3 ms·

For those who have questions about "Couldn't Apple just do X or Y?", Apple has published an eminently readable whitepaper on the software and hardware component

For those who have questions about "Couldn't Apple just do X or Y?", Apple has published an eminently readable whitepaper on the software and hardware components of their security: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf Of course, Apple could be implementing things differently from as described but the whitepaper lays out what is and is not possible in the described system.

abtinf 11y ago
If they are doing things substantially differently than outlined in that whitepaper, and so actually do have access to locked devices, then they would have just perjured themselves and exposed themselves to extraordinary liability. Which makes me think they are probably telling the truth - short of 0-days, no one has access to locked iOS devices.
zaroth 11y ago
The iOS Security Guide is 60 pages of technical goodness, but when dealing with encryption, it's really not enough to fully understand the system, even putting aside concerns about it being closed-source. There is such an incredible level of detail in the document, it would take a really long time to peel that onion back to be able to claim to really understand the trust model. It's some of the best technical documentation on encryption methods I've read, but even still there is plenty of room for ambiguity. The key section I think most people really should take a look at is "iCloud Backup" starting on page 42. Almost everything you do with your device will end up in an iCloud Backup if you have enabled that, and while the data is encrypted for transport, note well the following; The backup set is stored in the user’s iCloud account and consists of a copy of the user’s files, and the iCloud Backup keybag. The iCloud Backup keybag is protected by a random key, which is also stored with the backup set. (The user’s iCloud password is not utilized for encryption so that changing the iCloud password won’t invalidate existing backups.) In plain English, if you have enabled iCloud Backup, everything but your keychain itself is accessible in plaintext to Apple, and can be restored, without your password, to any new device that [you / the Feds] may provide. I would very much love for Apple to provide an opt-in where the iCloud backup key is tied to the account password with extremely aggressive key-stretching. I would take the risk of losing my iCloud Backup over the trade-off of having my backups accessible to Apple and anyone they can be compelled to share them with. But I do appreciate for the average user, it's not uncommon for iCloud Backup to be immediately preceded by a password reset (just look down-thread for an example). Note, Apple says that they use a combination of S3 and Azure to actually store the iCloud data, but that they have an additional layer of encryption over the data before sending it out. So while backups technically reside on Amazon/Microsoft servers, it's a black box to them.
- shalmanese 11y ago
  Yup. As the celebrity photo hacking should have made clear, Apple can only offer far weaker security guarantees on the web because they control less of the ecosystem. At a minimum, if the police get access to your email account, they can force a Apple ID password reset and then restore your data onto a new device without needing permission from you or Apple. Note however it is still possible to backup your iphone locally using iTunes and Apple now supports encrypted local backups. If you are worried about this threat vector, encrypted local backups provides a large degree of the same usability with significantly stronger security guarantees.
  - jameshart 11y ago
    "if the police get access to your email account, they can force a Apple ID password reset" That's an interesting assertion. I mean, yes, sure, they could do that, but it's an interesting question of whether they are legally allowed to do that. Effectively they'd be misrepresenting themselves to your email provider and to Apple as if they were you. Is that acceptable 'undercover policing'? Can they reset your banking password too? Can they do this only while they have you under arrest?
    - FD3SA 11y ago
      They don't need to admit they did it. Parallel construction works more effectively.
      - eridius 11y ago
        If they have information that was only present on your device or your iCloud backup, and they already can't get at your device, how exactly does parallel construction help them explain the fact that their evidence includes information that could have only been obtained one way?
        Natanael_L 11y ago
        Because that's not the evidence they present, they use that to figure out where else to look for evidence, pretending they found that randomly or by guesswork or suspicion or following an anonymous call.

abtinf 11y ago

If they are doing things substantially differently than outlined in that whitepaper, and so actually do have access to locked devices, then they would have just perjured themselves and exposed themselves to extraordinary liability. Which makes me think they are probably telling the truth - short of 0-days, no one has access to locked iOS devices.

zaroth 11y ago

The iOS Security Guide is 60 pages of technical goodness, but when dealing with encryption, it's really not enough to fully understand the system, even putting aside concerns about it being closed-source. There is such an incredible level of detail in the document, it would take a really long time to peel that onion back to be able to claim to really understand the trust model. It's some of the best technical documentation on encryption methods I've read, but even still there is plenty of room for ambiguity. The key section I think most people really should take a look at is "iCloud Backup" starting on page 42. Almost everything you do with your device will end up in an iCloud Backup if you have enabled that, and while the data is encrypted for transport, note well the following; The backup set is stored in the user’s iCloud account and consists of a copy of the user’s files, and the iCloud Backup keybag. The iCloud Backup keybag is protected by a random key, which is also stored with the backup set. (The user’s iCloud password is not utilized for encryption so that changing the iCloud password won’t invalidate existing backups.) In plain English, if you have enabled iCloud Backup, everything but your keychain itself is accessible in plaintext to Apple, and can be restored, without your password, to any new device that [you / the Feds] may provide. I would very much love for Apple to provide an opt-in where the iCloud backup key is tied to the account password with extremely aggressive key-stretching. I would take the risk of losing my iCloud Backup over the trade-off of having my backups accessible to Apple and anyone they can be compelled to share them with. But I do appreciate for the average user, it's not uncommon for iCloud Backup to be immediately preceded by a password reset (just look down-thread for an example). Note, Apple says that they use a combination of S3 and Azure to actually store the iCloud data, but that they have an additional layer of encryption over the data before sending it out. So while backups technically reside on Amazon/Microsoft servers, it's a black box to them.

shalmanese 11y ago
Yup. As the celebrity photo hacking should have made clear, Apple can only offer far weaker security guarantees on the web because they control less of the ecosystem. At a minimum, if the police get access to your email account, they can force a Apple ID password reset and then restore your data onto a new device without needing permission from you or Apple. Note however it is still possible to backup your iphone locally using iTunes and Apple now supports encrypted local backups. If you are worried about this threat vector, encrypted local backups provides a large degree of the same usability with significantly stronger security guarantees.
- jameshart 11y ago
  "if the police get access to your email account, they can force a Apple ID password reset" That's an interesting assertion. I mean, yes, sure, they could do that, but it's an interesting question of whether they are legally allowed to do that. Effectively they'd be misrepresenting themselves to your email provider and to Apple as if they were you. Is that acceptable 'undercover policing'? Can they reset your banking password too? Can they do this only while they have you under arrest?
  - FD3SA 11y ago
    They don't need to admit they did it. Parallel construction works more effectively.
    - eridius 11y ago
      If they have information that was only present on your device or your iCloud backup, and they already can't get at your device, how exactly does parallel construction help them explain the fact that their evidence includes information that could have only been obtained one way?
      - Natanael_L 11y ago
        Because that's not the evidence they present, they use that to figure out where else to look for evidence, pretending they found that randomly or by guesswork or suspicion or following an anonymous call.