Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bill Gates Says Apple Should Unlock the iPhone

techcrunch.com

Post reply on HN
Print view View original

61–70 of 106 posts

Re: Bill Gates Says Apple Should Unlock the iPhone

#61

Post by saurik »

acqq wrote: post #52
saurik wrote: post #41

Earlier quoted context omitted.

This is an iPhone 5C, which does not have the "secure enclave" feature, and it isn't even clear helps as Apple has stated to reporters that it is possible to do what the FBI wants, so we know the software on that component must be mutable. If it was actually impossible to do the thing the FBI wanted them to do then we would not even be having this discussion today: Apple would just say "can't, sorry" and the FBI woul…

Secure Enclave is irrelevant here. Even without Secure Enclave the data on iPhone 5C is encrypted with the user's password and Apple doesn't have access to the data as it doesn't have user's password, contrary to your claim that "Apple has the access to the data." No, FBI has access, but only to the encrypted data. And FBI can't decrypt it. They locked themselves out of the phone, actually. And the phone is not the p…

It takes mere minutes for us to crack the 4- digit passcode on the iPhone 4 (which I only specify as that's where we were last able to easily do this in the jailbreak community; it might be faster now), and most people likely don't use terribly strong passwords; the FBI might also have "leads" on what the password is, but not good enough ones that they feel confident dealing with ten attempts. This is a backdoor to the lock: you can quibble with me over the definition of "unfettered" (I do not consider "it will take some time, but I absolutely have a 100% chance of getting access without fail" terribly "fettered", but it definitely is more than the people who are frustrated with this situation seem to want the FBI to have).

> FBI demands from Apple to change their product (iOS) to make the encryption cracking attempts by FBI easier.

... and we should be thankful the FBI didn't simply demand the 4096-bit key Apple uses to sign firmwares, because that's all they actually need--nothing more than 512 bytes of data--in order to accomplish the thing everyone is upset about here.

Re: Bill Gates Says Apple Should Unlock the iPhone

#62

Post by acqq »

saurik wrote: post #59
pfg wrote: post #51

Earlier quoted context omitted.

I don't think this is a fair assessment. Apple is being asked to create a firmware version without brute force rate-limiting. With a sufficiently complex passphrase, the FBI is still SOL. They're not being asked to create a firmware version that would decrypt the disk - which would be impossible due to the iPhone's security architecture. The fact that only Apple is in a position to sign firmware that could do this is…

> Apple is being asked to create a firmware version without brute force rate-limiting. This is a one line of code change for Apple and would take them a few minutes. FWIW, there are people in the iOS jailbreaking community who could do this without the source code rather quickly. I'll even go so far as to say that we actually already have all the tools for this lying around for the iPhone 4, and with only minimal cha…

> I'll even go so far as to say that we actually already have all the tools for this lying around for the iPhone 4, and with only minimal changes made by even less qualified engineers they would probably work on the iPhone 5C.

Then there's even less reason to use All Writs to make Apple do it, unless it's to make the precedent to force the device makers to backdoor their products.

Just do it, for all of us, make that tool for 5C. But don't support FBI using this case to make "All Writs able to change products" precedent.

Re: Bill Gates Says Apple Should Unlock the iPhone

#63

Post by saurik »

camillomiller wrote: post #35
saurik wrote: post #25

Earlier quoted context omitted.

The reality is that Apple already has unfettered access to this device: they left themselves a backdoor to which only they have the key, in the form of a "secure" update mechanism that is so "secure" that even the user can't control it, only Apple can. To me the actual question here is whether the FBI should be allowed to ask and then force Apple to use the backdoor Apple built into their product; Apple painting this…

This is completely upside down. Can all Apple haters for once put down their haters' hat and try and be reasonable for the good of everybody? You phrased all that just to get to the conclusion that Apple is an over-controlling company imposing rules on otherwise super tech savvy users. Well sorry to break the news for you, but people decide on their own which smartphone to buy. Globally, most of the time, it's an And…

As long as you don't care if someone can attempt to pull the data from your phone like this, then sure: go ahead and buy that phone. The people generally in these threads, however, and apparently the opinion of Apple itself, is that the FBI should not be able to get the data off of this device; as it stands, Apple can guarantee their eventual success.

> Better, they can even root it! Make it even more insecure! Install pirated software that hides malware and will steal their ids or their money! Now THAT's choice and power to the user!

