'Karma': A hack used by the UAE to break into iPhones of foes • Hacker News Board

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#181

Post by int_19h » Wed, Jan 30, 2019, 11:19 PM UTC

794CD01 wrote: post #127

pjc50 wrote: post #96

Earlier quoted context omitted.

The "hashing time per crack" reminds me of the old 48-bit encryption which was mandated to have short, crackable keys. Or even the previous attempt at doing this with the "LEAF". Are you proposing some sort of work function within the crypto enclave ? ie you leave the device brute-forcing for a few days and it spits out the key? The "appreciable time" is going to be subject to constant downward pressure, both politic…

>Mass surveillance is not going to go away without huge cultural reform of the security services. They don't take concessions. FakeComments was mostly talking about targeted surveillance, but I agree with him/her in spirit, since I believe that mass surveillance is not going to go away. Ever. So you can either yell futilely into the wind as it happens over your objections, up to, including, and perhaps going beyond a…

It's not going to happen on "slightly preferable terms". Either those with political power in society want surveillance, or they don't. If they do, they'll take all that they can get, and the only thing cooperating with them will do is make it all happen faster - the moment you provide a "compromise" surveillance scheme to them on a silver platter is the moment when they'll start devising how to get around the remaining limits.

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#182

Post by cronix » Wed, Jan 30, 2019, 11:21 PM UTC

While I find this absolutely disgusting and horrifying, at the same time I hope this becomes extremely widespread and rapidly. This needs to happen to Americans. Only then will we, the collective we, wake up and actually do something and maybe start to take privacy and security seriously.

I am rapidly becoming anti tech, as I think I can clearly see where this is all going. That's hard for me to say, as my whole life has been tech focused. I'm 47 and started coding when I was 10. My whole life centers around it, and always has.

Hitler, Stalin and Mao would have absolutely loved to be alive today and have these types of tools. Maybe we need another 100M deaths to see what this kind of information and power leads to. We are recording everything we do digitally, all to be easily analyzed by whomever comes to power at some future point of time, where the rules might be different. Most of what is recorded about us we don't even know. It will also be easier to find all of the relatives, so they can be killed off too. They like to make examples and ensure no one steps out of line. They don't just kill you, they kill 1-2 generations of your family.

This data won't go away. Ever. They will know who likes what, who supports what, etc. Just a keyword search away from getting a list of names and addresses. We think we are so clever. We are building our future jail. For the first time in history, we have the ability to track every single minute detail about a persons life from birth til death, in extreme, high resolution which grows by the day. I don't just know you went from point A to point B. I know the exact route you took, how long it took to complete each segment, how long you stopped at each place along the way, what those places were, etc. That's just gps data.

I saw the 60 Minutes piece on PlanetLabs recent launch of 300 satellites. They're taking pics of the globe in very hi resolution, constantly. Better than some of our spy sats. Oh, and anyone can access that data. It's free! They showed how they were able to go back in time to when the compound that Osama Bin Laden killed in was built. They were then able to create a very accurate model of the compound which led to the raid that killed him by going so far back in time to when they started building the thing. Obviously we think that's a good thing because it led to a mass murderers death, but think about that technology.... recording everything 24/7, globally, going back years in time to reconstruct something that happened in the past... https://www.cbsnews.com/news/private-company-launches-larges...

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#183

Post by Scoundreller » Wed, Jan 30, 2019, 11:37 PM UTC

AnimalMuppet wrote: post #118

LeifCarrotson wrote: post #73

Earlier quoted context omitted.

> "That it is better 100 guilty Persons should escape than that one innocent Person should suffer, is a Maxim that has been long and generally approved." I wonder if that maxim is still generally approved. It seems like some authoritarians would prefer that 100 innocents would suffer than one guilty person should escape. I suppose it depends how you define "innocent" and "suffer". Under modern law, everyone is guilty…

I think, even in places that believed the maxim, 9/11 changed the calculation. Now the question is: How many innocent people should be jailed in order that 3000 innocent people not be killed? Mind you, I'm not saying it's right . I'm just saying that this is how the authorities are thinking.

Or how many billions of hour-lives should we steal a minute or hour at a time from to save X lives?

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#184

Post by AgentME » Wed, Jan 30, 2019, 11:59 PM UTC

smolder wrote: post #160

acct1771 wrote: post #100

Earlier quoted context omitted.

Perfect. Then, just hope people follow rules.

Sometimes you have to disincentivize behavior with prison time and things like that and then hope people don't do it. Trying to prevent some crimes ahead of time is a recipe for dystopia.

In this case, "trying to prevent some crimes [of government employees leaking the golden key]" possibly means "don't make a golden key that lets governments freely hack everyone", which is generally being regarded in this thread as the non-dystopian result.

