Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cellebrite claims it can unlock any iPhone, many new Android phones for police

wired.com

Post reply on HN
Print view View original

51–60 of 90 posts

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#51

Post by Jonnax »

danarmak wrote: post #50
speedplane wrote: post #14

Earlier quoted context omitted.

> Are you seriously shocked that there are people out there that would be willing to assist law enforcement? ... They are no worse than locksmiths advertising the ability to crack safes. It's more like a locksmith advertising the ability to break anyone's safe that contains details on every place you've ever been, purchase you've ever made, and person you've ever communicated with. Phones are far more ubiquitous and…

Are you suggesting a locksmith should refuse to help the police open safes that contain too many valuables or PII inside?

At the end of the day you live in a global world.

Is it acceptable for this company to sell it to Saudi Arabian police where it's a crime for a woman to run away from home?

https://www.businessinsider.com/saudi-arabia-imei-track-runa...

Or how about Australia raiding journalists for whistleblowing on abuses conducted by their arm forces in war: https://www.bbc.com/news/world-australia-48522729

Perhaps you agree or perhaps you don't. But the issue is more complex than saying that "everyone should help the police"

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#52

Post by JoeSmithson »

jMyles wrote: post #23
Illniyar wrote: post #10

Earlier quoted context omitted.

>First of all, to give words to the obvious question here: what leads a group of people to flaunt their insanely unethical desire to profit from ? They are literally trumpeting the ability for their clients to forcibly copy data without the permission of the owner of the device in question. Is it just money? Is it that simple? That's one way to look at it. Another is that they provide law enforcement the ability to c…

One way or another, they are facilitating (in fact profiting from) one human to forcibly access a sensitive device belonging to another human, with the consent of the latter. The sex offender spectre doesn't change that.

The sex offender "spectre" completely changes that because privacy is a "qualified right" that is appropriate to violate in some circumstances.

> Under the European Convention on Human Rights, the right to privacy is, in effect, contained in Article 8, the right to respect for family and private life. It is important to know that it is also a “qualified” right. That means it is not absolute, and can be interfered with in certain limited situations, for example to protect national security or freedom of expression. However, any interference has to be necessary and proportionate.

https://rightsinfo.org/the-right-to-privacy-and-why-it-matte...

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#53

Post by 6nf »

earenndil wrote: post #45
xhgdvjky wrote: post #35

Earlier quoted context omitted.

I don't think it's so obvious what the vulnerability is... or apple would want to patch it

Apple can't patch it. It's a fundamental limitation that, somewhere on the device, is stored a key; if you can extract that key, then you can run brute-force on it as much as you want from a supercomputer. And it has to be extractable because the phone itself has to use it.

The Secure Enclave prevents this

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#54

Post by danarmak »

Jonnax wrote: post #51
danarmak wrote: post #50

Earlier quoted context omitted.

Are you suggesting a locksmith should refuse to help the police open safes that contain too many valuables or PII inside?

At the end of the day you live in a global world. Is it acceptable for this company to sell it to Saudi Arabian police where it's a crime for a woman to run away from home? https://www.businessinsider.com/saudi-arabia-imei-track-runa... Or how about Australia raiding journalists for whistleblowing on abuses conducted by their arm forces in war: https://www.bbc.com/news/world-australia-48522729 Perhaps you agree or pe…

I'm not saying "everyone" should help the police. I do think it's alright that a few companies, in specialized professions, exist to help the police (and other governmental organizations).

Yes, a lot of the effect is harmful, including in helping police do harm. But an argument that no-one should help the police is basically an argument the police shouldn't exist.

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#55

Post by tpetry »

6nf wrote: post #53
earenndil wrote: post #45

Earlier quoted context omitted.

Apple can't patch it. It's a fundamental limitation that, somewhere on the device, is stored a key; if you can extract that key, then you can run brute-force on it as much as you want from a supercomputer. And it has to be extractable because the phone itself has to use it.

The Secure Enclave prevents this

The secure enclave SHOULD prevent this! The cellebrite people found some vulnerability, but we dont know in which component.

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#56

Post by kerkeslager »

jMyles wrote: post #3

First of all, to give words to the obvious question here: what leads a group of people to flaunt their insanely unethical desire to profit from ? They are literally trumpeting the ability for their clients to forcibly copy data without the permission of the owner of the device in question. Is it just money? Is it that simple? Annnyway, more importantly: are there any details about how their claims are even possible?…

> First of all, to give words to the obvious question here: what leads a group of people to flaunt their insanely unethical desire to profit from ? They are literally trumpeting the ability for their clients to forcibly copy data without the permission of the owner of the device in question. Is it just money? Is it that simple?

