Apple Is Said to Be Working on an iPhone Even It Can’t Hack • Hacker News Board

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#361

Post by ccvannorman » Thu, Feb 25, 2016, 4:44 PM UTC

d-m wrote: post #357

eli_gottlieb wrote: post #321

Earlier quoted context omitted.

Of course it's a short-term marketing benefit. But , if the encryption is secure, then the marketing benefit is matching up with the customer benefit, so hey.

It's not clear that it IS a short-term benefit. Poll results are mixed (although the wording has a significant impact on the results) and a leading presidential candidate is calling for a boycott of their products. Marketing campaigns tend to be less polarizing. Also, I would imagine that losing the case would negatively impact sales more than if they had quietly complied.

Polls say whatever the poll-maker wants. Ask people if they support government surveillance, they say "Sure." Ask if they want the government to be able to access their Dick-Pics and the answer is a resounding NO[1]. Apple is on the right side of history here.

[1] https://www.youtube.com/watch?v=XEVlyP4_11M

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#362

Post by fluxquanta » Thu, Feb 25, 2016, 4:45 PM UTC

zeveb wrote: post #359

fluxquanta wrote: post #328

Earlier quoted context omitted.

The idea of Apple (or some other big corporation) providing my protected personal data to my next-of-kin is more frightening than the idea that the government has the ability to spy on me while I'm alive. It's the most morbid kind of subliminal marketing that could possibly exist. "Hey, we're really sorry about fluxquanta's passing. Here is his private data which he may or may not have wanted you to see (but we'll ju…

That's pretty standard, though: once you no longer exist, all your private data, all your private money, all your private goods become part of your estate, to be disposed of by your executor according to your will.

Things like money and personal physical property, sure, I understand that. But I feel like personal protected (encrypted) data should be treated differently. I'm thankful Google at least has options[0] available for their ecosystem, but I guess I'm going to need a will to cover the rest.

[0]https://support.google.com/accounts/answer/3036546?hl=en

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#363

Post by kevinnk » Thu, Feb 25, 2016, 4:52 PM UTC

nickpsecurity wrote: post #215

kevinnk wrote: post #209

Earlier quoted context omitted.

Could you be more specific? I've followed the NSA leaks with some interest, but not particularly closely, so I'd be really interested in seeing the actual presentation/document/whatever. For reference I've googled every combination of "nsa apple mobile OS leak" I could think of and couldn't find a primary source.

I Googled "nsa leak iOS" and found the first one: http://www.spiegel.de/international/world/how-the-nsa-spies-... Helps to type in just what you want and what will specifically have your answer. Mobile will give you garbage most of the time. Apple as well. A technical document will usually reference iOS. Also, you can use quotes to ensure something appears. Interesting enough, me typing what you typed into Google sti…

Sorry, maybe I should have been a little more specific. I was looking for a primary source that shows this part: "FBI talked about how they couldn't beat iPhones but NSA had them in the leaks & was parallel constructing to FBI." The link you posted only talks about "hacking" iPhones, but nothing about parallel construction. Additionally, it only talks about how the NSA is making use of the device's (local) backup. As far as I can tell that doesn't imply a hack of the iPhone itself.

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#364

Post by Evolved » Thu, Feb 25, 2016, 5:08 PM UTC

@everyone: All this hubbub and no guarantee the phone wasn't already wiped and/or doesn't contain any sensitive information because they didn't use that phone for those purposes.

@Udik: I could just keep my tax documents in printed plaintext on top of my dresser but I opt to keep them locked up. Privacy and security are important. If people who utilize privacy/security tools are up to no good then why does the U.S. Gov't have a clause for not revealing information due to State Secrets? Why do we set our Facebook profiles to private? Why have passwords at all on anything? Are you beginning to see the point?

