Apple Is Said to Be Working on an iPhone Even It Can’t Hack

Post by Piskvorrr » Thu, Feb 25, 2016, 8:31 AM UTC

abalone wrote: post #113

autoreleasepool wrote: post #105

Earlier quoted context omitted.

I actually intend for my private data to die with me. I have gone out of my way to guarantee that it will. In my view, if I haven't published it, then it shouldn't be accessible. I have absolutely nothing to hide. I have simply always treated my privacy as something that was valuable in it of itself. Perhaps even more valuable than the photos I clearly opted to not share with others, to go off your example. I also do…

Since you're responding to me I'm assuming you mean me, but I have no problem conceptualizing non-malicious things you would want to keep private. The problem here is that a lot of the stuff stored on phones falls somewhere between "dies with me" private and "should pass on to my family" private. Or "should be recoverable if I lose my key" private. Strong encryption makes it impossible to recover in the event of a lo…

Post by goldenkey » Thu, Feb 25, 2016, 8:47 AM UTC

Ayaz wrote: post #225

jacobparker wrote: post #106

Earlier quoted context omitted.

There's also a 48 hour window and touch ID doesn't work initially after booting. https://support.apple.com/en-us/HT204587 Great design.

Not only the amount of work, technology and thought that have gone into this, but also how well this has been implemented is mind-blowing.

Post by nicky0 » Thu, Feb 25, 2016, 8:58 AM UTC

cromwellian wrote: post #64

tptacek wrote: post #49

Earlier quoted context omitted.

A couple issues: * Decapping and feature extraction even from simpler devices is error prone; you can destroy the device in the process. You only get one bite at the apple; you can't "image" the hardware and restore it later. Since the government is always targeting one specific phone, this is a real problem. * There's no one byte you can write to bypass all the security on an iPhone, because (barring some unknown re…

No, the chief protection against the PIN code hacking comes from the retry counter. The FBI doesn't need the crypto keys, it just needs the PIN code. So it needs to brute force about 10,000 PIN codes. Any mechanism that prevents the application processor from either a) remembering it incremented the count b) corrupts the count or c) patches the logic that handles a retry count of 10, is sufficient to attack the phone…

Post by Piskvorrr » Thu, Feb 25, 2016, 9:17 AM UTC

zobzu wrote: post #234

"Impossible for security agency to hack" Nothing is 100% proof, crypto certainly isn't. It's going from child's play to "you actually need to knowledge" to "this is actually hard now" (but.. not impossible).

Post by majewsky » Thu, Feb 25, 2016, 9:24 AM UTC

aianus wrote: post #123

cromwellian wrote: post #88

Earlier quoted context omitted.

I'm speaking the case of the San Bernardino killers. Using strong alphanumeric pass phrases are anti-usability, the vast majority of people won't use them. Hell, the vast majority of people don't even have strong alphanumeric passwords on desktop services. So it falls to either 2-factor or biometric to avoid PINs. Biometric of course has it's own problems. Perhaps people should really carry around a Secure Enclave on…

You only need the strong alphanumeric pass phrases on device startup, then you can use TouchID. I bought an iPhone 6 for exactly this reason (employer required strong passphrase, was too annoying to type in on the Android device I had at the time).