Live data from Hacker News

FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

404media.co

471–480 of 565 posts

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#471

Sadly, they still got to her Signal on her Desktop – her sources might still be compromised. It's sadly inherent to desktop applications, but I'm sad that a lot more people don't know that Signal for Desktop is much, much less secure against adversaries with your laptop.

Yea, I also would want to question the conclusions in the article. Was the issue that they couldn't unlock the iPhone, or that they had no reason to pursue the thread? To my understanding, the Apple ecosystem means that everything is synced together. If they already got into her laptop, wouldn't all of the iMessages, call history, and iCloud material already be synced there? What would be the gain of going after the…

Not if she’s smart.

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#473

Remember...they can make you use touch id...they can't make you give them your password. https://x.com/runasand/status/2017659019251343763?s=20 The FBI was able to access Washington Post reporter Hannah Natanson's Signal messages because she used Signal on her work laptop. The laptop accepted Touch ID for authentication, meaning the agents were allowed to require her to unlock it.

I don't get why I can be forced to use my biometrics to unlock but I cannot be forced to give a pin. Doesn't jive in my brain.

"technicality" or "loophole" is probably the word.

I fully agree, forced biometrics is bullshit.

I say the same about forced blood removal for BAC testing. They can get a warrant for your blood, that's crazy to me.

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#474

Earlier quoted context omitted.

I don't get why I can be forced to use my biometrics to unlock but I cannot be forced to give a pin. Doesn't jive in my brain.

When they arrest you, they have physical control of your body. You're in handcuffs. They can put your fingers against the unlock button. You can make a fist, but they can have more strength and leverage to unfist your fist. There's no known technique to force you to input a password.

Are we not talking about a legal difference? That was my reading.

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#475
post #474

Earlier quoted context omitted.

When they arrest you, they have physical control of your body. You're in handcuffs. They can put your fingers against the unlock button. You can make a fist, but they can have more strength and leverage to unfist your fist. There's no known technique to force you to input a password.

Are we not talking about a legal difference? That was my reading.

The law follows practicality in this instance.

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#476

Earlier quoted context omitted.

> It's close enough Not really, because tools like Cellbrite are more limited with BFU, hence the manual informing LEO to keep (locked) devices charged, amd the countermeasures being iOS forcefully rebooting devices that have been locked for too long.

There is a way now to force BFU from a phone that is turned on, I can't remember the sequence

It’s called restarting the phone.

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#477

Depending on your jurisdiction faceid is safer than fingerprint, because faceid won’t unlock while your eyes are closed. In many European countries forcing your finger on a scanner would be permissible under certain circumstances, forcing your eyes open so far has been deemed unacceptable.

Good to know. You sure about this though ? I swear I've seen people use Face ID on someone who's sleeping

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#478
post #97

Can a hacked phone (such as one that was not in Lockdown Mode at one point in time) persist in a hacked state? Obviously, the theoretical answer is yes, given an advanced-enough exploit. But let's say Apple is unaware of a specific rootkit. If each OS update is a wave, is the installed exploit more like a rowboat or a frigate? Will it likely be defeated accidentally by minor OS changes, or is it likely to endure? Thi…

Forget OS updates. The biggest obstacle to exploit persistence: a good old hard system reboot. Modern iOS has an incredibly tight secure chain-of-trust bootloader. If you shut your device to a known-off state (using the hardware key sequence), on power on, you can be 99.999% certain only Apple-signed code will run all the way from secureROM to iOS userland. The exception is if the secureROM is somehow compromised and…

[deleted]

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#479

Earlier quoted context omitted.

Is the knowledge of which finger to use protected as much as a passcode? Law enforcement might have the authority to physically hold the owner's finger to the device, but it seems that the owner has the right to refuse to disclose which finger is the right one. If law enforcement doesn't guess correctly in a few tries, the device could lock itself and require the passcode. Another reason to use my dog's nose instead…

I really wish Apple would offer a pin option on macos. For this reason, precisely. Either that, or an option to automatically disable touchid after a short amount of time (eg an hour or if my phone doesn't connect to the laptop)

Wait, wasn’t touch id phased out together with the intel touch bar macbooks? I’ve never used anything but a long password to unlock.

Re: FBI couldn't get into WaPo reporter's iPhone because Lockdown Mode enabled

#480

Earlier quoted context omitted.

I don't get why I can be forced to use my biometrics to unlock but I cannot be forced to give a pin. Doesn't jive in my brain.

When they arrest you, they have physical control of your body. You're in handcuffs. They can put your fingers against the unlock button. You can make a fist, but they can have more strength and leverage to unfist your fist. There's no known technique to force you to input a password.

Well there is one known technique. https://xkcd.com/538/
Post reply on HN