25 ms·

Apple tells U.S. judge 'impossible' to unlock new iPhones

328 points by aaronbrethorst 11y ago

faide 11y ago
In case anyone shares my confusion: they aren't talking about unlocking in the sense of removing carrier restrictions, but rather in the sense of disabling the security features of the device to access the data stored on it.
- daimyoyo 11y ago
  I believe they're talking about trying to access a phone once it has been "locked" from too many wrong tries at the lock screen.
  - pakled_engineer 11y ago
    That's what I got from the article, the key was wiped because of X many tries so Apple can't "unlock" the data on the device (excluding everything backed up to apple cloud). In the future they will use shady FinFisher iTunes and other exploits to grab the data then seize the phone.
- alialkhatib 11y ago
  I was similarly confused. While the HN title accurately reflects the Reuters title, I think it'd be reasonable to retitle the submission to something along the lines of "Apple: breaking encryption on devices running iOS 8 and newer 'would be impossible'", or something (point being to highlight that we're talking about the encryption issue, not carrier).
- jmount 11y ago
  I agree. For phones "unlock" means removing carrier restrictions and getting information off is something like "decrypt" or "crack."
  - wan23 11y ago
    iOS devices have a "lock screen" where to use the device you have to enter a passcode or password or fingerprint to gain access to the device. Usually if you pick up someone's phone this is the screen that you see. https://9to5mac.files.wordpress.com/2013/07/screen-shot-2013-07-29-at-10-24-13-am.png https://9to5mac.files.wordpress.com/2013/07/screen-shot-2013... Note the "slide to unlock" message at the bottom. If you asked most users what it means to unlock a phone, this is what they would think of, as they see it every day.
    - benatkin 11y ago
      > If you asked most users what it means to unlock a phone, this is what they would think of, as they see it every day. [citation needed] "Unlocked phone" is not limited to experts. More than half a million hits on google: https://www.google.com/search?q=%22unlocked+phone%22&oq=%22unlocked+phone%22&aqs=chrome..69i57.2766j0j7&sourceid=chrome&es_sm=91&ie=UTF-8 https://www.google.com/search?q=%22unlocked+phone%22&oq=%22u... I really don't know what "most users" would think of.
      - somebehemoth 11y ago
        What possible citation could be better than the one provided? Apple has sold over 1 billion of these devices and they all share the same lock screen UI; 500,000 search results on Google pales in comparison as a citation. Edit: I understand your point and agree that unlocking a device would not mean exactly the same thing to all people. I just don't agree that the parent needed an additional citation.
- supercoder 11y ago
  Makes sense to anyone who uses an iPhone though.
  - morganvachon 11y ago
    iPhone user here, and my first thought upon reading the headline was "unlocking" in the sense of carrier locks. Given that Apple sells unlocked phones in the first place, my mind immediately switched to the actual meaning of the headline. But still, there was a moment of confusion.
lemiant 11y ago
Can someone explain how Apple has managed to render brute force ineffective if there are only 10000 possible 4-digit passcodes?
- jansenvt 11y ago
  the same way everyone else does. they limit the number of attempts you get.
  - simmons 11y ago
    I'm not too familiar with how iPhone hardware is put together, but is there a possibility of performing a forensic extraction of the flash memory and performing a brute-force attack offline? Or does the conversion of PIN to the storage encryption key happen in the secure enclave, which may resist such forensic meddling?
    - dogma1138 11y ago
      You probably can, but this isn't to access the phone of some international criminal mastermind but of some guy that was picked up on the corner for peddling drugs. Its not like the NYPD can dump 500,000 or more for every phone they need to access. What worries me is that this will lead to laws being passed that will criminalize refusal to hand over passwords and encryption keys.
    - mehrdada 11y ago
      Each iPhone comes with a unique key burned into the processor. I believe the PIN is cryptographically combined with the unique key to derive the encryption key on device. That makes offline brute-force intractable without knowing the unique key (or somehow getting it out of the chip by looking at it or something, but it won't be easy).
      - beeboop 11y ago
        Ah yes, the infallible password that's really small and hard to see. I'm sure the guys at the NSA were all "man we'd need, like, a microscope or some shit to read that!" and just went to lunch and called it a day. There is literally nothing Apple could do to have a key of some sort on their processor that wouldn't be laughably easy for a well funded organization to get access to.
