7 ms·

I applaud Apple for having made it technically impossible for them to betray their customers' trust, but I was just wondering about third party applications whi

I applaud Apple for having made it technically impossible for them to betray their customers' trust, but I was just wondering about third party applications which have been granted access to various data on the phone. If the prosecution is looking for evidence in photos, and the suspect has granted Facebook access to their photos, could a judge compel Facebook to use their access to the phone in question to retrieve photos that were never on Facebook? I ask this in both a legal sense as well as a technical sense as I am not familiar enough with iOS permissions/API.

kevinchen 11y ago
From my understanding - important files are encrypted, and the ability to decrypt is lost when the user sleeps their phone. So iOS needs the user to enter a passcode before the data can be read again.
- seiji 11y ago
  Have there been any cases of police illegally forcing fingerprint unlock against a person's express consent? Finger unlock is nice when you're in a non-hostile environment, but now with a 100ms finger brush, the entire phone opens up wide and says "take all my data!" I wish iPhones had a feature like "if dropped on the floor (or after any 'significant' impact), remove session key to disable finger print auth and require password again." Then when you gotta cheese it, you just throw and go.
  - n0us 11y ago
    I think they can legally fingerprint you and use that to unlock the phone but they cannot force you to reveal your password because you would be forced to incriminate yourself. (If you did in fact commit a crime)
    - avn2109 11y ago
      This is just more evidence supporting the claim, which has already been persuasively argued elsewhere, [0] that fingerprints are usernames, not passwords. [0] http://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html http://blog.dustinkirkland.com/2013/10/fingerprints-are-user...
      - schrodinger 11y ago
        It's way more nuanced than that. Fingerprints are certainly way more like a password versus an adversary like a crazy girlfriend who gets your phone, but closer to a username against a very formidable adversary. Certainly not equal though.
        calgoo 11y ago
        So more like a token?
  - EiZei 11y ago
    Or you could just turn since first authentication after booting requires a passcode.
    - seiji 11y ago
      Situation: you're arrested/captured/etc. All they have to do is, on a new 6S phone, touch your finger to the sensor for 1/10th of a second. There's no emergency evac situation. You either have basically no protection from hostile action or you avoid finger auth.
      - ViViDboarder 11y ago
        I think it's to be determined if that would be an illegal search.
        rogeryu 11y ago
        If they do stuff like that, they will probably deny that they did it. Having had access to your phone, they can look for information that can be used to find other leads, that will be strong enough for a court order.
      - Retra 11y ago
        If you're an international spy or something, maybe don't store your top secret data on consumer-grade electronics.
        seiji 11y ago
        Or someone you sleep with wants to read your texts and all it takes is a light tap of a finger while you're unconscious to open your phone completely. as far as "international spy," we have national level security directors storing secrets in AOL accounts. We can't protect people from themselves, so we have to make systems better for everybody.
        deleted 11y ago
        [deleted]
  - kbenson 11y ago
    Why would they have to force that? It's not too hard to manufacture something that will bypass the fingerprint unlock using rubber cement or silicon gel, especially for an organization that is one of the few expected to have your fingerprints on file (at least in the scenario we are describing, where you're already in custody).
    - seiji 11y ago
      Also: finger unlock only works after a password has been entered once (to generate the "finger unlock" key). Copying fingerprints or compelling finger access is moot if the device dumps the finger unlock key (as is done after 48 hours of no finger auth or after 5 (?) failed finger auth attempts). But, trying to revoke the finger auth key in an emergency (less than 5 seconds) is difficult. Your only option is to try and quickly power off the device, but you're at the mercy of the "press and hold sleep/wake button for 5 seconds, then slide to turn off" delay timer.
      - idlewords 11y ago
        Or quickly chew off your fingers.
      - deleted 11y ago
        [deleted]
      - evan_ 11y ago
        If you hold the power and face buttons for about 10 seconds the phone will turn off. Takes two hands though.
      - srwx 11y ago
        Android dumps all "smart unlock" options when you press and hold (1 second) on the 'slide to unlock' on screen button and forces passcode/password/pin from that point on. I practice doing this so it's not foreign to me if I ever find myself in a dodgy scenario.
        gambiting 11y ago
  - acdha 11y ago
    How often does that happen outside of TV? In most cases where you have legal protection which actually works, you would also be able to power down the phone. In most of the other scenarios, most people are going to unlock it anyway under the threat of a beating or threats that non-cooperation will result in heavy/fabricated charges.
    - venomsnake 11y ago
      > threats that non-cooperation will result in heavy/fabricated charges. Being DA 101
  - prawn 11y ago
    Fingerprint unlock allows 5 fingers on file. Maybe if you attempted an unlock with a different finger (pinky, say), it locked out that method until you'd used your passcode instead? Similar to the idea of having a second PIN on your credit card that allows access but indicates acting-under-duress to the bank.
    - seiji 11y ago
      Yeah, there are a lot of clever ways it could be done, but with completely closed platforms we are just at the mercy of our proprietarily coded overlords.
      - prawn 11y ago
        Can appreciate that, but I do think Apple are showing genuine signs of caring about users in this area.
      - pjmlp 11y ago
        The other ones the code is just there to take it, code review it and use any loopholes.
    - Forlien 11y ago
      When police departments seize electronics, like phones or computers, I thought it was standard for them to clone any hard drives so that they don't lose any data to similar techniques. Is there a reason that they couldn't employ this countermeasure for your suggested security?