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#185

Post by house_atr » Thu, Jan 31, 2019, 12:07 AM UTC

house_atr wrote: post #80

zaroth wrote: post #13

Whether or not this hack was developed with the help of Apple (a “backdoor”) or by a third-party exploit, this is exactly what a “golden key” looks like after it gets in the wild. An espionage tool developed by a major world power proliferates to totalitarian regimes, aided and operated by ex-NSA agents on the payroll, to compromise human rights activists and the political opposition. If ever there was proof that our…

"Totalitarian regime" I stop reading whenever I hear doublespeak. You need to find a new way to address countries that aren't western democracies. Especially since the rest of the world is catching up, you won't hold this monopoly on labels for much longer.

Hahaha feed me your downvotes. It fuels me and validates how much of a threat it is to you to treat world affairs without cartoon labels.

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#186

Post by tlrobinson » Thu, Jan 31, 2019, 12:29 AM UTC

> and former American intelligence operatives working as contractors for the UAE’s intelligence services

At what point does this become considered treason?

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#187

Post by cfv » Thu, Jan 31, 2019, 12:39 AM UTC

I can't help but giggle at the thought of Emirati hackers. For whatever reason my mind can't wrap around the fact that an extremely religious people can also be at the high end of tech (at the very least high enough to figure out 0days and such).

Does anyone have any info on since when this has actually been like this? I'd like to look up how their CS education works and that kind of stuff.

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#188

Post by p1necone » Thu, Jan 31, 2019, 1:10 AM UTC

trhway wrote: post #88

>A team of former U.S. government intelligence operatives working for the United Arab Emirates no non-competes? So, when Snowden tells to public about mere existence of NSA hacks - it is a crime, yet when an intelligence operative brings his NSA and the likes sourced detailed technical knowledge to a foreign government - that is kosher.

Well yeah, our leaders don't care nearly as much if you go and do shady shit for other leaders as they do about you exposing their own shady shit to the general population. Don't assume the US government is ever going to act in good faith about this kind of stuff.

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#189

Post by FakeComments » Thu, Jan 31, 2019, 1:33 AM UTC

basilgohar wrote: post #164

FakeComments wrote: post #55

Earlier quoted context omitted.

That’s a deep straw man of what I said, to the point of being non-constructive mocking. You’re just being dishonest to claim I suggested trusting the spy agencies. Rather, I pointed out that they have a real mission, and they’re going to spend effort accomplishing it. But their mission isn’t to own every device — it’s to own a select few, probably on the order of hundreds or thousands a year. So, if we create a mecha…

> But their mission isn’t to own every device — it’s to own a select few, probably on the order of hundreds or thousands a year. This is patently untrue. Snowden and much more have made it absolutely, unambiguously clear that national spy agencies do wish to gather and collect absolutely and every bit of information possible about their own law-abiding citizens as well as those here that are not.

Could you cite anything supporting that?

I followed the Snowden leaks quite closely, but don’t remember anything close to unambiguously showing that.

Re: 'Karma': A hack used by the UAE to break into iPhones of foes

#190

Post by FakeComments » Thu, Jan 31, 2019, 1:38 AM UTC

int_19h wrote: post #180

FakeComments wrote: post #49

Earlier quoted context omitted.

I disagree with the conclusion of absolute security — it won’t happen, and only encourages subversion by people who both need and have a right to access the content. Instead of pontificating, the tech industry should innovate. There’s no reason that hashchains can’t be used to timelock the key, and the enclave export it in response to a signed request. Then we can at least force the compromises through the legal syst…

> What’s not going to sell, and what the tech industry needs to get over is “lulz, it’ll impossible to intercept military or terrorist information because I need absolute privacy for my saucy emails”. I think it’s been empirically demonstrated that won’t happen. It's very much the other way. Strong encryption algorithms have been available to the public for a long time now. You can ban using them, but the only way to…

I disagree with your analysis — the way most people receive encryption, including criminals and terrorists, is through a provider. Regulating their behavior does change the general trend in security. Further, forcing them to implement their own encryption increases the likelihood they make a mistake while also refocusing the NSA et al to those algorithms instead.

What we’ve seen is governments subverting encryption and systems repeatedly, in ways they wouldn’t if they had other methods.

I’m not trying to accomplish some absolute ideological position, I’m trying to shift the state of affairs to realign incentives for several players. If some people write their own encryption, or the technologists use GPG everywhere, whatever.

> allow them to have a society-wide dragnet

I don’t think you even read my proposal: the mechanism I proposed makes that impossible, which is in contrast to the current state of affairs, where they subvert the security of the entire system instead of targeted people. Allowing for targeted cracking at a certain level of expense and requiring physical possession of the device in no way enables mass dragnets, and in fact, removes their legal cover by providing alternative means.

I’m not saying people can’t invent their own security — just that factory made safes need to not be “unbreakable”, because it just incentivized bad behavior when they discover a flaw and/or subverting the integrity of the factory.