guelo 11y ago
Theoretically, couldn't Apple push an auto-update to the phone that could decrypt the data?
- jacobwil 11y ago
  Where would that software auto-update get the decryption key from? If the user has enabled a passcode, then their passcode is used in generation of the key used to protect the disk encryption key. Even if apple did push an update, the user would still have to unlock their device post-update.
  - MichaelGG 11y ago
    If the secure enclave runs signed updates, the rate limiting/auto-wipe could be removed.
  - baddox 11y ago
    The update could wait for the next time the user types in that password. If you own the phone (which you do if you can push OS updates), you can own the data on it. There's no way around that, unless the phone is already confiscated or the user knows to not type in their password.
    - johncolanduoni 11y ago
      > which you do if you can push OS updates Unless Apple already inserted a secret backdoor that allows for forced updates, you don't have to update the phone when it prompts you. The closest I've seen it get is a reminder that asks you if you'd like to schedule an update for 2:00 AM or some such time, and then asks for your passcode to do so. You still need to type it for the explicit purpose of updating for it to go through.
      - crazypyro 11y ago
        Was there not a huge storm when iOS 7 came out because they automatically pushed the update?
deleted 11y ago
[deleted]
api 11y ago
So on one hand we're carrying around little location-aware sensors that upload all kinds of tracking data to who-knows-where, enabling unprecedented tracking of human beings and their movements at incredibly high resolution. We also voluntarily post so much data online any number of social media sites, financial institutions, etc. can see almost everything we do. BUT on the other hand with proper use of crypto it is now possible to engage in secure communication at a distance that can never be decrypted without our consent and (if certain protocols and method are used) allow anonymity at both ends of the link (e.g. Tor hidden services). It is also possible to securely send money to others using Bitcoin without knowing their identity... ever. Very interesting times... it's both a panopticon and an unprecedented age for anonymity and privacy.
- revelation 11y ago
  Well no, you have already detailed the crucial vulnerability in this panopticon: the devices can not be trusted. Trying to do encryption and secure communication with untrusted devices then is utter folly. I'm just astonished by the breadth of vulnerability in modern smartphones, particularly with Googles handling of Android security. We haven't even gotten into baseband vulnerabilities yet because the whole applications processor security thing is just an entirely crumbling piece of cardboard.
asadhaider 11y ago
For users with Touch ID enabled, would it be legal for law enforcement to use your fingerprint on file to access the phone that way? I'm not sure how easy it would be to fool the touch ID sensor on the phone. I think I remember a MythBusters episode where they made a silicone mould of a fingerprint to bypass a security system.
- 0x0 11y ago
  TouchID requires a passcode after the phone has been locked for 48 hours or so.
- interpol_p 11y ago
  Too many failed attempts (three, I think) and the phone reverts to requiring a password. So unless they can get it right on the first try it would still be a bit of a risk — because even using your actual finger can miss at times.
- zaroth 11y ago
  Yes, and there is case law that fingerprints are not testimony (since you leave them everywhere you go). However, as others stated below, it won't work because the PIN is still required after a timeout. Really, they thought this through.
  - MBCook 11y ago
    Or you can quickly disable TouchID by giving it an invalid fingerprint too many times or simply shutting off the phone. Then you'll need a password and I don't believe they can compel that.
qyv 11y ago
The only direct quote in the article that offers any real context: "Forcing Apple to extract data in this case, absent clear legal authority to do so, could threaten the trust between Apple and its customers and substantially tarnish the Apple brand" This quote, granted taken without full context, seems to indicate a pretty clear stipulation of "clear legal authority". Not sure what to make of that, but I do think that in matters of privacy and surveillance the words are always chosen very carefully indeed.
shalmanese 11y ago