      - nickff 11y ago
        It is possible to secure devices in ways that even the correct passcode or fingerprint will only work with a specific chipset/decryption module. Some flash storage is also only readable after an unlock code has been transmitted.
    - sah2ed 11y ago
      > Similar to the idea of having a second PIN on your credit card that allows access but indicates acting-under-duress to the bank. Sounds like you are alluding to being able to use a reverse version of your PIN on an ATM when in duress? It's a trope [0]. [0] http://www.snopes.com/business/bank/pinalert.asp http://www.snopes.com/business/bank/pinalert.asp
  - mattlutze 11y ago
    There's a setting, in the most recent iOS at least, you can enable where 10 failed fingerprint attempts will trigger the phone to wipe itself.
  - Shivetya 11y ago
    I just like the idea of training it to learn different fingers... you know what I mean. just like it needs passcodes that do that same, if not more. a passcode to let you in, one to CALL the cops, and another to thwart them
- chisleu 11y ago
  Current iphones can be unlocked by asking siri for the time. I doubt the new iPhone security is much better.
  - avn2109 11y ago
    Can you give more details on how this works? I just tried and couldn't get it.
    - chisleu 11y ago
      Someone demo'd it on a couple new iphones at the hackerspace yesterday. They got to the homescreen with all the app buttons through the clock exploit. It wasn't just access to the dialer. Once you get through to the clock, you can hit the home button and it just hops to the home screen. I have no idea how this works in regard to the encryption. It isn't likely anyone else here does either. They are just speculating. I hope that it is good, but I don't trust it. No one should trust it. I would look, but I don't own an iPhone.
      - avn2109 11y ago
        I've spent a fair amount of time now trying to reproduce this on iOS 9.02 on a 5s, and I can't make it work. I can easily get to the clock by asking Siri and then tapping the clock in her results, or by swiping up from the bottom of the screen, but either way when I press the home button it dumps me back to the "Enter Your Passcode" screen. I don't mean this as a claim that the iPhone is a secure device, since it obviously isn't in several different ways, but rather just that I can't reproduce this specific behavior.
  - mahyarm 11y ago
    How can you do that? Are you sure your not just engaging touch id? I tried it with my thumb, which 'unlocked'. Then I tried again with my fingernail, which didn't unlock it.
  - deleted 11y ago
    [deleted]
dmayle 11y ago
What's more is the app update mechanism. From a technical standpoint, Apple just has to deliver an app update via auto-update to a version of an app that has the necessary access
- rusbus 11y ago
  But conceivably apps can't update when the phone is locked?
  - awqrre 11y ago
    but whenever you are using your phone, it is unlocked and not encrypted and all data could be transfered at that time (or any update could be installed)... 4G is pretty fast and it would not take very long and could be hard to notice.
avn2109 11y ago
>> "...technically impossible for them to betray their customers' trust..." Impossible is a very strong word in this context. Let me take the opportunity to remind everyone that an iPhone is a very complicated device running nearly 100% closed source hardware and software, include all sorts of opaque cryptographic hardware and a known-to-be-compromised secondary baseband computer, such that the security of the device's entire stack, top-to-bottom, could not possibly be verified by a third party in principle, let alone in practice. In light of that fact, security claims by Apple could be regarded as changing (reducing?) the probability of the law getting your data by technical means or collusion with Cupertino, but certainly not as insuring that the probability = 0. Edit: This is not an indictment of Apple per se, since the same is true of literally every smartphone ever constructed, but at least e.g. Blackberry isn't out there claiming that they're unable to compromise your data, full stop.
- BWStearns 11y ago
  I wasn't trying to imply that Apple has forged a perfectly secure complex system, but rather that they have (likely) legally and practically prevented themselves from being compelled to betray their users. While forcing Apple to hand over a password they have stored in plaintext is quite definitely in the legal realm of accepted behavior, I don't think a judge could reasonably order Apple to devote engineering time towards defeating their own security system in order to make the prosecution's job easier, especially when it is not actually assured that the effort would be a success and any success would preclude the same work from being used in subsequent prosecutions. I was merely skipping the caveats (back doors, implementation error, leaky behavior, etc) and giving benefit of the doubt with regards to honesty of intentions.
  - ckcheng 11y ago
    I think "legally and practically prevented" is key here. Not sure if anyone noticed but this article is like a continuation of the story from days ago [1] when the judge in the case "questioned the government’s authority to compel Apple to unlock a seized mobile device using the All Writs Act" [2] and "called on Apple to weigh in about whether it is even capable of bypassing the lock screen in this case" [2]. Guess Apple has weighed in now as to its technical feasibility. Now it's up to the judge to decide whether it is an unreasonable burden on Apple, and whether it violates the Constitution, as to whether to compel Apple to help in the Justice Department's investigation. In this one single case, the iPhone has an older iOS, so maybe it's not an "unreasonable burden". But if it was iOS 8 or later, it might be deemed an unreasonable burden to compel Apple to brute force or otherwise crack the password, even if it was somehow technically possible. And "forcing Apple to push backdoored updates would constitute 'compelled speech' in violation of the First Amendment" [2]. So it does look as if Apple thought it through, and made iOS 8 so that they legally and practically cannot "betray their customers' trust" as you say. [1] https://news.ycombinator.com/item?id=10383253 https://news.ycombinator.com/item?id=10383253 [2] https://www.eff.org/deeplinks/2015/10/judge-doj-not-all-writs https://www.eff.org/deeplinks/2015/10/judge-doj-not-all-writ...

