4 ms·
Plenty of good if you have a reasonable passphrase and the vendor hasn't been compelled to assist. "Can only try 10 times" isn't anything guaranteed by encrypt
by danielweber 11y ago
Plenty of good if you have a reasonable passphrase and the vendor hasn't been compelled to assist.
"Can only try 10 times" isn't anything guaranteed by encryption. My laptop has an encrypted partition, but an attacker can brute-force it at will. Even if I had software to say "only let it happen 10 times, then erase the partition" the whole drive could just be cloned. That's why I have a 20+ character passphrase.
- tptacek 11y agoApple goes way out of their way to avoid scenarios where they can be compelled to subvert iOS security. For instance, see pg44+ of the iOS security white paper: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf ... the HSMs that manage the escrow scheme for credentials stored in iCloud are themselves rigged to blow up on 10 failed tries, and, not only that, but the code that implements that process is burned into the HSMs and the keys Apple would need to change that logic have been destroyed.
- danielweber 11y agoInformative. Thanks!
- niij 11y agoThank you for the link. I was unaware how seriously Apple takes their security. Self-destructing HSMs to avoid brute-forcing is extremely impressive. THIS is a model of how to implement proper key escrow.
- rburhum 11y agoI understand how encryption works :) I was talking specifically about this scenario where the phone pin may be 4 or 6 numbers and Apple is helping them.