For those who have questions about "Couldn't Apple just do X or Y?", Apple has published an eminently readable whitepaper on the software and hardware components of their security: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf Of course, Apple could be implementing things differently from as described but the whitepaper lays out what is and is not possible in the described system.
- abtinf 11y ago
  If they are doing things substantially differently than outlined in that whitepaper, and so actually do have access to locked devices, then they would have just perjured themselves and exposed themselves to extraordinary liability. Which makes me think they are probably telling the truth - short of 0-days, no one has access to locked iOS devices.
- zaroth 11y ago
  The iOS Security Guide is 60 pages of technical goodness, but when dealing with encryption, it's really not enough to fully understand the system, even putting aside concerns about it being closed-source. There is such an incredible level of detail in the document, it would take a really long time to peel that onion back to be able to claim to really understand the trust model. It's some of the best technical documentation on encryption methods I've read, but even still there is plenty of room for ambiguity. The key section I think most people really should take a look at is "iCloud Backup" starting on page 42. Almost everything you do with your device will end up in an iCloud Backup if you have enabled that, and while the data is encrypted for transport, note well the following; The backup set is stored in the user’s iCloud account and consists of a copy of the user’s files, and the iCloud Backup keybag. The iCloud Backup keybag is protected by a random key, which is also stored with the backup set. (The user’s iCloud password is not utilized for encryption so that changing the iCloud password won’t invalidate existing backups.) In plain English, if you have enabled iCloud Backup, everything but your keychain itself is accessible in plaintext to Apple, and can be restored, without your password, to any new device that [you / the Feds] may provide. I would very much love for Apple to provide an opt-in where the iCloud backup key is tied to the account password with extremely aggressive key-stretching. I would take the risk of losing my iCloud Backup over the trade-off of having my backups accessible to Apple and anyone they can be compelled to share them with. But I do appreciate for the average user, it's not uncommon for iCloud Backup to be immediately preceded by a password reset (just look down-thread for an example). Note, Apple says that they use a combination of S3 and Azure to actually store the iCloud data, but that they have an additional layer of encryption over the data before sending it out. So while backups technically reside on Amazon/Microsoft servers, it's a black box to them.
dsfyu404ed 11y ago
They're saying "there isn't an easy way in that we know of" not that there isn't one...
- netheril96 11y ago
  No one can never be 100% sure that their security does not have flaws, either in design or in implementation.
  - briandear 11y ago
    Righ. But a court cannot compel Apple to find an unknown flaw in something to help law enforcement.
Learn2win 11y ago
It sounds Apple is saying "If you don't want law enforcement to to break into your iPhone, buy a newer iPhone."
- runholm 11y ago
  Specifically they can't break iPhones running iOS8 or newer. Which is available for quite old iPhones. I do not think this is an attempt to sell newer iPhones to the small fraction of users they have running iPhones too old for iOS8.
Learn2win 11y ago
It sounds Apple is saying "If you don't want law enforcement to to break into your iPhone, buy a newer iPhone."
PopeOfNope 11y ago
You hear that? That's the sound of a million security researchers simultaneously shouting 'Challenge Accepted!'
BWStearns 11y ago
I applaud Apple for having made it technically impossible for them to betray their customers' trust, but I was just wondering about third party applications which have been granted access to various data on the phone. If the prosecution is looking for evidence in photos, and the suspect has granted Facebook access to their photos, could a judge compel Facebook to use their access to the phone in question to retrieve photos that were never on Facebook? I ask this in both a legal sense as well as a technical sense as I am not familiar enough with iOS permissions/API.
- kevinchen 11y ago
  From my understanding - important files are encrypted, and the ability to decrypt is lost when the user sleeps their phone. So iOS needs the user to enter a passcode before the data can be read again.
  - seiji 11y ago