kevinchen 11y ago

From my understanding - important files are encrypted, and the ability to decrypt is lost when the user sleeps their phone. So iOS needs the user to enter a passcode before the data can be read again.

seiji 11y ago
Have there been any cases of police illegally forcing fingerprint unlock against a person's express consent? Finger unlock is nice when you're in a non-hostile environment, but now with a 100ms finger brush, the entire phone opens up wide and says "take all my data!" I wish iPhones had a feature like "if dropped on the floor (or after any 'significant' impact), remove session key to disable finger print auth and require password again." Then when you gotta cheese it, you just throw and go.
- n0us 11y ago
  I think they can legally fingerprint you and use that to unlock the phone but they cannot force you to reveal your password because you would be forced to incriminate yourself. (If you did in fact commit a crime)
  - avn2109 11y ago
    This is just more evidence supporting the claim, which has already been persuasively argued elsewhere, [0] that fingerprints are usernames, not passwords. [0] http://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html http://blog.dustinkirkland.com/2013/10/fingerprints-are-user...
    - schrodinger 11y ago
      It's way more nuanced than that. Fingerprints are certainly way more like a password versus an adversary like a crazy girlfriend who gets your phone, but closer to a username against a very formidable adversary. Certainly not equal though.
      - calgoo 11y ago
        So more like a token?
- EiZei 11y ago
  Or you could just turn since first authentication after booting requires a passcode.
  - seiji 11y ago
    Situation: you're arrested/captured/etc. All they have to do is, on a new 6S phone, touch your finger to the sensor for 1/10th of a second. There's no emergency evac situation. You either have basically no protection from hostile action or you avoid finger auth.
    - ViViDboarder 11y ago
      I think it's to be determined if that would be an illegal search.
      - rogeryu 11y ago
        If they do stuff like that, they will probably deny that they did it. Having had access to your phone, they can look for information that can be used to find other leads, that will be strong enough for a court order.
    - Retra 11y ago
      If you're an international spy or something, maybe don't store your top secret data on consumer-grade electronics.
      - seiji 11y ago
        Or someone you sleep with wants to read your texts and all it takes is a light tap of a finger while you're unconscious to open your phone completely. as far as "international spy," we have national level security directors storing secrets in AOL accounts. We can't protect people from themselves, so we have to make systems better for everybody.
        deleted 11y ago
        [deleted]
- kbenson 11y ago
  Why would they have to force that? It's not too hard to manufacture something that will bypass the fingerprint unlock using rubber cement or silicon gel, especially for an organization that is one of the few expected to have your fingerprints on file (at least in the scenario we are describing, where you're already in custody).
  - seiji 11y ago
    Also: finger unlock only works after a password has been entered once (to generate the "finger unlock" key). Copying fingerprints or compelling finger access is moot if the device dumps the finger unlock key (as is done after 48 hours of no finger auth or after 5 (?) failed finger auth attempts). But, trying to revoke the finger auth key in an emergency (less than 5 seconds) is difficult. Your only option is to try and quickly power off the device, but you're at the mercy of the "press and hold sleep/wake button for 5 seconds, then slide to turn off" delay timer.
    - idlewords 11y ago
      Or quickly chew off your fingers.
    - deleted 11y ago
      [deleted]
    - evan_ 11y ago
      If you hold the power and face buttons for about 10 seconds the phone will turn off. Takes two hands though.
    - srwx 11y ago
      Android dumps all "smart unlock" options when you press and hold (1 second) on the 'slide to unlock' on screen button and forces passcode/password/pin from that point on. I practice doing this so it's not foreign to me if I ever find myself in a dodgy scenario.