This makes no sense. Sure: someone can make their device less secure if they want. I absolutely support you doing that. They can also try to use vulnerabilities to take back control of their device and make it more secure (though with an iPhone there are some serious issues with this, due to how almost impossible it is to lock Apple out). But what does this have to do with the conversation at hand? Can you connect any of this back with the FBI discussion?

Re: Bill Gates Says Apple Should Unlock the iPhone

#64

Post by zer01 »

acqq wrote: post #43
zer01 wrote: post #7

>"It is no different than [the question of] should anybody ever have been able to tell the phone company to get information, should anybody be able to get at bank records,” he said. “Let’s say the bank had tied a ribbon round the disk drive and said ‘don’t make me cut this ribbon because you’ll make me cut it many times’." Seriously? It's absolutely different (not to mention his ribbon analogy makes no sense at all).…

> Here's hoping that the iPhone 7 has a secure enclave that either 1.) deletes keys on firmware flash, or 2.) doesn't allow it to be upgraded ever. If you hope for that, consider the legal base on which FBI made the current request: All Writs Act, which is, in full: https://en.wikipedia.org/wiki/All_Writs_Act "(a) The Supreme Court and all courts established by Act of Congress may issue all writs necessary or appropr…

I agree that it would be upsetting if precedent was made, but I believe it is technically feasible to build a device whose keys are only known by an end user. The FBI is basically asking to go down legitimate update channels to brute force their pass-code, and while that's still a feasible option, of course the FBI is going to ask to use it. Updating the security model of the secure enclave to either destroy keys on flash or disable the flashing mechanism all-together would render the ability outside of even apple's reach, then it goes back down to a question of if you can be compelled to give up your encryption pass-phrase, which I believe precedent has already been set on (please correct me if I'm wrong).

As an aside it bugs me to a fairly large degree that we still attempt to apply very old laws to something they were never designed to address the things we put in front of it. It feels very akin to trying to jam a square peg in a round hole.

Ever play with a wifi pineapple? Ever build one yourself? Congrats! You broke a federal wiretapping statute!

https://www.law.cornell.edu/uscode/text/18/2511 https://www.law.cornell.edu/uscode/text/18/2512

Re: Bill Gates Says Apple Should Unlock the iPhone

#65

Post by acqq »

saurik wrote: post #61
acqq wrote: post #52

Earlier quoted context omitted.

Secure Enclave is irrelevant here. Even without Secure Enclave the data on iPhone 5C is encrypted with the user's password and Apple doesn't have access to the data as it doesn't have user's password, contrary to your claim that "Apple has the access to the data." No, FBI has access, but only to the encrypted data. And FBI can't decrypt it. They locked themselves out of the phone, actually. And the phone is not the p…

It takes mere minutes for us to crack the 4- digit passcode on the iPhone 4 (which I only specify as that's where we were last able to easily do this in the jailbreak community; it might be faster now), and most people likely don't use terribly strong passwords; the FBI might also have "leads" on what the password is, but not good enough ones that they feel confident dealing with ten attempts. This is a backdoor to t…

> It takes mere minutes for us to crack the 4- digit passcode on the iPhone 4

Please make it then for iPhone 5C. You would do the world a favor.

If you claim you don't have the needed RSA key, then you confirm that the encryption actually works. And you know that your "tool" wouldn't work on the copy of the encrypted data, too. Nice for consumers, isn't it, hardware-dependent functioning encryption by Apple.

Re: Bill Gates Says Apple Should Unlock the iPhone

#66

Post by saurik »

rrego wrote: post #55
saurik wrote: post #25

Earlier quoted context omitted.

The reality is that Apple already has unfettered access to this device: they left themselves a backdoor to which only they have the key, in the form of a "secure" update mechanism that is so "secure" that even the user can't control it, only Apple can. To me the actual question here is whether the FBI should be allowed to ask and then force Apple to use the backdoor Apple built into their product; Apple painting this…

More or less correct if fully trusting any signed code by a third party (Apple) is a backdoor. For what it's worth, signed code imparts security benefits to Apple and Android users who indeed can't be trusted to not screw up their own phones. Thing is, this entire system is based off of trust. If people lose trust in Apple, then they lose trust product. While even Apple can't decrypt the data, existence of malicious…

> FBI would have done better to ask Apple in secret. Apple really made the only possible choice when faced with a public request.