Probably.

I've met a lot of people who argue against the right to privacy. Most of those people are in positions where they profit from trampling people's privacy in some way: social media integrations, profiting from advertising, law enforcement/spying, or simply deprioritizing security. Lots of those folks are on Hacker News.

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#57

Post by kerkeslager »

danarmak wrote: post #54
Jonnax wrote: post #51

Earlier quoted context omitted.

At the end of the day you live in a global world. Is it acceptable for this company to sell it to Saudi Arabian police where it's a crime for a woman to run away from home? https://www.businessinsider.com/saudi-arabia-imei-track-runa... Or how about Australia raiding journalists for whistleblowing on abuses conducted by their arm forces in war: https://www.bbc.com/news/world-australia-48522729 Perhaps you agree or pe…

I'm not saying "everyone" should help the police. I do think it's alright that a few companies, in specialized professions, exist to help the police (and other governmental organizations). Yes, a lot of the effect is harmful, including in helping police do harm. But an argument that no-one should help the police is basically an argument the police shouldn't exist.

No it's not.

I'd argue that nobody should help the police as they exist in many modern implementations, because the police as they exist now are often bad actors. But it's not hard to imagine a police force that's held to a higher standard such that they actually are trustworthy. The argument doesn't have to be "police shouldn't exist"--it could be "police should be better".

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#58

Post by danarmak »

kerkeslager wrote: post #57
danarmak wrote: post #54

Earlier quoted context omitted.

I'm not saying "everyone" should help the police. I do think it's alright that a few companies, in specialized professions, exist to help the police (and other governmental organizations). Yes, a lot of the effect is harmful, including in helping police do harm. But an argument that no-one should help the police is basically an argument the police shouldn't exist.

No it's not. I'd argue that nobody should help the police as they exist in many modern implementations, because the police as they exist now are often bad actors. But it's not hard to imagine a police force that's held to a higher standard such that they actually are trustworthy. The argument doesn't have to be "police shouldn't exist"--it could be "police should be better".

But since we lack an individually actionable way of making the police better, doesn't the argument reduce to "we should not help the police as they are now"?

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#59

Post by grumdan »

jMyles wrote: post #3

First of all, to give words to the obvious question here: what leads a group of people to flaunt their insanely unethical desire to profit from ? They are literally trumpeting the ability for their clients to forcibly copy data without the permission of the owner of the device in question. Is it just money? Is it that simple? Annnyway, more importantly: are there any details about how their claims are even possible?…

> What's the difference? Why are phones such a security nightmare? At least in terms of encryption at rest on a cold device, isn't this a solved problem?

One horribly annoying decision of Android is that the encryption passphrase cannot be different from the unlock pin, leaving users with two choices:

- Have a long, secure password that actually makes Android's encryption worth a damn. They then have to enter this password every time they want to unlock their phone. I don't think many people go for this option.

- Have a short usable password so you can painlessly unlock your phone. However, then encryption only provides a marginal benefit

(- I decided to use a long password with fingerprint unlock as a compromise, which creates its own security problems.)

It seems that they ignore that a powered off devices could easily provide much stronger protection by allowing a separate encryption password. And if the device is powered on, limiting unlock attempts might be somewhat useful to frustrate attacks against short lock screen passwords.

Re: Cellebrite claims it can unlock any iPhone, many new Android phones for police

#60

Post by equdi »

grumdan wrote: post #59
jMyles wrote: post #3

First of all, to give words to the obvious question here: what leads a group of people to flaunt their insanely unethical desire to profit from ? They are literally trumpeting the ability for their clients to forcibly copy data without the permission of the owner of the device in question. Is it just money? Is it that simple? Annnyway, more importantly: are there any details about how their claims are even possible?…

> What's the difference? Why are phones such a security nightmare? At least in terms of encryption at rest on a cold device, isn't this a solved problem? One horribly annoying decision of Android is that the encryption passphrase cannot be different from the unlock pin, leaving users with two choices: - Have a long, secure password that actually makes Android's encryption worth a damn. They then have to enter this pa…

You are only forced to enter your passphrase when you turn on the mobile and once every X days. The rest of the time you can use your fingerprint to unlock the mobile. Seems like a good compromise.
Post reply on HN