      - gambiting 11y ago
- acdha 11y ago
  How often does that happen outside of TV? In most cases where you have legal protection which actually works, you would also be able to power down the phone. In most of the other scenarios, most people are going to unlock it anyway under the threat of a beating or threats that non-cooperation will result in heavy/fabricated charges.
  - venomsnake 11y ago
    > threats that non-cooperation will result in heavy/fabricated charges. Being DA 101
- prawn 11y ago
  Fingerprint unlock allows 5 fingers on file. Maybe if you attempted an unlock with a different finger (pinky, say), it locked out that method until you'd used your passcode instead? Similar to the idea of having a second PIN on your credit card that allows access but indicates acting-under-duress to the bank.
  - seiji 11y ago
    Yeah, there are a lot of clever ways it could be done, but with completely closed platforms we are just at the mercy of our proprietarily coded overlords.
    - prawn 11y ago
      Can appreciate that, but I do think Apple are showing genuine signs of caring about users in this area.
    - pjmlp 11y ago
      The other ones the code is just there to take it, code review it and use any loopholes.
  - Forlien 11y ago
    When police departments seize electronics, like phones or computers, I thought it was standard for them to clone any hard drives so that they don't lose any data to similar techniques. Is there a reason that they couldn't employ this countermeasure for your suggested security?
    - nickff 11y ago
      It is possible to secure devices in ways that even the correct passcode or fingerprint will only work with a specific chipset/decryption module. Some flash storage is also only readable after an unlock code has been transmitted.
  - sah2ed 11y ago
    > Similar to the idea of having a second PIN on your credit card that allows access but indicates acting-under-duress to the bank. Sounds like you are alluding to being able to use a reverse version of your PIN on an ATM when in duress? It's a trope [0]. [0] http://www.snopes.com/business/bank/pinalert.asp http://www.snopes.com/business/bank/pinalert.asp
- mattlutze 11y ago
  There's a setting, in the most recent iOS at least, you can enable where 10 failed fingerprint attempts will trigger the phone to wipe itself.
- Shivetya 11y ago
  I just like the idea of training it to learn different fingers... you know what I mean. just like it needs passcodes that do that same, if not more. a passcode to let you in, one to CALL the cops, and another to thwart them
chisleu 11y ago
Current iphones can be unlocked by asking siri for the time. I doubt the new iPhone security is much better.
- avn2109 11y ago
  Can you give more details on how this works? I just tried and couldn't get it.
  - chisleu 11y ago
    Someone demo'd it on a couple new iphones at the hackerspace yesterday. They got to the homescreen with all the app buttons through the clock exploit. It wasn't just access to the dialer. Once you get through to the clock, you can hit the home button and it just hops to the home screen. I have no idea how this works in regard to the encryption. It isn't likely anyone else here does either. They are just speculating. I hope that it is good, but I don't trust it. No one should trust it. I would look, but I don't own an iPhone.
    - avn2109 11y ago
      I've spent a fair amount of time now trying to reproduce this on iOS 9.02 on a 5s, and I can't make it work. I can easily get to the clock by asking Siri and then tapping the clock in her results, or by swiping up from the bottom of the screen, but either way when I press the home button it dumps me back to the "Enter Your Passcode" screen. I don't mean this as a claim that the iPhone is a secure device, since it obviously isn't in several different ways, but rather just that I can't reproduce this specific behavior.
- mahyarm 11y ago
  How can you do that? Are you sure your not just engaging touch id? I tried it with my thumb, which 'unlocked'. Then I tried again with my fingernail, which didn't unlock it.
- deleted 11y ago
  [deleted]

