Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Your iPhone just got less secure. Blame the FBI

washingtonpost.com

Post reply on HN
Print view View original

211–220 of 255 posts

Re: Your iPhone just got less secure. Blame the FBI

#211

Post by camillomiller »

ryao wrote: post #106
exelius wrote: post #86

Earlier quoted context omitted.

> Lest you jump to the argument that this would endanger operations, I would still point out two very salient facts: this information is not intelligence data, and as Schneier pointed out, this attack can be used against many in the US government, including FBI agents in the field. Getting it fixed is the right thing to do. I agree with you that given the facts we know today, notifying Apple is the right thing to do.…

We do not even know if the FBI knows the vulnerability. The phone could have been attacked by a contractor working for the FBI without the contractor sharing the tools.

This is a great point. Cellebrite's known for their black box approach. Law enforcements and Courts can send their locked iPhone and get it back unlocked. They'll just get the job done without knowing what was actually performed on the phone. This might as well be the case here.

Re: Your iPhone just got less secure. Blame the FBI

#212

Post by logfromblammo »

logfromblammo wrote: post #210
pklausler wrote: post #186

Earlier quoted context omitted.

I should have just given the other problem, sorry for the laziness. Your friend tells you that she has two children. They're not both boys, she adds. What are the odds that they're both girls? (Obviously 1/3). When she tells you that one child is named Mary, the odds that they're both girls change (to 1/2)! Even though you knew that at least one of the children was a girl, and the name might as well be arbitrary, and…

After first datum (there are two children): Presuming A and B to be independent events (first child is a girl, second child is a girl) P(A) = 1 - P(!A) = 1/2 P(B) = 1 - P(!B) = 1/2 P(A and B) = P(B|A) * P(A) = 1/2 * 1/2 = 1/4 P(A and !B) = P(!B|A) * P(A) = 1/2 * 1/2 = 1/4 P(!A and B) = P(B|!A) * P(!A) = 1/2 * 1/2 = 1/4 P(!A and !B) = P(!B|!A) * P(!A) = 1/2 * 1/2 = 1/4 Good so far. But the probability later on depends…

Now see if you can work it out if your friend told you this beforehand:

Between pregnancies, I had an accident that resulted in an odd medical condition. The doctors said that after it happened, 50% of boy fetuses that otherwise would have resulted in pregnancy would simply fail to implant, and I wouldn't even know about it.

Now there's an all new ambiguity. How do you decide whether your friend was planning on having two children all along, or if she has two children because that's how many times she got pregnant?

Re: Your iPhone just got less secure. Blame the FBI

#213

Post by grahamburger »

zodPod wrote: post #165
adekok wrote: post #88

Earlier quoted context omitted.

> The probabilities change, even when a door you didn't pick [and doesn't hold the prize] is opened. That's the common misunderstanding of the problem. Most people think that the probabilities go fro 1/3, 1/3, 1/3 to 1/2, 1/2, after choosing a door and having Monty Hall open one of the others. The probabilities don't change. The probabilities are 1/3, 1/3, 1/3 at the start. After you choose a door, they're still 1/3,…

This is a great clarification of how this problem works. I STILL can't grasp why you'd switch. Since you have no idea which door it is, couldn't the 2/3 probability be applied to either his door or your door? For all you know, the one that he removed was just one random one of the goat doors. Your chance of picking the car was 1/3 before, if you could have the car already, why would it be better to switch now that he…

The most clear way that I've heard it described is by scaling it up to 100 doors or so, and then removing 98 doors instead of removing 1. (This is mentioned elsewhere in the thread.) It would be interesting to see the results of your test using this method. It seems intuitively clear with 100 doors that switching is the better method.

Re: Your iPhone just got less secure. Blame the FBI

#214

Post by kodablah »

ctdonath wrote: post #189

The "vulnerabilities equities process", adopted in 2010, requires the FBI disclose the exploit details to Apple on request. More info can be found in am EFF case: https://www.eff.org/files/2014/07/01/eff_v_nsa_odni_-_foia.p...

Maybe I misread the redacted doc [0] but from what I see, it is sent to the Entities Review Board (ERB) that then determines whether they should disseminate. I was unable to find the requirement to disclose. Can you point to it?

0 - https://www.eff.org/document/vulnerabilities-equities-proces...

Re: Your iPhone just got less secure. Blame the FBI

#215

Post by pklausler »

logfromblammo wrote: post #212
logfromblammo wrote: post #210

Earlier quoted context omitted.

