Apple Is Said to Be Working on an iPhone Even It Can’t Hack

Post by crgt » Thu, Feb 25, 2016, 3:26 AM UTC

dylan604 wrote: post #166

jameshart wrote: post #119

Earlier quoted context omitted.

Corporate email profiles on BYOD phones often enforce a long passcode requirement, so you've got a lot of Fortune 500 sales guys to screen out if you're stopping and searching anybody with a suspiciously long password.

I'm at a loss as to how alphabet agency can determine a weak passcode vs strong passcode was used. how does a pin get stored on the phone? surely, not plain text of a 4 digit pin. if they do any encryption to the 4 digit pin, how would it appear any different than a significantly stronger passcode?

Post by Spooky23 » Thu, Feb 25, 2016, 3:34 AM UTC

teacup50 wrote: post #96

tptacek wrote: post #2

They're presumably already 99% of the way there. If the Secure Enclave can be updated on a locked phone, all they need to do is stop allowing that, right? To me, the more profound consideration is this: if you use a strong alphanumeric password to unlock your phone, there is nothing Apple has been able to do for many years to unlock your phone. The AES-XTS key that protects data on the device is derived from your pas…

They're not anywhere near 99% of the way there; they've destroyed the heterogeneous decentralized ecosystem that broad security requires. Locking themselves out of the Secure Enclave isn't anywhere near sufficient. As long as the device software and trust mechanisms are totally opaque and centrally controlled by Apple, the whole thing is just a facade. There's almost nothing Apple can't push to the phone, and the aud…

Post by rsync » Thu, Feb 25, 2016, 3:45 AM UTC

tptacek wrote: post #2

They're presumably already 99% of the way there. If the Secure Enclave can be updated on a locked phone, all they need to do is stop allowing that, right? To me, the more profound consideration is this: if you use a strong alphanumeric password to unlock your phone, there is nothing Apple has been able to do for many years to unlock your phone. The AES-XTS key that protects data on the device is derived from your pas…

Post by nickpsecurity » Thu, Feb 25, 2016, 3:47 AM UTC

kevinnk wrote: post #126

nickpsecurity wrote: post #74

My last write-up on smartphone risks applies to this discussion. https://news.ycombinator.com/item?id=10906999 Apple is far from having a secure phone right now. NSA certainly has ways to bypass this based on my attack framework and their prior work. They just don't want them to be known. They pulled the same stuff in the past where FBI talked about how they couldn't beat iPhones but NSA had them in the leaks & was p…

> They pulled the same stuff in the past where FBI talked about how they couldn't beat iPhones but NSA had them in the leaks & was parallel constructing to FBI. Do you have a link to a leak that shows this? I couldn't find anything with a simple google search.

Post by jfoster » Thu, Feb 25, 2016, 3:49 AM UTC

tptacek wrote: post #49

cromwellian wrote: post #36

Any device that relies on hiding secrets inside the silicon itself is subject to hacking. Several secure-enclave like chips have been hacked in the past by using electron microscopes and direct probes on the silicon. If BlackHat conference independent security researchers have the resources to pull this off, Apple and the NSA certainly can. Exfiltrating the Enclave UID could be done by various mechanisms at the chip…

A couple issues: * Decapping and feature extraction even from simpler devices is error prone; you can destroy the device in the process. You only get one bite at the apple; you can't "image" the hardware and restore it later. Since the government is always targeting one specific phone, this is a real problem. * There's no one byte you can write to bypass all the security on an iPhone, because (barring some unknown re…