3 ms·

>> "...technically impossible for them to betray their customers' trust..." Impossible is a very strong word in this context. Let me take the opportunity to re

by avn2109 11y ago

>> "...technically impossible for them to betray their customers' trust..." Impossible is a very strong word in this context. Let me take the opportunity to remind everyone that an iPhone is a very complicated device running nearly 100% closed source hardware and software, include all sorts of opaque cryptographic hardware and a known-to-be-compromised secondary baseband computer, such that the security of the device's entire stack, top-to-bottom, could not possibly be verified by a third party in principle, let alone in practice. In light of that fact, security claims by Apple could be regarded as changing (reducing?) the probability of the law getting your data by technical means or collusion with Cupertino, but certainly not as insuring that the probability = 0. Edit: This is not an indictment of Apple per se, since the same is true of literally every smartphone ever constructed, but at least e.g. Blackberry isn't out there claiming that they're unable to compromise your data, full stop.

BWStearns 11y ago
I wasn't trying to imply that Apple has forged a perfectly secure complex system, but rather that they have (likely) legally and practically prevented themselves from being compelled to betray their users. While forcing Apple to hand over a password they have stored in plaintext is quite definitely in the legal realm of accepted behavior, I don't think a judge could reasonably order Apple to devote engineering time towards defeating their own security system in order to make the prosecution's job easier, especially when it is not actually assured that the effort would be a success and any success would preclude the same work from being used in subsequent prosecutions. I was merely skipping the caveats (back doors, implementation error, leaky behavior, etc) and giving benefit of the doubt with regards to honesty of intentions.
- ckcheng 11y ago
  I think "legally and practically prevented" is key here. Not sure if anyone noticed but this article is like a continuation of the story from days ago [1] when the judge in the case "questioned the government’s authority to compel Apple to unlock a seized mobile device using the All Writs Act" [2] and "called on Apple to weigh in about whether it is even capable of bypassing the lock screen in this case" [2]. Guess Apple has weighed in now as to its technical feasibility. Now it's up to the judge to decide whether it is an unreasonable burden on Apple, and whether it violates the Constitution, as to whether to compel Apple to help in the Justice Department's investigation. In this one single case, the iPhone has an older iOS, so maybe it's not an "unreasonable burden". But if it was iOS 8 or later, it might be deemed an unreasonable burden to compel Apple to brute force or otherwise crack the password, even if it was somehow technically possible. And "forcing Apple to push backdoored updates would constitute 'compelled speech' in violation of the First Amendment" [2]. So it does look as if Apple thought it through, and made iOS 8 so that they legally and practically cannot "betray their customers' trust" as you say. [1] https://news.ycombinator.com/item?id=10383253 https://news.ycombinator.com/item?id=10383253 [2] https://www.eff.org/deeplinks/2015/10/judge-doj-not-all-writs https://www.eff.org/deeplinks/2015/10/judge-doj-not-all-writ...
Arnt 11y ago
Apple says "we have no ability to" etc, not "noone has and we never will have" etc. An Apple officer making a sworn statement that Apple has no technical ability to extract data from an uncooperative customer's phone is significant, even if it applies only to the present, not to the past or future.

by avn2109 11y ago

BWStearns 11y ago

I wasn't trying to imply that Apple has forged a perfectly secure complex system, but rather that they have (likely) legally and practically prevented themselves from being compelled to betray their users. While forcing Apple to hand over a password they have stored in plaintext is quite definitely in the legal realm of accepted behavior, I don't think a judge could reasonably order Apple to devote engineering time towards defeating their own security system in order to make the prosecution's job easier, especially when it is not actually assured that the effort would be a success and any success would preclude the same work from being used in subsequent prosecutions. I was merely skipping the caveats (back doors, implementation error, leaky behavior, etc) and giving benefit of the doubt with regards to honesty of intentions.

ckcheng 11y ago
I think "legally and practically prevented" is key here. Not sure if anyone noticed but this article is like a continuation of the story from days ago [1] when the judge in the case "questioned the government’s authority to compel Apple to unlock a seized mobile device using the All Writs Act" [2] and "called on Apple to weigh in about whether it is even capable of bypassing the lock screen in this case" [2]. Guess Apple has weighed in now as to its technical feasibility. Now it's up to the judge to decide whether it is an unreasonable burden on Apple, and whether it violates the Constitution, as to whether to compel Apple to help in the Justice Department's investigation. In this one single case, the iPhone has an older iOS, so maybe it's not an "unreasonable burden". But if it was iOS 8 or later, it might be deemed an unreasonable burden to compel Apple to brute force or otherwise crack the password, even if it was somehow technically possible. And "forcing Apple to push backdoored updates would constitute 'compelled speech' in violation of the First Amendment" [2]. So it does look as if Apple thought it through, and made iOS 8 so that they legally and practically cannot "betray their customers' trust" as you say. [1] https://news.ycombinator.com/item?id=10383253 https://news.ycombinator.com/item?id=10383253 [2] https://www.eff.org/deeplinks/2015/10/judge-doj-not-all-writs https://www.eff.org/deeplinks/2015/10/judge-doj-not-all-writ...

Arnt 11y ago

Apple says "we have no ability to" etc, not "noone has and we never will have" etc. An Apple officer making a sworn statement that Apple has no technical ability to extract data from an uncooperative customer's phone is significant, even if it applies only to the present, not to the past or future.