    Have there been any cases of police illegally forcing fingerprint unlock against a person's express consent? Finger unlock is nice when you're in a non-hostile environment, but now with a 100ms finger brush, the entire phone opens up wide and says "take all my data!" I wish iPhones had a feature like "if dropped on the floor (or after any 'significant' impact), remove session key to disable finger print auth and require password again." Then when you gotta cheese it, you just throw and go.
    - n0us 11y ago
      I think they can legally fingerprint you and use that to unlock the phone but they cannot force you to reveal your password because you would be forced to incriminate yourself. (If you did in fact commit a crime)
      - avn2109 11y ago
        This is just more evidence supporting the claim, which has already been persuasively argued elsewhere, [0] that fingerprints are usernames, not passwords. [0] http://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html http://blog.dustinkirkland.com/2013/10/fingerprints-are-user...
Titanous 11y ago
Here's the actual filing from Apple: https://s3.amazonaws.com/f.cl.ly/items/2G372p3E1D0m3806001A/document.pdf https://s3.amazonaws.com/f.cl.ly/items/2G372p3E1D0m3806001A/...
tacotuesday 11y ago
This sounds really similar to when the Snowden docs were first leaked. You have to listen very carefully to exactly what is said and read between the lines. http://www.cnet.com/news/obama-denies-that-us-spied-on-german-chancellor-or-does-he/?_escaped_fragment_=# http://www.cnet.com/news/obama-denies-that-us-spied-on-germa...! "the United States is not monitoring and will not monitor the communications" means, "Was monitoring up until just now." Here Apple says "We can't unlock new iPhones." Apple says nothing about their ability to restore iCloud backups or load software to capture evidence from a locked phone.
joeyspn 11y ago
In security, impossible is a marketing word
- venomsnake 11y ago
  There is situational impossibility though. Apple not being able to decrypt a powered down phone is possible if they did their design work properly.
  - joeyspn 11y ago
    > There is situational impossibility though. Agree, but often impossibility claims have an expiration date. They also said it would be impossible to jailbreak iOS 9 with the new rootless security... It took few months for a Chinese team to completely by-pass Apple's new design. http://www.forbes.com/sites/antonyleather/2015/10/18/how-to-jailbreak-your-ios-9-ipad-or-iphone/ http://www.forbes.com/sites/antonyleather/2015/10/18/how-to-...
xkiwi 11y ago
what if this is parallel construction? Can it state as 'impossible' to 'unlock'(crack/backdoor) in civil level but unlock-able on DoD/NSA level?
vbezhenar 11y ago
iPhone pincodes by default are very short. iPhone protects them from bruteforce with delays after unsuccessful tries. But does the hardware, where pincode's hash is stored, protects it with delays and protects it from labaratory attack? I mean, government could just open iPhone, extract that chip, extract pincode's hash and crack it. You would need quite long password to withstand such an attack. Another vector of attack is fingerprint scanner. After iPhone turned on, by default you can unlock it with fingerprint scanner. And turning iPhone off is not very quick, you need to push power button for a few seconds and then slide over screen. If police arresting you, then will get your phone from your hands and just force your finger to open it, no pincode needed. So yes, while iPhone is probably safe when properly configured (ruling out possible vulnerabilities), the proper configuration is hard to use and is not default. That's from the point of goverment attacker. If attacker is just some thieve or commercial espionage, probably iPhone is a good device even with default settings.
- BillinghamJ 11y ago
  Comments above suggest that the pincode information is managed within a HSM-esque onboard hardware device. As such, extracting that chip and retrieving the pincode hash is likely to be entirely infeasible, even for very capable orgs like the NSA.
jlebrech 11y ago
So the US wants it to be impossible for the average person to unlock a phone (via law) but Apple make it technically impossible and the US justice system cries foul. Swings and roundabouts.
randyrand 11y ago
Anyone know how iCloud backups are encrypted?
- frankzinger 11y ago
  This comment above by zaroth might answer your question: https://news.ycombinator.com/item?id=10422952 https://news.ycombinator.com/item?id=10422952
__sarcasm 11y ago
But what if some diabolical fiend attaches an encrypted iPhone to a nuclear bomb, and the only way to diffuse the timer is by asking Apple to unlock the encryption to stop the timer??? Also, "child pornography" ...what if "child pornography" is involved? You wouldn't want THAT, right?
yyhhsj0521 11y ago
Chrome says that the page contains malicious softwares... oops?