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#365

Post by criddell » Thu, Feb 25, 2016, 5:15 PM UTC

geertj wrote: post #305

I've been very impressed with what I've learned in the last few weeks regarding Apple's efforts to provide privacy for its customer using what it seems some very robust engineering and design. I'm currently an Android user (Samsung S6 edge) but am considering seriously going back to the iPhone because of this. The cynical side of me says that Apple's marketing tactics have worked. But I've got a feeling, heck, I want…

I wonder if Microsoft came out with Palladium (https://en.wikipedia.org/wiki/Next-Generation_Secure_Computi...) today, if it would be hailed as a great development for privacy or would still garner lots of criticism as it did 10 years ago.

Of Palladium, Bruce Scheier said:

> "There's a lot of good stuff in Pd, and a lot I like about it. There's also a lot I don't like, and am scared of. My fear is that Pd will lead us down a road where our computers are no longer our computers, but are instead owned by a variety of factions and companies all looking for a piece of our wallet. To the extent that Pd facilitates that reality, it's bad for society. I don't mind companies selling, renting, or licensing things to me, but the loss of the power, reach, and flexibility of the computer is too great a price to pay."

I think his fears have come true to some extent in iOS, but knowing what we know now about government surveillance of everybody, it may no longer seem like too great a price to pay. That is, if you trust the vendor. Apple seems to be worthy of that trust. But Microsoft...?

Edit: formatting

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#366

Post by maqr » Thu, Feb 25, 2016, 5:29 PM UTC

criddell wrote: post #365

geertj wrote: post #305

I've been very impressed with what I've learned in the last few weeks regarding Apple's efforts to provide privacy for its customer using what it seems some very robust engineering and design. I'm currently an Android user (Samsung S6 edge) but am considering seriously going back to the iPhone because of this. The cynical side of me says that Apple's marketing tactics have worked. But I've got a feeling, heck, I want…

I wonder if Microsoft came out with Palladium ( https://en.wikipedia.org/wiki/Next-Generation_Secure_Computi... ) today, if it would be hailed as a great development for privacy or would still garner lots of criticism as it did 10 years ago. Of Palladium, Bruce Scheier said: > "There's a lot of good stuff in Pd, and a lot I like about it. There's also a lot I don't like, and am scared of. My fear is that Pd will lead…

> Apple seems to be worthy of that trust.

Oh no... it's working...

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#367

Post by nickik » Thu, Feb 25, 2016, 5:44 PM UTC

geertj wrote: post #316

erkkie wrote: post #311

Earlier quoted context omitted.

Anything specifically missing on android side except the PR? Seriously asking if I'm missing something. The nexus series has comparable crypto hw and similar options for encryption + wiping.

Two things come to mind. First an equivalent of the secure enclave. Second a single company that is willing to go this far to protect its users. For Samsung this is complicated because both Google and Samsung are involved, and Samsung is not a US company so I'd expect them to cave in under pressure from the US govt more easily. Edit: a Nexus device bought directly from Google with the right hw may address both points…

I have been looking at the Snapdragon 820 and it at least on that level, it does not seem that android devices should mis anything. The new Sense Id is an improved Touch Id, and I mean that both in terms of the finger print sensor itself, as well as the hardware protection itself. They implemented full UAF in the SecureMSM for the authentification. The best thing is that this is exposed to the layers above and can be leveriged in the growing fido ecosystem.

The major issue with android systems does not seem to be lacking software and hardware, but rather the unwillingnes of providers to push best practices as defaults to all users.

I somewhat agree and somewhat disagree with your analysis of the politics. Their are both advantages and disadvantages of both situations

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#368

Post by nickik » Thu, Feb 25, 2016, 5:47 PM UTC

bilbo0s wrote: post #352

erkkie wrote: post #311

Earlier quoted context omitted.

