Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Is Said to Be Working on an iPhone Even It Can’t Hack

nytimes.com

Post reply on HN
Print view View original

81–90 of 415 posts

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#81

Post by j1vms »

abalone wrote: post #50

It's important to emphasize something: iCloud will always be "backdoored", by design, and backing up to iCloud is what most users should and will be doing. The reason iCloud data will always be accessible by Apple, and thus governments, is not because Apple wants to make it accessible to governments. It's so that Apple can offer customers the very important feature of accessing their own data if they forget or otherw…

>The reason iCloud data will always be accessible by Apple, and thus governments, is [...] so that Apple can offer customers the very important feature of accessing their own data if they forget or otherwise don't have the password. That is an essential feature, and why this aspect will never change.

And may the era of homomorphic encryption schemes come and thus render moot the need for Apple and other companies to access unencrypted data as a plausible excuse when performing back-end processing/recovery on their client's data.

edit: well, to correct myself, as you said that wouldn't obviate the need for the feature of "recover data without password, after passing some other security tests"

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#82

Post by schoen »

tptacek wrote: post #73
deegles wrote: post #70

Earlier quoted context omitted.

Can non-US citizens be coerced into giving up their passcode?

No, at least, not by the DOJ, and not for any use in a court of law.

We wrote about this in our border search guide and concluded that there is a risk of being refused admission to the U.S. in this case (in the border search context) because the CBP agents performing the inspection have extremely broad discretion on "admissibility" of non-citizens and non-permanent residents, and refusing to cooperate with what they see as a part of the inspection could be something that would lead them to turn someone away. (However, this is still not quite the same as forcing someone to answer in the sense that they don't obviously get to impose penal sanctions on people for saying no.)

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#83

Post by dragonwriter »

studentrob wrote: post #67

Good. Congress shall pass no law abridging freedom of speech, and code has been ruled free speech. The only reason previous wiretapping laws were passed is because they weren't in the limelight and the public never had a chance to weigh in. Let's make this an election issue

> The only reason previous wiretapping laws were passed is because they weren't in the limelight

USA FREEDOM was passed fairly specifically because the issue was in the limelight.

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#84

Post by kzrdude »

studentrob wrote: post #67

Good. Congress shall pass no law abridging freedom of speech, and code has been ruled free speech. The only reason previous wiretapping laws were passed is because they weren't in the limelight and the public never had a chance to weigh in. Let's make this an election issue

Take a step back and fight campaign finance and gerrymandering, so that people are once again represented well in lawmaking. Campaign finance needs to be reformed so that it becomes affordable for representatives to represent their country instead of their sponsors, and gerrymandering so that democracy has the competition it needs to select better politicians.

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#85

Post by mtgx »

jarcoal wrote: post #7

Don't they just need to tell people to switch away from 4 or 6 digit pins and use longer passwords?

Yes, they could just remove the PIN authentication method, and I hope they do. Because then it would leave DoJ to argue for something even more extreme than they are now.

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#86

Post by studentrob »

joezydeco wrote: post #43

Could DOJ slap Apple with an injunction forbidding deployments of new iOS releases until the San Bernadino case is concluded? If Apple can't launch new iOS versions, can they still launch new iPhones?

By saying what exactly? That an unhackable iOS is illegal? That's not currently true and it is the precedent that everyone believes the DOJ would like to set, but that the DOJ keeps denying.

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#87

Post by abalone »

surye wrote: post #57
abalone wrote: post #50

It's important to emphasize something: iCloud will always be "backdoored", by design, and backing up to iCloud is what most users should and will be doing. The reason iCloud data will always be accessible by Apple, and thus governments, is not because Apple wants to make it accessible to governments. It's so that Apple can offer customers the very important feature of accessing their own data if they forget or otherw…

> When someone passes away, for example, it would be a terrible compounding tragedy if all their photos from their whole life passed away along with them, because they didn't tell anyone their password or where they kept the backup key. Would you really expect Apple to recover the data in this scenario for the next of kin? I certainly wouldn't, and I wouldn't want them to.

I definitely would if it was a regular iCloud Photo Library with decades of family history, pictures of the kids growing up, etc. Imagine all that being lost. It's not what most users would want.

If there was something the deceased person truly wanted hidden from their next of kin, they could use stronger encryption for that. The Notes app, for example, allows for note-level strong encryption. But it's not an ideal fit for the more typical use case.

Anyway, they do it.[1]

[1] http://www.cnet.com/news/widow-says-apple-told-her-to-get-co...

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#88

Post by cromwellian »

tptacek wrote: post #71
cromwellian wrote: post #64

Earlier quoted context omitted.

No, the chief protection against the PIN code hacking comes from the retry counter. The FBI doesn't need the crypto keys, it just needs the PIN code. So it needs to brute force about 10,000 PIN codes. Any mechanism that prevents the application processor from either a) remembering it incremented the count b) corrupts the count or c) patches the logic that handles a retry count of 10, is sufficient to attack the phone…

You aren't limited to 10,000 possibilities. You can use an alphanumeric passphrase. The passphrase is run through PBKDF2 before being mixed with the device hardware key. On phones after the 5C, nothing you can do with the AP helps you here; the 10-strikes rule is enforced by the SE, which is a separate piece of hardware. It's true that if you can flip bits in the SE, you can influence its behavior. But whatever you d…

I'm speaking the case of the San Bernardino killers. Using strong alphanumeric pass phrases are anti-usability, the vast majority of people won't use them. Hell, the vast majority of people don't even have strong alphanumeric passwords on desktop services.

So it falls to either 2-factor or biometric to avoid PINs. Biometric of course has it's own problems.

Perhaps people should really carry around a Secure Enclave on a ring or something, and with a button to self-destruct it in case of emergency. (e.g. pinhole reset)

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#89

Post by Crito »

toomuchtodo wrote: post #32
taneq wrote: post #19

Earlier quoted context omitted.

Does TouchID have any protections against your finger unlocking your phone post-mortem?

No, although I'd love to see a HealthKit app that uses your Apple Watch as a dead man's switch, and disables Touch ID or powers the phone off in the event the watch is removed or your pulse is no longer detected.

Without a wristprint for the watch to read, what prevents somebody else from wearing it?

The pulse and skin conductivity might change, but are either of those reliable enough metrics for such an application?

Re: Apple Is Said to Be Working on an iPhone Even It Can’t Hack

#90

Post by TazeTSchnitzel »

studentrob wrote: post #67

Good. Congress shall pass no law abridging freedom of speech, and code has been ruled free speech. The only reason previous wiretapping laws were passed is because they weren't in the limelight and the public never had a chance to weigh in. Let's make this an election issue

> Good. Congress shall pass no law abridging freedom of speech, and code has been ruled free speech.

Unless it breaks DRM!

Post reply on HN