328 points by aaronbrethorst 11y ago

faide 11y ago

In case anyone shares my confusion: they aren't talking about unlocking in the sense of removing carrier restrictions, but rather in the sense of disabling the security features of the device to access the data stored on it.

daimyoyo 11y ago
I believe they're talking about trying to access a phone once it has been "locked" from too many wrong tries at the lock screen.
- pakled_engineer 11y ago
  That's what I got from the article, the key was wiped because of X many tries so Apple can't "unlock" the data on the device (excluding everything backed up to apple cloud). In the future they will use shady FinFisher iTunes and other exploits to grab the data then seize the phone.
alialkhatib 11y ago
I was similarly confused. While the HN title accurately reflects the Reuters title, I think it'd be reasonable to retitle the submission to something along the lines of "Apple: breaking encryption on devices running iOS 8 and newer 'would be impossible'", or something (point being to highlight that we're talking about the encryption issue, not carrier).
jmount 11y ago
I agree. For phones "unlock" means removing carrier restrictions and getting information off is something like "decrypt" or "crack."
- wan23 11y ago
  iOS devices have a "lock screen" where to use the device you have to enter a passcode or password or fingerprint to gain access to the device. Usually if you pick up someone's phone this is the screen that you see. https://9to5mac.files.wordpress.com/2013/07/screen-shot-2013-07-29-at-10-24-13-am.png https://9to5mac.files.wordpress.com/2013/07/screen-shot-2013... Note the "slide to unlock" message at the bottom. If you asked most users what it means to unlock a phone, this is what they would think of, as they see it every day.
  - benatkin 11y ago
    > If you asked most users what it means to unlock a phone, this is what they would think of, as they see it every day. [citation needed] "Unlocked phone" is not limited to experts. More than half a million hits on google: https://www.google.com/search?q=%22unlocked+phone%22&oq=%22unlocked+phone%22&aqs=chrome..69i57.2766j0j7&sourceid=chrome&es_sm=91&ie=UTF-8 https://www.google.com/search?q=%22unlocked+phone%22&oq=%22u... I really don't know what "most users" would think of.
    - somebehemoth 11y ago
      What possible citation could be better than the one provided? Apple has sold over 1 billion of these devices and they all share the same lock screen UI; 500,000 search results on Google pales in comparison as a citation. Edit: I understand your point and agree that unlocking a device would not mean exactly the same thing to all people. I just don't agree that the parent needed an additional citation.
supercoder 11y ago
Makes sense to anyone who uses an iPhone though.
- morganvachon 11y ago
  iPhone user here, and my first thought upon reading the headline was "unlocking" in the sense of carrier locks. Given that Apple sells unlocked phones in the first place, my mind immediately switched to the actual meaning of the headline. But still, there was a moment of confusion.

lemiant 11y ago

Can someone explain how Apple has managed to render brute force ineffective if there are only 10000 possible 4-digit passcodes?

jansenvt 11y ago
the same way everyone else does. they limit the number of attempts you get.
- simmons 11y ago
  I'm not too familiar with how iPhone hardware is put together, but is there a possibility of performing a forensic extraction of the flash memory and performing a brute-force attack offline? Or does the conversion of PIN to the storage encryption key happen in the secure enclave, which may resist such forensic meddling?
  - dogma1138 11y ago
    You probably can, but this isn't to access the phone of some international criminal mastermind but of some guy that was picked up on the corner for peddling drugs. Its not like the NYPD can dump 500,000 or more for every phone they need to access. What worries me is that this will lead to laws being passed that will criminalize refusal to hand over passwords and encryption keys.
  - mehrdada 11y ago
    Each iPhone comes with a unique key burned into the processor. I believe the PIN is cryptographically combined with the unique key to derive the encryption key on device. That makes offline brute-force intractable without knowing the unique key (or somehow getting it out of the chip by looking at it or something, but it won't be easy).
    - beeboop 11y ago
      Ah yes, the infallible password that's really small and hard to see. I'm sure the guys at the NSA were all "man we'd need, like, a microscope or some shit to read that!" and just went to lunch and called it a day. There is literally nothing Apple could do to have a key of some sort on their processor that wouldn't be laughably easy for a well funded organization to get access to.