dmayle 11y ago

What's more is the app update mechanism. From a technical standpoint, Apple just has to deliver an app update via auto-update to a version of an app that has the necessary access

rusbus 11y ago
But conceivably apps can't update when the phone is locked?
- awqrre 11y ago
  but whenever you are using your phone, it is unlocked and not encrypted and all data could be transfered at that time (or any update could be installed)... 4G is pretty fast and it would not take very long and could be hard to notice.

avn2109 11y ago

>> "...technically impossible for them to betray their customers' trust..." Impossible is a very strong word in this context. Let me take the opportunity to remind everyone that an iPhone is a very complicated device running nearly 100% closed source hardware and software, include all sorts of opaque cryptographic hardware and a known-to-be-compromised secondary baseband computer, such that the security of the device's entire stack, top-to-bottom, could not possibly be verified by a third party in principle, let alone in practice. In light of that fact, security claims by Apple could be regarded as changing (reducing?) the probability of the law getting your data by technical means or collusion with Cupertino, but certainly not as insuring that the probability = 0. Edit: This is not an indictment of Apple per se, since the same is true of literally every smartphone ever constructed, but at least e.g. Blackberry isn't out there claiming that they're unable to compromise your data, full stop.

BWStearns 11y ago
I wasn't trying to imply that Apple has forged a perfectly secure complex system, but rather that they have (likely) legally and practically prevented themselves from being compelled to betray their users. While forcing Apple to hand over a password they have stored in plaintext is quite definitely in the legal realm of accepted behavior, I don't think a judge could reasonably order Apple to devote engineering time towards defeating their own security system in order to make the prosecution's job easier, especially when it is not actually assured that the effort would be a success and any success would preclude the same work from being used in subsequent prosecutions. I was merely skipping the caveats (back doors, implementation error, leaky behavior, etc) and giving benefit of the doubt with regards to honesty of intentions.
- ckcheng 11y ago
  I think "legally and practically prevented" is key here. Not sure if anyone noticed but this article is like a continuation of the story from days ago [1] when the judge in the case "questioned the government’s authority to compel Apple to unlock a seized mobile device using the All Writs Act" [2] and "called on Apple to weigh in about whether it is even capable of bypassing the lock screen in this case" [2]. Guess Apple has weighed in now as to its technical feasibility. Now it's up to the judge to decide whether it is an unreasonable burden on Apple, and whether it violates the Constitution, as to whether to compel Apple to help in the Justice Department's investigation. In this one single case, the iPhone has an older iOS, so maybe it's not an "unreasonable burden". But if it was iOS 8 or later, it might be deemed an unreasonable burden to compel Apple to brute force or otherwise crack the password, even if it was somehow technically possible. And "forcing Apple to push backdoored updates would constitute 'compelled speech' in violation of the First Amendment" [2]. So it does look as if Apple thought it through, and made iOS 8 so that they legally and practically cannot "betray their customers' trust" as you say. [1] https://news.ycombinator.com/item?id=10383253 https://news.ycombinator.com/item?id=10383253 [2] https://www.eff.org/deeplinks/2015/10/judge-doj-not-all-writs https://www.eff.org/deeplinks/2015/10/judge-doj-not-all-writ...