is being pedantic.

Re: Your iPhone just got less secure. Blame the FBI

#162

Post by quinnchr »

snowwrestler wrote: post #84
studentrob wrote: post #12

The FBI's refusal to detail the flaw will just add to the pile of miscommunications between technologists and the government. That hurts the government's ability to advance their own technological capabilities and understanding. Every day, they're getting better at shooting themselves in the foot and widening that communication gap. I see nobody out there capable of bridging it. Not Tim Cook, not the EFF, not Obama,…

The specific point of bridging is that technology corporations and the federal government should both care deeply about making consumer and corporate technology as secure as possible, given how much of the nation depends on it. On paper, the right federal agency for this should be the Department of Homeland Security. In reality they have neither the technical expertise nor the political "juice" to compete with the in…

The government isn't a single entity with a single goal. There already exist federal agencies with the goal of increasing security (see http://csrc.nist.gov/groups/ST/toolkit/), while others like the FBI have vested interest in increasing their powers of investigation. The executive branch has already made their stance clear, weakening encryption should not be the goal of any federal agency:

"We recommend that, regarding encryption, the US Government should:

(1) fully support and not undermine efforts to create encryption standards;

(2) not in any way subvert, undermine, weaken, or make vulnerable generally available commercial software; and

(3) increase the use of encryption, and urge US companies to do so, in order to better protect data in transit, at rest, in the cloud, and in other storage."

http://arstechnica.com/information-technology/2013/12/nsa-sh...

Re: Your iPhone just got less secure. Blame the FBI

#163

Post by the_ancient »

studentrob wrote: post #97
titzer wrote: post #79

Earlier quoted context omitted.

> I respect Bruce and he's done a ton of great work, but I obviously disagree with him on this point. I do not believe governments (especially ones engaged in clandestine surveillance operations) have an obligation to share security vulnerabilities with companies. Interesting. What obligations do governments have? On the one hand we have government agencies (the CPA, e.g.) whose entire function is to protect consumer…

Here's the oath stated by FBI agents when they join [1], > I [name] do solemnly swear (or affirm) that I will support and defend the Constitution of the United States against all enemies, foreign and domestic; that I will bear true faith and allegiance to the same; that I take this obligation freely, without any mental reservation or purpose of evasion; and that I will well and faithfully discharge the duties of the…

That oath is worth nothing given the Greatest threat to the Constitution is the FBI, NSA and other parts of the Federal Government

They may swear a oath to the constitution, but they are actually Loyal to the Federal Government, not the Constitution.

Re: Your iPhone just got less secure. Blame the FBI

#164

Post by jfoster »

woodman wrote: post #127
ikeboy wrote: post #77

Earlier quoted context omitted.

They were willing to hand over the phone to Apple and allow all work to take place on Apple premises. How does that affect other phones?

So have you not heard that this would set a legal precedent? Apple would get pestered until they finally create an automatic gateway for turn key security breaking, not unlike the wiretap portals setup by telecoms - or the frequently abused youtube DMCA mechanisms.

It wouldn't set a legal precedent unless a court ruled on it. It would only have come to that if Apple continued to decline the FBI's request.

Re: Your iPhone just got less secure. Blame the FBI

#165

Post by zodPod »

adekok wrote: post #88
wrsh07 wrote: post #45

Earlier quoted context omitted.

Funny to call it reporting when it's more of an editorial by the renowned security researcher Bruce Schneier. However, I'll defend his point: take the Monty Hall problem [ https://en.wikipedia.org/wiki/Monty_Hall_problem ]. The probabilities change, even when a door you didn't pick [and doesn't hold the prize] is opened. I think this is a fair analogy. We've now gained knowledge about the existence of a vulnerability…

> The probabilities change, even when a door you didn't pick [and doesn't hold the prize] is opened. That's the common misunderstanding of the problem. Most people think that the probabilities go fro 1/3, 1/3, 1/3 to 1/2, 1/2, after choosing a door and having Monty Hall open one of the others. The probabilities don't change. The probabilities are 1/3, 1/3, 1/3 at the start. After you choose a door, they're still 1/3,…

This is a great clarification of how this problem works. I STILL can't grasp why you'd switch. Since you have no idea which door it is, couldn't the 2/3 probability be applied to either his door or your door? For all you know, the one that he removed was just one random one of the goat doors. Your chance of picking the car was 1/3 before, if you could have the car already, why would it be better to switch now that he removed which ever would definitely be a goat? It seems like you still have a 50/50 chance of getting the car and your chance of the one that remains (unpicked/unremoved) is just as likely to be the other goat as it is to be the car..

That said, I made a simulation of it where it does the following: 1. Assign random locations behind doors, 2. Player randomly chooses door, 3. Host excludes door (random if both are goats, goat if one is a car), 4. Player either switches, or doesn't switch based on what's chosen for that simulation (the full set gets one or the other)

After running 50,000,000 then dividing success/tries, my number is nearly exactly the same between the two. Is my simulation working incorrectly?

Re: Your iPhone just got less secure. Blame the FBI

#166

Post by ethbro »

exelius wrote: post #64
ethbro wrote: post #56

Earlier quoted context omitted.

> This is bad reporting. I felt the same way when I hit the article link, but changed by mind when Bruce Schneier made the more nuanced argument. Of course the vulnerability already existed. That's not what he has a problem with: the problem is that now there is a commercially-known but secret vulnerability. Which is a different thing than an unknown vulnerability. Newer hardware revisions, etc etc, but the biggest i…

I guess the part I disagree with him on is that I actually expect the US government to act like malware authors. They've shown an affinity for the tactics before (using surveillance software, stingrays, etc) so it's at least perfectly consistent. I have no expectations that the relationship between law enforcement and technology companies will improve. I guess I've just accepted this situation as the "new normal".