guelo 11y ago

Theoretically, couldn't Apple push an auto-update to the phone that could decrypt the data?

jacobwil 11y ago
Where would that software auto-update get the decryption key from? If the user has enabled a passcode, then their passcode is used in generation of the key used to protect the disk encryption key. Even if apple did push an update, the user would still have to unlock their device post-update.
- MichaelGG 11y ago
  If the secure enclave runs signed updates, the rate limiting/auto-wipe could be removed.
- baddox 11y ago
  The update could wait for the next time the user types in that password. If you own the phone (which you do if you can push OS updates), you can own the data on it. There's no way around that, unless the phone is already confiscated or the user knows to not type in their password.
  - johncolanduoni 11y ago
    > which you do if you can push OS updates Unless Apple already inserted a secret backdoor that allows for forced updates, you don't have to update the phone when it prompts you. The closest I've seen it get is a reminder that asks you if you'd like to schedule an update for 2:00 AM or some such time, and then asks for your passcode to do so. You still need to type it for the explicit purpose of updating for it to go through.
    - crazypyro 11y ago
      Was there not a huge storm when iOS 7 came out because they automatically pushed the update?

deleted 11y ago

[deleted]

api 11y ago

So on one hand we're carrying around little location-aware sensors that upload all kinds of tracking data to who-knows-where, enabling unprecedented tracking of human beings and their movements at incredibly high resolution. We also voluntarily post so much data online any number of social media sites, financial institutions, etc. can see almost everything we do. BUT on the other hand with proper use of crypto it is now possible to engage in secure communication at a distance that can never be decrypted without our consent and (if certain protocols and method are used) allow anonymity at both ends of the link (e.g. Tor hidden services). It is also possible to securely send money to others using Bitcoin without knowing their identity... ever. Very interesting times... it's both a panopticon and an unprecedented age for anonymity and privacy.

revelation 11y ago
Well no, you have already detailed the crucial vulnerability in this panopticon: the devices can not be trusted. Trying to do encryption and secure communication with untrusted devices then is utter folly. I'm just astonished by the breadth of vulnerability in modern smartphones, particularly with Googles handling of Android security. We haven't even gotten into baseband vulnerabilities yet because the whole applications processor security thing is just an entirely crumbling piece of cardboard.

asadhaider 11y ago

For users with Touch ID enabled, would it be legal for law enforcement to use your fingerprint on file to access the phone that way? I'm not sure how easy it would be to fool the touch ID sensor on the phone. I think I remember a MythBusters episode where they made a silicone mould of a fingerprint to bypass a security system.

0x0 11y ago
TouchID requires a passcode after the phone has been locked for 48 hours or so.
interpol_p 11y ago
Too many failed attempts (three, I think) and the phone reverts to requiring a password. So unless they can get it right on the first try it would still be a bit of a risk — because even using your actual finger can miss at times.
zaroth 11y ago
Yes, and there is case law that fingerprints are not testimony (since you leave them everywhere you go). However, as others stated below, it won't work because the PIN is still required after a timeout. Really, they thought this through.
- MBCook 11y ago
  Or you can quickly disable TouchID by giving it an invalid fingerprint too many times or simply shutting off the phone. Then you'll need a password and I don't believe they can compel that.

qyv 11y ago

The only direct quote in the article that offers any real context: "Forcing Apple to extract data in this case, absent clear legal authority to do so, could threaten the trust between Apple and its customers and substantially tarnish the Apple brand" This quote, granted taken without full context, seems to indicate a pretty clear stipulation of "clear legal authority". Not sure what to make of that, but I do think that in matters of privacy and surveillance the words are always chosen very carefully indeed.

