Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Is Said to Be Working on an iPhone Even It Can’t Hack

nytimes.com

Post reply on HN
Print view View original

41–50 of 415 posts

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#41

Post by FussyZeus »

toomuchtodo wrote: post #30
r00fus wrote: post #26

Earlier quoted context omitted.

If they have access to a live finger for the TouchID, sure they can bypass - but they could do that with the $5 guaranteed coercion method as well [1]. Copying a good fingerprint from a dead finger or a randomly placed print is not easy [2]. It's hard, doable but you get 5 tries so if you screw up, you have thrown away all the hard work of the print transfer. All bets are off if the iPhone is power-cycled. Best bet i…

> All bets are off if the iPhone is power-cycled. Best bet if you're pulled over by authorities or at a security checkpoint is to turn off your iPhone (and have a strong alphanumeric passcode). Excellent advice. Even better, if you're about to pass through US customs and border patrol, backup the phone first, wipe, and restore on the other side. Of course, this depends on your level of paranoia. I am paranoid.

Wiping the phone doesn't help you. Using the strong password renders the information inaccessible, at least as inaccessible as your phone backup is. Touch ID isn't re-enabled until the phone's passcode is used. Presumably if the authorities have access to your phone's memory they also have access to your laptops, and neither will do them any damn good.

And it's paranoia if there's a legitimate threat, that's just called due diligence. ;)

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#42

Post by bobbles »

themagician wrote: post #10
w1ntermute wrote: post #8

Earlier quoted context omitted.

> if you use a strong alphanumeric password to unlock your phone, there is nothing Apple has been able to do for many years to unlock your phone Is this true even if you use Touch ID?

TouchID disables itself after 48 hours and requires the password again.

Also after 5 failed attempts - you can test with an unregistered finger

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#44

Post by quantumpotato_ »

cromwellian wrote: post #36

Any device that relies on hiding secrets inside the silicon itself is subject to hacking. Several secure-enclave like chips have been hacked in the past by using electron microscopes and direct probes on the silicon. If BlackHat conference independent security researchers have the resources to pull this off, Apple and the NSA certainly can. Exfiltrating the Enclave UID could be done by various mechanisms at the chip…

I upvoted because I think you are absolutely correct. Better security could be had with a two-factor system -- plug the phone into a cryptobox to decrypt. Having everything in one place is vulnerable.

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#45

Post by superuser2 »

r00fus wrote: post #26
w1ntermute wrote: post #8

Earlier quoted context omitted.

> if you use a strong alphanumeric password to unlock your phone, there is nothing Apple has been able to do for many years to unlock your phone Is this true even if you use Touch ID?

If they have access to a live finger for the TouchID, sure they can bypass - but they could do that with the $5 guaranteed coercion method as well [1]. Copying a good fingerprint from a dead finger or a randomly placed print is not easy [2]. It's hard, doable but you get 5 tries so if you screw up, you have thrown away all the hard work of the print transfer. All bets are off if the iPhone is power-cycled. Best bet i…

It is not a good bet if you're pulled over by the authorities to be doing something with your hands that they can't reliably identify as different from preparing a weapon. Particularly if not white.

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#46

Post by cmiller1 »

r00fus wrote: post #26
w1ntermute wrote: post #8

Earlier quoted context omitted.

> if you use a strong alphanumeric password to unlock your phone, there is nothing Apple has been able to do for many years to unlock your phone Is this true even if you use Touch ID?

If they have access to a live finger for the TouchID, sure they can bypass - but they could do that with the $5 guaranteed coercion method as well [1]. Copying a good fingerprint from a dead finger or a randomly placed print is not easy [2]. It's hard, doable but you get 5 tries so if you screw up, you have thrown away all the hard work of the print transfer. All bets are off if the iPhone is power-cycled. Best bet i…

Is it only five fails on TouchID to delete data? I don't have the option to delete the data enabled on my iPhone... but it often takes more than five tries to just get it to work on my finger that is legitimately registered in touchID.

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#47

Post by mahyarm »

toomuchtodo wrote: post #32
taneq wrote: post #19

Earlier quoted context omitted.

Does TouchID have any protections against your finger unlocking your phone post-mortem?

No, although I'd love to see a HealthKit app that uses your Apple Watch as a dead man's switch, and disables Touch ID or powers the phone off in the event the watch is removed or your pulse is no longer detected.

That wouldn't work well with loose wrists and other similar edge cases.

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#48

Post by newjersey »

rdancer wrote: post #16
w1ntermute wrote: post #8

Earlier quoted context omitted.

> if you use a strong alphanumeric password to unlock your phone, there is nothing Apple has been able to do for many years to unlock your phone Is this true even if you use Touch ID?

If the has been switched off or if >48h passed since the last unlock. Also remember that rubber-hose cryptanalysis is always an option.

Can you be convicted in the US based on evidence obtained with physical torture?

Edit: Looks like the answer is it depends and not a resounding no

http://www.nolo.com/legal-encyclopedia/evidence-obtained-thr...

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#49

Post by tptacek »

cromwellian wrote: post #36

Any device that relies on hiding secrets inside the silicon itself is subject to hacking. Several secure-enclave like chips have been hacked in the past by using electron microscopes and direct probes on the silicon. If BlackHat conference independent security researchers have the resources to pull this off, Apple and the NSA certainly can. Exfiltrating the Enclave UID could be done by various mechanisms at the chip…

A couple issues:

* Decapping and feature extraction even from simpler devices is error prone; you can destroy the device in the process. You only get one bite at the apple; you can't "image" the hardware and restore it later. Since the government is always targeting one specific phone, this is a real problem.

* There's no one byte you can write to bypass all the security on an iPhone, because (barring some unknown remanence effect) the protections come from crypto keys that are derived from user input.

* The phone is already using a serious KDF to derive keys, so given a strong passphrase, even if you extract the hardware key that's mixed in with passphrase, recovering the data protection key might still be difficult.

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#50

Post by abalone »

It's important to emphasize something: iCloud will always be "backdoored", by design, and backing up to iCloud is what most users should and will be doing.

The reason iCloud data will always be accessible by Apple, and thus governments, is not because Apple wants to make it accessible to governments. It's so that Apple can offer customers the very important feature of accessing their own data if they forget or otherwise don't have the password. That is an essential feature, and why this aspect will never change.

When someone passes away, for example, it would be a terrible compounding tragedy if all their photos from their whole life passed away along with them, because they didn't tell anyone their password or where they kept the backup key. So Apple wants and needs to provide an alternative way to recover the account. (For example, they will provide access to a deceased person's account if their spouse can obtain a court order proving the death and relationship.)

Harvard recent published a paper (called "Don't Panic") that essentially states the same.[1] Governments shouldn't "panic" because in most cases, consumers will not be exclusively using unbreakable encryption, because it has tradeoffs that aren't always desirable.

And the reason why most consumer should be backing up to iCloud is similar: that's how you prevent the tragedy of losing your data if you lose your phone.

Just something to keep in mind when discussing the "going dark" and "unhackable" news items.

It is worth noting however that people who do "have something to hide" from governments probably won't be using iCloud, if they know what they're doing. Then again if they know what they're doing, they wouldn't use anything that is backdoored anyway. So the naive criminals will still probably be hackable, and that's about all we can hope for.

[1] https://cyber.law.harvard.edu/pubrelease/dont-panic/Dont_Pan...

Post reply on HN