Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

404media.co

Post reply on HN
Print view View original

421–430 of 565 posts

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#421

Post by CGMthrowaway »

overfeed wrote: post #405
snuxoll wrote: post #389

Earlier quoted context omitted.

It's close enough, because (most of) the encryption keys are wiped from memory every time the device is locked, and this action makes the secure enclave require PIN authentication to release them again.

> It's close enough Not really, because tools like Cellbrite are more limited with BFU, hence the manual informing LEO to keep (locked) devices charged, amd the countermeasures being iOS forcefully rebooting devices that have been locked for too long.

There is a way now to force BFU from a phone that is turned on, I can't remember the sequence

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#422

Post by anigbrowl »

digiown wrote: post #373
tadzikpk wrote: post #357

Earlier quoted context omitted.

> I'm sad that a lot more people don't know that Signal for Desktop is much, much less secure against adversaries with your laptop Educate us. What makes it less secure?

The key in the desktop version is not always stored in the secure enclave, is my assumption (it definitely supports plaintext storage). Theoretically this makes it possible to extract the key for the message database. Also a different malicious program can read it. But this is moot anyway if the FBI can browse through the chats. This isn't what failed here.

Also last time I looked (less than 1 year ago) files sent over Signal are stored in plain, just with obfuscated filenames. So even without access to Signal it's easy to see what message attachments a person has received, and copy any interesting ones.

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#423

Post by notyourwork »

nova22033 wrote: post #236

Remember...they can make you use touch id...they can't make you give them your password. https://x.com/runasand/status/2017659019251343763?s=20 The FBI was able to access Washington Post reporter Hannah Natanson's Signal messages because she used Signal on her work laptop. The laptop accepted Touch ID for authentication, meaning the agents were allowed to require her to unlock it.

I don't get why I can be forced to use my biometrics to unlock but I cannot be forced to give a pin. Doesn't jive in my brain.

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#424

Post by pc86 »

reactordev wrote: post #302
pc86 wrote: post #23

Earlier quoted context omitted.

Serious question: What are the "valid concerns" about people securing their computing devices against third parties?

Pegasus. Jedi. SKyWIper. Rogue Actors. Rogue thief’s. Rogue governments. Your spouse. Separating corporate IT from personal IT. There’s plenty of reasons.

These are reasons to be able to secure your devices against third parties, not reasons you shouldn't be able to.

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#425

Post by coppsilgold »

mmooss wrote: post #282

Don't be idiots. The FBI may say that whether or not they can get in: 1. If they can get in, now people - including high-value targets like journalists - will use bad security. 2. If the FBI (or another agency) has an unknown capability, the FBI must say they can't get in or reveal their capabilities to all adversaries, including to even higher-profile targets such as counter-intelligence targets. Saying nothing also…

I would not recommend that one trust a secure enclave with full disk encryption (FDE). This is what you are doing when your password/PIN/fingerprint can't contain sufficient entropy to derive a secure encryption key.

The problem with low entropy security measures arises due to the fact that this low entropy is used to instruct the secure enclave (TEE) to release/use the actual high entropy key. So the key must be stored physically (eg. as voltage levels) somewhere in the device.

It's a similar story when the device is locked, on most computers the RAM isn't even encrypted so a locked computer is no major obstacle to an adversary. On devices where RAM is encrypted the encryption key is also stored somewhere - if only while the device is powered on.

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#426

Post by piperswe »

fragmede wrote: post #411
orwin wrote: post #376

Earlier quoted context omitted.

My opinion is that she set it up, it didn't work at first, she didn't use it, forgot that it existed, and here we are. > Apple devices share fingerprint matching details and another device had her details I looked into it quite seriously for windows thinkpads, unless Apple do it differently, you cannot share fingerprint, they're in a local chip and never move.

So how does TouchID on an external keyboard work without having to re-set up fingerprints?

Presumably the fingerprint data is stored in the Mac's Secure Enclave, and the external keyboard is just a reader

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#427

Post by fragmede »

warkdarrior wrote: post #331
delichon wrote: post #161

Earlier quoted context omitted.

Even if I had the skills to confirm the code is secure, how could I know that this is the code running on my phone, without also having the skills to build and deploy it from source?

Also, you need to make sure that the installation process does not insert a backdoor into the code you built from source.

Or the compilation process!

https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#428

Post by piperswe »

delichon wrote: post #90
UltraSane wrote: post #15

Samsung phones have the Secure Folder which can have a different, more secure password and be encrypted when the phone is on.

I use the Cryptomator app for this, it works as advertised. I keep ~60 GiB of personal files in there that would be an easy button to steal my identity and savings. I'm just hoping it doesn't include an NSA back door.

The NSA definitely has easier ways to steal your identity and savings if they wanted to anyways

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#429

Post by JumpCrisscross »

TylerLives wrote: post #412
JumpCrisscross wrote: post #398

Earlier quoted context omitted.

> I'd rather have unabused kids than the technological breakthroughs he has contributed to I'd rather have both. Hawthorne doesn't get nuked if Elon Musk goes to jail. > Children were exploited Abuse. Exploitation. CSAM. We're mushing words. Child rape. These men raped children. Others not only stayed silent in full knowledge of it, but supported it directly and indirectly. More than that, they arrogantly assumed–and…

[flagged]

Direct? No. That he was indicted for it? Yes [1].

(Clarification: I’m using the term colloquially. Whether Epstein had a mental condition is unclear.)

[1] https://www.justice.gov/usao-sdny/press-release/file/1180481...

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#430

Post by ceejayoz »

NoMoreNicksLeft wrote: post #395
pyrophane wrote: post #326

Earlier quoted context omitted.

Maybe. I don't think we yet have a good understanding of how many deaths he will have caused as a result of DOGE so abruptly cutting off assistance to so many vulnerable people around the world, but I've heard estimates hover around 600,000. Assuming that number turns out to be close to reality, how do you weigh so many unnecessary deaths against VTL rockets and the electric cars? Perhaps a practitioner of Effective…

[flagged]

> The US taxpayer has no moral obligation to send welfare "around the world".

Sure. It's a transactional purchase of stability and goodwill, via which the US has benefited enormously.

Post reply on HN