shalmanese 11y ago

For those who have questions about "Couldn't Apple just do X or Y?", Apple has published an eminently readable whitepaper on the software and hardware components of their security: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf Of course, Apple could be implementing things differently from as described but the whitepaper lays out what is and is not possible in the described system.

abtinf 11y ago
If they are doing things substantially differently than outlined in that whitepaper, and so actually do have access to locked devices, then they would have just perjured themselves and exposed themselves to extraordinary liability. Which makes me think they are probably telling the truth - short of 0-days, no one has access to locked iOS devices.
zaroth 11y ago
The iOS Security Guide is 60 pages of technical goodness, but when dealing with encryption, it's really not enough to fully understand the system, even putting aside concerns about it being closed-source. There is such an incredible level of detail in the document, it would take a really long time to peel that onion back to be able to claim to really understand the trust model. It's some of the best technical documentation on encryption methods I've read, but even still there is plenty of room for ambiguity. The key section I think most people really should take a look at is "iCloud Backup" starting on page 42. Almost everything you do with your device will end up in an iCloud Backup if you have enabled that, and while the data is encrypted for transport, note well the following; The backup set is stored in the user’s iCloud account and consists of a copy of the user’s files, and the iCloud Backup keybag. The iCloud Backup keybag is protected by a random key, which is also stored with the backup set. (The user’s iCloud password is not utilized for encryption so that changing the iCloud password won’t invalidate existing backups.) In plain English, if you have enabled iCloud Backup, everything but your keychain itself is accessible in plaintext to Apple, and can be restored, without your password, to any new device that [you / the Feds] may provide. I would very much love for Apple to provide an opt-in where the iCloud backup key is tied to the account password with extremely aggressive key-stretching. I would take the risk of losing my iCloud Backup over the trade-off of having my backups accessible to Apple and anyone they can be compelled to share them with. But I do appreciate for the average user, it's not uncommon for iCloud Backup to be immediately preceded by a password reset (just look down-thread for an example). Note, Apple says that they use a combination of S3 and Azure to actually store the iCloud data, but that they have an additional layer of encryption over the data before sending it out. So while backups technically reside on Amazon/Microsoft servers, it's a black box to them.

dsfyu404ed 11y ago

They're saying "there isn't an easy way in that we know of" not that there isn't one...

netheril96 11y ago
No one can never be 100% sure that their security does not have flaws, either in design or in implementation.
- briandear 11y ago
  Righ. But a court cannot compel Apple to find an unknown flaw in something to help law enforcement.

Learn2win 11y ago

It sounds Apple is saying "If you don't want law enforcement to to break into your iPhone, buy a newer iPhone."

runholm 11y ago
Specifically they can't break iPhones running iOS8 or newer. Which is available for quite old iPhones. I do not think this is an attempt to sell newer iPhones to the small fraction of users they have running iPhones too old for iOS8.

Learn2win 11y ago

It sounds Apple is saying "If you don't want law enforcement to to break into your iPhone, buy a newer iPhone."

PopeOfNope 11y ago

You hear that? That's the sound of a million security researchers simultaneously shouting 'Challenge Accepted!'

BWStearns 11y ago

I applaud Apple for having made it technically impossible for them to betray their customers' trust, but I was just wondering about third party applications which have been granted access to various data on the phone. If the prosecution is looking for evidence in photos, and the suspect has granted Facebook access to their photos, could a judge compel Facebook to use their access to the phone in question to retrieve photos that were never on Facebook? I ask this in both a legal sense as well as a technical sense as I am not familiar enough with iOS permissions/API.

kevinchen 11y ago
From my understanding - important files are encrypted, and the ability to decrypt is lost when the user sleeps their phone. So iOS needs the user to enter a passcode before the data can be read again.
- seiji 11y ago
  Have there been any cases of police illegally forcing fingerprint unlock against a person's express consent? Finger unlock is nice when you're in a non-hostile environment, but now with a 100ms finger brush, the entire phone opens up wide and says "take all my data!" I wish iPhones had a feature like "if dropped on the floor (or after any 'significant' impact), remove session key to disable finger print auth and require password again." Then when you gotta cheese it, you just throw and go.
  - n0us 11y ago
    I think they can legally fingerprint you and use that to unlock the phone but they cannot force you to reveal your password because you would be forced to incriminate yourself. (If you did in fact commit a crime)
    - avn2109 11y ago
      This is just more evidence supporting the claim, which has already been persuasively argued elsewhere, [0] that fingerprints are usernames, not passwords. [0] http://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html http://blog.dustinkirkland.com/2013/10/fingerprints-are-user...