Anything specifically missing on android side except the PR? Seriously asking if I'm missing something. The nexus series has comparable crypto hw and similar options for encryption + wiping.

https://news.ycombinator.com/item?id=10250803 I'll repost a snippet from a post by merhdada that hints at the root of one of the problems with android security: "This can happen only because of a design flaw in the security architecture of Android (L). Unlike iOS and like traditional PCs, the disk encryption key is always in memory when the device is booted and nothing is really protected if you get a device in that…

IPhone data is just as much on corporate servers.

To bad flock does not exist any more, a droping replacement for google sync with end to end crypto. Very nice.

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#369

Post by nickpsecurity » Thu, Feb 25, 2016, 5:57 PM UTC

Udo_Schmitz wrote: post #288

nickpsecurity wrote: post #215

Earlier quoted context omitted.

I Googled "nsa leak iOS" and found the first one: http://www.spiegel.de/international/world/how-the-nsa-spies-... Helps to type in just what you want and what will specifically have your answer. Mobile will give you garbage most of the time. Apple as well. A technical document will usually reference iOS. Also, you can use quotes to ensure something appears. Interesting enough, me typing what you typed into Google sti…

If you are asked for a source it doesn't look great to begin your answer with: "I googled …" About the linked article: out of date (2013, mentions iOS 4.3.3). Very thin on actual information. 90% of article is about Blackberry but insinuates same risks for iOS. As a German I wouldn’t trust Der Spiegel anyway: when it come to IT issues my fellow countrymen are often fueled by longstanding anti-americanism and technoph…

He said he couldn't find anything on the topic Googling. When anyone does that, the first thing I do is Google exactly what they said. Usually turns up something. Then I point that as if I wonder how much research they actually did. If they otherwise seem alright, I might also give tips on how I get decent results out of search engines.

"About the linked article: out of date (2013, mentions iOS 4.3.3). Very thin on actual information. "

It's what I got out of a quick Google. I was unwilling to spend more time on that angle as my list of risks plus Apple's development practices shows we should consider it untrustworthy by default. I just don't feel like putting too much time into finding the specific evidence NSA might hit a specific version of a product that wasn't secure in its entire history. Also, which came from a company whose products did things like require an admin login on certain services but not check if password matches records: just the existence of a password in submission was enough. Better to spend that time on researching actual security. ;)

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#370

Post by nickpsecurity » Thu, Feb 25, 2016, 6:04 PM UTC

kevinnk wrote: post #363

nickpsecurity wrote: post #215

Earlier quoted context omitted.

I Googled "nsa leak iOS" and found the first one: http://www.spiegel.de/international/world/how-the-nsa-spies-... Helps to type in just what you want and what will specifically have your answer. Mobile will give you garbage most of the time. Apple as well. A technical document will usually reference iOS. Also, you can use quotes to ensure something appears. Interesting enough, me typing what you typed into Google sti…

Sorry, maybe I should have been a little more specific. I was looking for a primary source that shows this part: "FBI talked about how they couldn't beat iPhones but NSA had them in the leaks & was parallel constructing to FBI." The link you posted only talks about "hacking" iPhones, but nothing about parallel construction. Additionally, it only talks about how the NSA is making use of the device's (local) backup. As…

Oh, OK. That makes more sense. As I said to other commenter, I'm not doing enough research to figure out how they're hacking it directly. There's so many published hacks of hardware and firmware that were designed for secure operation that it would be a miracle if they didn't have something on iPhones. It's more a "insecure-by-default" if it doesn't address what's on my list of attack vectors. I know it doesn't because it wouldn't be compatible with legacy ARM or iOS code without modifications. ;)

Far as parallel construction, let me see if I can quickly Google something. Here's you a few on it early on with FBI and DEA's stronger cooperation.

https://www.techdirt.com/articles/20150427/11042430811/nsas-...

http://www.reuters.com/article/us-dea-sod-idUSBRE97409R20130...

Further, they'll actually let a criminal go just to prevent either the public or courts learning the details of defense-related techniques. The Stingrays are a perfect example:

http://arstechnica.com/tech-policy/2015/04/fbi-would-rather-...