I agree. I will go further and say that I hope Apple would make the same decision in secret. I believe Apple in general and Tim Cook in particular to be not just moral, but "principled", in that I feel like he's unlikely to back down from a moral argument without being beaten into submission. I hope Apple fights this one to the death.

> Thing is, this entire system is based off of trust. If people lose trust in Apple, then they lose trust product. While even Apple can't decrypt the data, existence of malicious signed code means you can't trust signed code.

The question at hand is whether it makes sense to trust a company when their government wants them to do something and may technically have the law (as broken as you or I or even "almost everyone" feels that law is) on their side. This is the same discussion about putting data on servers in other countries run by companies that might bow to the will of some oppressive totalitarian regime, only the server is in your pocket and the regime is the United States through the FBI.

Re: Bill Gates Says Apple Should Unlock the iPhone

#67

Post by acqq »

zer01 wrote: post #64
acqq wrote: post #43

Earlier quoted context omitted.

> Here's hoping that the iPhone 7 has a secure enclave that either 1.) deletes keys on firmware flash, or 2.) doesn't allow it to be upgraded ever. If you hope for that, consider the legal base on which FBI made the current request: All Writs Act, which is, in full: https://en.wikipedia.org/wiki/All_Writs_Act "(a) The Supreme Court and all courts established by Act of Congress may issue all writs necessary or appropr…

I agree that it would be upsetting if precedent was made, but I believe it is technically feasible to build a device whose keys are only known by an end user. The FBI is basically asking to go down legitimate update channels to brute force their pass-code, and while that's still a feasible option, of course the FBI is going to ask to use it. Updating the security model of the secure enclave to either destroy keys on…

> I believe precedent has already been set on (please correct me if I'm wrong).

No, as far as I understand, this now would be a new and dangerous precedent:

Nobody was ever asked to alter their product using All Writs.

That's what's here all about.

Re: Bill Gates Says Apple Should Unlock the iPhone

#69

Post by saurik »

acqq wrote: post #62
saurik wrote: post #59

Earlier quoted context omitted.

> Apple is being asked to create a firmware version without brute force rate-limiting. This is a one line of code change for Apple and would take them a few minutes. FWIW, there are people in the iOS jailbreaking community who could do this without the source code rather quickly. I'll even go so far as to say that we actually already have all the tools for this lying around for the iPhone 4, and with only minimal cha…

> I'll even go so far as to say that we actually already have all the tools for this lying around for the iPhone 4, and with only minimal changes made by even less qualified engineers they would probably work on the iPhone 5C. Then there's even less reason to use All Writs to make Apple do it, unless it's to make the precedent to force the device makers to backdoor their products. Just do it, for all of us, make that…

You seem to still fundamentally misunderstand the situation, as you seem to be challenging me to build the tool today and get Apple off the hook, as if that was all that mattered.

I can build the tool. What I can't do is sign the result. The only thing any of us are missing is the 4096-bit RSA encryption key used to sign the firmware. The way we load this tool onto the iPhone 4 is using a vulnerability in their bootloader that lets us bypass the signature check. There is only 512 bytes of data at question here, not some insurmountable amount of work.

Re: Bill Gates Says Apple Should Unlock the iPhone

#70

Post by acqq »

saurik wrote: post #69
acqq wrote: post #62

Earlier quoted context omitted.

> I'll even go so far as to say that we actually already have all the tools for this lying around for the iPhone 4, and with only minimal changes made by even less qualified engineers they would probably work on the iPhone 5C. Then there's even less reason to use All Writs to make Apple do it, unless it's to make the precedent to force the device makers to backdoor their products. Just do it, for all of us, make that…

You seem to still fundamentally misunderstand the situation, as you seem to be challenging me to build the tool today and get Apple off the hook, as if that was all that mattered. I can build the tool. What I can't do is sign the result. The only thing any of us are missing is the 4096-bit RSA encryption key used to sign the firmware. The way we load this tool onto the iPhone 4 is using a vulnerability in their bootl…

> he only thing any of us are missing is the 4096-bit RSA encryption key used to sign the firmware.

Ah, so Apple's encryption does actually work.

That's the essence of the good encryption: everything is known, except the key. You are not supposed to have it. FBI, hopefully, isn't supposed to have it too. That's why we have laws. Checks and balances and stuff. Laws made for specific cases, not "we can do anything."

Post reply on HN