After first datum (there are two children): Presuming A and B to be independent events (first child is a girl, second child is a girl) P(A) = 1 - P(!A) = 1/2 P(B) = 1 - P(!B) = 1/2 P(A and B) = P(B|A) * P(A) = 1/2 * 1/2 = 1/4 P(A and !B) = P(!B|A) * P(A) = 1/2 * 1/2 = 1/4 P(!A and B) = P(B|!A) * P(!A) = 1/2 * 1/2 = 1/4 P(!A and !B) = P(!B|!A) * P(!A) = 1/2 * 1/2 = 1/4 Good so far. But the probability later on depends…

Now see if you can work it out if your friend told you this beforehand: Between pregnancies, I had an accident that resulted in an odd medical condition. The doctors said that after it happened, 50% of boy fetuses that otherwise would have resulted in pregnancy would simply fail to implant, and I wouldn't even know about it. Now there's an all new ambiguity. How do you decide whether your friend was planning on havin…

Here's an epistemological head-scratcher: do the odds still change if you don't hear the daughter's name accurately? Why?

Re: Your iPhone just got less secure. Blame the FBI

#216

Post by SeoxyS »

zodPod wrote: post #165
adekok wrote: post #88

Earlier quoted context omitted.

> The probabilities change, even when a door you didn't pick [and doesn't hold the prize] is opened. That's the common misunderstanding of the problem. Most people think that the probabilities go fro 1/3, 1/3, 1/3 to 1/2, 1/2, after choosing a door and having Monty Hall open one of the others. The probabilities don't change. The probabilities are 1/3, 1/3, 1/3 at the start. After you choose a door, they're still 1/3,…

This is a great clarification of how this problem works. I STILL can't grasp why you'd switch. Since you have no idea which door it is, couldn't the 2/3 probability be applied to either his door or your door? For all you know, the one that he removed was just one random one of the goat doors. Your chance of picking the car was 1/3 before, if you could have the car already, why would it be better to switch now that he…

This is the one article that made me fully grasp it forever. I've known about this for ages, but it never really clicked until I read it put this way:

http://waitbutwhy.com/2016/03/the-jellybean-problem.html

Re: Your iPhone just got less secure. Blame the FBI

#217

Post by woodman »

ikeboy wrote: post #209
woodman wrote: post #184

Earlier quoted context omitted.

Again, victim blaming. How is that any different from the false choice "We can do this the hard way, or the easy way"? Have you considered what will happen to the number of such requests as devices continue to become more secure?

As devices become more secure, Apple will no longer be able to unlock them. If you put a backdoor into your phones, you should expect to have to use it.

> As devices become more secure, Apple will no longer be able to unlock them.

That is only true if revoking trust is the only thing left to do to increase iphone security against every potential bad actor. That isn't the case, and that leaves plenty of time to pester Apple with unlocking phones collected in every investigation from now until then.

> If you put a backdoor into your phones, you should expect to have to use it.

What law is that, the All Writs act? That is what was being tested, because not everybody shares your certainty about it. The moral problem of the forced labor of an unrelated party is enough to make me disagree. Also, that logic could easily be used to justify the forced inclusion of a backdoor in an otherwise secure device. You can't have it both ways, a secure device and a device manufactured by a company that can be legally compelled to do whatever the state deems "necessary or appropriate".

Re: Your iPhone just got less secure. Blame the FBI

#218

Post by ikeboy »

woodman wrote: post #217
ikeboy wrote: post #209

Earlier quoted context omitted.

As devices become more secure, Apple will no longer be able to unlock them. If you put a backdoor into your phones, you should expect to have to use it.

> As devices become more secure, Apple will no longer be able to unlock them. That is only true if revoking trust is the only thing left to do to increase iphone security against every potential bad actor. That isn't the case, and that leaves plenty of time to pester Apple with unlocking phones collected in every investigation from now until then. > If you put a backdoor into your phones, you should expect to have to…

I don't think labor should be forced, but data should be accessible. Apple had the keys to use the backdoor, and they should have been forced to choose between using them to sign software, or handing them over and letting the FBI sign it themselves. Apple would prefer to sign it themselves, so they can effectively be forced to do so.

I disagree that they can force the inclusion of a backdoor using the same logic. The reason I think they can compel action is that the real thing they want from Apple is information, I.e. the key. Apple can get out of revealing the key by using it themselves.

Re: Your iPhone just got less secure. Blame the FBI

#219

Post by c22 »

camillomiller wrote: post #211
ryao wrote: post #106

Earlier quoted context omitted.

We do not even know if the FBI knows the vulnerability. The phone could have been attacked by a contractor working for the FBI without the contractor sharing the tools.

This is a great point. Cellebrite's known for their black box approach. Law enforcements and Courts can send their locked iPhone and get it back unlocked. They'll just get the job done without knowing what was actually performed on the phone. This might as well be the case here.

Doesn't this approach cast doubt on the legitimacy of any evidence obtained from the device?

Re: Your iPhone just got less secure. Blame the FBI

#220

Post by [deleted] »

camillomiller wrote: post #211
ryao wrote: post #106

Earlier quoted context omitted.

We do not even know if the FBI knows the vulnerability. The phone could have been attacked by a contractor working for the FBI without the contractor sharing the tools.

This is a great point. Cellebrite's known for their black box approach. Law enforcements and Courts can send their locked iPhone and get it back unlocked. They'll just get the job done without knowing what was actually performed on the phone. This might as well be the case here.

[deleted]
Post reply on HN