Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

404media.co

Post reply on HN
Print view View original

451–460 of 565 posts

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#451

Post by pregnenolone »

coppsilgold wrote: post #425
mmooss wrote: post #282

Don't be idiots. The FBI may say that whether or not they can get in: 1. If they can get in, now people - including high-value targets like journalists - will use bad security. 2. If the FBI (or another agency) has an unknown capability, the FBI must say they can't get in or reveal their capabilities to all adversaries, including to even higher-profile targets such as counter-intelligence targets. Saying nothing also…

I would not recommend that one trust a secure enclave with full disk encryption (FDE). This is what you are doing when your password/PIN/fingerprint can't contain sufficient entropy to derive a secure encryption key. The problem with low entropy security measures arises due to the fact that this low entropy is used to instruct the secure enclave (TEE) to release/use the actual high entropy key. So the key must be sto…

RAM encryption doesn’t prevent DMA attacks and perofming a DMA attack is quite trivial as long as the machine is running. Secure enclaves do prevent those and they're a good solution. If implemented correctly, they have no downsides. I'm not referring to TPMs due to their inherent flaws; I’m talking about SoC crypto engines like those found in Apple’s M series or Intel's latest Panther Lake lineup. They prevent DMA attacks and side-channel vulnerabilities. True, I wouldn’t trust any secure enclave never to be breached – that’s an impossible promise to make even though it would require a nation-state level attack – but even this concern can be easily addressed by making the final encryption key depend on both software key derivation and the secret stored within the enclave.

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#452

Post by direwolf20 »

nova22033 wrote: post #236

Remember...they can make you use touch id...they can't make you give them your password. https://x.com/runasand/status/2017659019251343763?s=20 The FBI was able to access Washington Post reporter Hannah Natanson's Signal messages because she used Signal on her work laptop. The laptop accepted Touch ID for authentication, meaning the agents were allowed to require her to unlock it.

Remember, this isn't how it works in every country.

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#453

Post by direwolf20 »

OGWhales wrote: post #403
noident wrote: post #387

Earlier quoted context omitted.

That's a very unusual and narrow exception involving "foregone conclusion doctrine", an important fact missed by Ars Technica but elaborated on by AP: https://apnews.com/general-news-49da3a1e71f74e1c98012611aedc...

> Authorities, citing a “foregone conclusion exception” to the Fifth Amendment, argued that Rawls could not invoke his right to self-incrimination because police already had evidence of a crime. The 3rd Circuit panel agreed, upholding a lower court decision. I do not follow the logic here, what does that even mean? It seems very dubious. And what happens if one legitimately forgets? They just get to keep you there fo…

And why do they need to unlock your phone if they already proved you did the crime?

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#454

Post by direwolf20 »

notyourwork wrote: post #423
nova22033 wrote: post #236

Remember...they can make you use touch id...they can't make you give them your password. https://x.com/runasand/status/2017659019251343763?s=20 The FBI was able to access Washington Post reporter Hannah Natanson's Signal messages because she used Signal on her work laptop. The laptop accepted Touch ID for authentication, meaning the agents were allowed to require her to unlock it.

I don't get why I can be forced to use my biometrics to unlock but I cannot be forced to give a pin. Doesn't jive in my brain.

When they arrest you, they have physical control of your body. You're in handcuffs. They can put your fingers against the unlock button. You can make a fist, but they can have more strength and leverage to unfist your fist.

There's no known technique to force you to input a password.

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#455

Post by direwolf20 »

verall wrote: post #338
rawgabbit wrote: post #325

Earlier quoted context omitted.

Serious question. If I am re-entering the US after traveling abroad, can customs legally ask me to turn the phone back on and/or seize my phone? I am a US citizen. Out of habit, I keep my phone off during the flight and turn it on after clearing customs.

my understanding is that they can hold you for a couple days without charges for your insubordination but as a citizen they have to let you back into the country or officially arrest you, try to get an actual warrant, etc.

they can just break the law

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#456

Post by direwolf20 »

raw_anon_1111 wrote: post #385
nova22033 wrote: post #236

Remember...they can make you use touch id...they can't make you give them your password. https://x.com/runasand/status/2017659019251343763?s=20 The FBI was able to access Washington Post reporter Hannah Natanson's Signal messages because she used Signal on her work laptop. The laptop accepted Touch ID for authentication, meaning the agents were allowed to require her to unlock it.

As if the government is not above breaking the law and using rubber hose decryption. The current administration’s justice department has been caught lying left and right

Plausible deniability still works. You enter your duress code and your system boots to a secondary partition with Facebook and Snapchat. No such OS exists.

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#457

Post by direwolf20 »

827a wrote: post #444
kingnothing wrote: post #406

Earlier quoted context omitted.

It's relatively well know that the NSO Group / Pegasus is what governments use to access locked phones.

This was known, in the past, but if its relying on zero-days Apple & Google are, adversarially, attempting to keep up with and patch, my assumption would not be that pegasus is, at any time, always able to breach a fully-updated iPhone. Rather, its a situation where maybe there are periods of a few months at a time where they have a working exploit, until Apple discovers it and patches it, repeat indefinitely.

How does Apple discover their exploits? I'm sure they keep some around for extremely high value targets.

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#458

Post by direwolf20 »

bmicraft wrote: post #323
pbhjpbhj wrote: post #213

Earlier quoted context omitted.

Did she have Bitlocker or FileVault or other disk encryption that was breeched? (Or they took the system booted as TLAs seek to do?)

There was a story here the other day, bitlocker keys stored in your Microsoft account will be handed over.

Which windows does by default and makes it hard to turn off

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#459

Post by direwolf20 »

quesera wrote: post #265
PunchyHamster wrote: post #219

They just need to ask apple to unlock it. And they can't really refuse under US law

They can refuse, and they have refused. See San Bernardino and the concept of "compelled work".

That was the old US law, not the one where Tim Cook delivered gold bars to Trump

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#460

Post by rustyhancock »

nova22033 wrote: post #236

Remember...they can make you use touch id...they can't make you give them your password. https://x.com/runasand/status/2017659019251343763?s=20 The FBI was able to access Washington Post reporter Hannah Natanson's Signal messages because she used Signal on her work laptop. The laptop accepted Touch ID for authentication, meaning the agents were allowed to require her to unlock it.

As far as I know lockdown mode and BFU prevent touch ID unlocking.

At least a password and pin you choose to give over.

Post reply on HN