Titanous 11y ago

Here's the actual filing from Apple: https://s3.amazonaws.com/f.cl.ly/items/2G372p3E1D0m3806001A/document.pdf https://s3.amazonaws.com/f.cl.ly/items/2G372p3E1D0m3806001A/...

tacotuesday 11y ago

This sounds really similar to when the Snowden docs were first leaked. You have to listen very carefully to exactly what is said and read between the lines. http://www.cnet.com/news/obama-denies-that-us-spied-on-german-chancellor-or-does-he/?_escaped_fragment_=# http://www.cnet.com/news/obama-denies-that-us-spied-on-germa...! "the United States is not monitoring and will not monitor the communications" means, "Was monitoring up until just now." Here Apple says "We can't unlock new iPhones." Apple says nothing about their ability to restore iCloud backups or load software to capture evidence from a locked phone.

joeyspn 11y ago

In security, impossible is a marketing word

venomsnake 11y ago
There is situational impossibility though. Apple not being able to decrypt a powered down phone is possible if they did their design work properly.
- joeyspn 11y ago
  > There is situational impossibility though. Agree, but often impossibility claims have an expiration date. They also said it would be impossible to jailbreak iOS 9 with the new rootless security... It took few months for a Chinese team to completely by-pass Apple's new design. http://www.forbes.com/sites/antonyleather/2015/10/18/how-to-jailbreak-your-ios-9-ipad-or-iphone/ http://www.forbes.com/sites/antonyleather/2015/10/18/how-to-...

xkiwi 11y ago

what if this is parallel construction? Can it state as 'impossible' to 'unlock'(crack/backdoor) in civil level but unlock-able on DoD/NSA level?

vbezhenar 11y ago

iPhone pincodes by default are very short. iPhone protects them from bruteforce with delays after unsuccessful tries. But does the hardware, where pincode's hash is stored, protects it with delays and protects it from labaratory attack? I mean, government could just open iPhone, extract that chip, extract pincode's hash and crack it. You would need quite long password to withstand such an attack. Another vector of attack is fingerprint scanner. After iPhone turned on, by default you can unlock it with fingerprint scanner. And turning iPhone off is not very quick, you need to push power button for a few seconds and then slide over screen. If police arresting you, then will get your phone from your hands and just force your finger to open it, no pincode needed. So yes, while iPhone is probably safe when properly configured (ruling out possible vulnerabilities), the proper configuration is hard to use and is not default. That's from the point of goverment attacker. If attacker is just some thieve or commercial espionage, probably iPhone is a good device even with default settings.

BillinghamJ 11y ago
Comments above suggest that the pincode information is managed within a HSM-esque onboard hardware device. As such, extracting that chip and retrieving the pincode hash is likely to be entirely infeasible, even for very capable orgs like the NSA.

jlebrech 11y ago

So the US wants it to be impossible for the average person to unlock a phone (via law) but Apple make it technically impossible and the US justice system cries foul. Swings and roundabouts.

randyrand 11y ago

Anyone know how iCloud backups are encrypted?

frankzinger 11y ago
This comment above by zaroth might answer your question: https://news.ycombinator.com/item?id=10422952 https://news.ycombinator.com/item?id=10422952

__sarcasm 11y ago

But what if some diabolical fiend attaches an encrypted iPhone to a nuclear bomb, and the only way to diffuse the timer is by asking Apple to unlock the encryption to stop the timer??? Also, "child pornography" ...what if "child pornography" is involved? You wouldn't want THAT, right?

yyhhsj0521 11y ago

Chrome says that the page contains malicious softwares... oops?