As much as one can go on about the US government abusing its powers, there's still a difference between criminal enterprises and national security theater. At the minimum, the later is still within control of democratically elected branches of government (or indirectly via courts).

One of the central features of democracy is that it's a large ship but does turn toward the majority. You/I/we want that ship to turn towards a right to strong crypto systems enshrined in law? Work on influencing that majority.

Because the fact of the matter is that a majority of Americans don't even understand encryption. And to paraphrase McAvoy from The Newsroom and point at one of the reasons more social change wasn't effected from the 60s, in a democracy an idea being right is less important than it being known and agreed with.

All that is required for cynacism, on the other hand, is to sit on ones couch.

> I have no expectations that the relationship between law enforcement and technology companies will improve.

I absolutely agree with this, but that Brave New World has its own dangers. Apple could technically construct a device to enable secure drug trafficking and place its levers of control over that device outside US jurisdiction. Then begin taking a cut of the enterprise. Control is power, and if we shift it from the US government to corporations, then corporate accountability starts to become a lot more important.

Because that's ultimately what we're talking about now. Imagine in 20 years when we're having the conversation about the poor US government standing up to Apple or Google.

Re: Your iPhone just got less secure. Blame the FBI

#167

Post by wrsh07 »

adekok wrote: post #88
wrsh07 wrote: post #45

Earlier quoted context omitted.

Funny to call it reporting when it's more of an editorial by the renowned security researcher Bruce Schneier. However, I'll defend his point: take the Monty Hall problem [ https://en.wikipedia.org/wiki/Monty_Hall_problem ]. The probabilities change, even when a door you didn't pick [and doesn't hold the prize] is opened. I think this is a fair analogy. We've now gained knowledge about the existence of a vulnerability…

> The probabilities change, even when a door you didn't pick [and doesn't hold the prize] is opened. That's the common misunderstanding of the problem. Most people think that the probabilities go fro 1/3, 1/3, 1/3 to 1/2, 1/2, after choosing a door and having Monty Hall open one of the others. The probabilities don't change. The probabilities are 1/3, 1/3, 1/3 at the start. After you choose a door, they're still 1/3,…

You are, of course, correct. Sorry about the careless wording [I think the analogy is still interesting, though!]

Re: Your iPhone just got less secure. Blame the FBI

#168

Post by the_ancient »

zeveb wrote: post #151
studentrob wrote: post #68

Earlier quoted context omitted.

Public officials answer to a different standard than private citizens who run companies. The oath of the FBI is not to make their own jobs easier. It is to maintain public security. If the Director of the FBI cannot do that effectively, then that is a blemish on the record of President Obama who appointed Comey. There's a definite need for someone to step up and say that on balance, we are more secure without trying…

> The oath of the FBI is not to make their own jobs easier. It is to maintain public security. Actually, this is their oath: I [name] do solemnly swear (or affirm) that I will support and defend the Constitution of the United States against all enemies, foreign and domestic; that I will bear true faith and allegiance to the same; that I take this obligation freely, without any mental reservation or purpose of evasion…

If the Constitution is silent, that means it is prohibited.

The constitution is first and foremost a document outlining what the federal government is allowed to do. If it is not listed in the Constitution, then by design the government does not have the authority.

I think this has been lost, in part by the inclusion of the bill of rights, which where never intended to be an all inclusive lists of a persons rights.

Re: Your iPhone just got less secure. Blame the FBI

#169

Post by CaptSpify »

spriggan3 wrote: post #76
CaptSpify wrote: post #31

Earlier quoted context omitted.

How do you prove something you don't know?

Well the burden of the proof lies with the person that states something as a fact. What is the title of that blog post again ? Right. now let the author show you the proof. If he doesn't know then he shouldn't talk about something like it is a fact. The only fact in this whole debacle is that the FBI has been caught lying again,again and again. So they were lying then and people should believe them now ?

> Well the burden of the proof lies with the person that states something as a fact.

Sure, but they aren't really stating a fact. They are saying they don't know if it's fact or not.

I agree the title of the post is terrible and inaccurate, but the formatting of your comment is focused on the quote, not the title.

Re: Your iPhone just got less secure. Blame the FBI

#170

Post by wrsh07 »

zodPod wrote: post #165
adekok wrote: post #88

Earlier quoted context omitted.

> The probabilities change, even when a door you didn't pick [and doesn't hold the prize] is opened. That's the common misunderstanding of the problem. Most people think that the probabilities go fro 1/3, 1/3, 1/3 to 1/2, 1/2, after choosing a door and having Monty Hall open one of the others. The probabilities don't change. The probabilities are 1/3, 1/3, 1/3 at the start. After you choose a door, they're still 1/3,…

This is a great clarification of how this problem works. I STILL can't grasp why you'd switch. Since you have no idea which door it is, couldn't the 2/3 probability be applied to either his door or your door? For all you know, the one that he removed was just one random one of the goat doors. Your chance of picking the car was 1/3 before, if you could have the car already, why would it be better to switch now that he…

I find it clearer if you have 100 doors. Pick one. The host eliminates 98 doors [with no prize behind them].

Do you switch? Or do you stick with your original guess? As the parent mentioned, switching gives you a 99/100 chance of being correct, staying gives you a mere 1/100 chance.

Post reply on HN