5 ms·

Unfortunately, there's no good outcome here. If Apple can unencrypt the phone, it will prove to everyone that backdoors exist. If they can't, and they tell the

Unfortunately, there's no good outcome here. If Apple can unencrypt the phone, it will prove to everyone that backdoors exist. If they can't, and they tell the FBI as much, it will just give politicians more reasons sound off about how we have to have backdoors, because this shooter was a "terrorist" after all, and we just have to suck it up and do whatever is necessary to go after people like that. Either way, we end up with backdoors.

tannhauser23 11y ago
Did you read the article? The court didn't order Apple to decrypt the phone. Instead, Apple has to disable the phone's feature that automatically wipes the hard drive after 10 failed password attempts. This is so that the FBI can brute-force its way into the data.
- whatwhatwhat999 11y ago
  Yes, and that's effectively the same thing. Bypassing controls counts as a "backdoor".
  - BinaryIdiot 11y ago
    Brute forcing a password could take more time, with today's technology, than we have left on Earth depending on complexity and if there are known vulnerabilities. I'm not sure I would effectively consider this order an order to "unencrypt".
    - kondro 11y ago
      Passcodes are only 4 or 6 digits.
      - gambiting 11y ago
        The encryption key is calculated from your passcode + the AES key etched into the chip inside the phone. There's no way to read that key directly, unless you do some crazy chip imaging where you read the actual electron state of the memory - could be done, but the chance of corrupting that memory is very high, and if they read even one bit wrong then the entire key is useless. So there are two ways to go about this - they can either brute force AES, which, quite simply, can't be done(and I don't mean can't be done with current computers, the number of possible combinations is larger than the atoms in the universe or something stupid like that), unless NSA has a way to crack AES faster(but if they do, they won't make that knowledge public). Or try every passcode combination going through the Apple's full algorithm, which takes about ~5 seconds to generate a key. So it's doable, but it would take some time.
        kondro 11y ago
        5C doesn't have dedicated HSM.
      - Laforet 11y ago
        After a few attempts the OS would rate-limit guesses to prevent exactly that. On some iOS versions it is possible to override this mechanism by cutting power at the right moment[1] but this exploit has been patched for a while and I doubt this device is vulnerable. [1] http://observer.com/2015/03/watch-this-little-machine-brute-force-its-way-through-an-iphone-lock-screen/ http://observer.com/2015/03/watch-this-little-machine-brute-...
        technofiend 11y ago
        Hence this part of the order (3) it will ensure that when the FBI submits passcodes to the SUBJECT DEVICE, software running on the device will not purposefully introduce any additional delay between passcode attempts beyond what is incurred by Apple hardware.
      - BinaryIdiot 11y ago
        Maybe? Do we even know what type of passcode they used? If they turned off simple passcode then they could have entered anything they wanted at varying lengths.
- anonydsfsfs 11y ago
  This could be example of parallel construction[1]. They may already have unencrypted it via a backdoor, but they wouldn't be able to use anything they find as evidence in court because they'd have to reveal the backdoor. If they can plausibly show they brute-forced it instead, they keep the backdoor hidden. [1] https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction
  - wyldfire 11y ago
    Ok, but IMO this is a much lesser evil than (1) compulsory lawful-override of encryption/back door or (2) legislation to exclude devices which don't provide back doors. Ultimately states will develop the capacity for brute forcing and you have relatively little recourse. While I hate the idea of a three letter agency doing this at any scale large or small, the potential for corrupt local LEOs to abuse their power with an encryption backdoor is very great.
  - Godel_unicode 11y ago
    "it could be parallel construction" is true in literally every instance since it's impossible to prove the negative case. This is becoming my cue to stop reading the comments; when parallel construction is the most obvious argument, you've read the interesting ideas up thread.
    - kevin_b_er 11y ago
      However, the US Government is known to have gathered hidden evidence in drug cases, then used parallel construction to hide the violation. So, now the government's presentation of evidence should always be considered in question. As it has shown dishonesty at the presentation and gathering of evidence and there's nothing that says they haven't changed their unethical ways, how can they be trusted to present evidence legally gathered? https://www.washingtonpost.com/news/the-switch/wp/2013/08/05/the-nsa-is-giving-your-phone-records-to-the-dea-and-the-dea-is-covering-it-up/ https://www.washingtonpost.com/news/the-switch/wp/2013/08/05...

tannhauser23 11y ago

Did you read the article? The court didn't order Apple to decrypt the phone. Instead, Apple has to disable the phone's feature that automatically wipes the hard drive after 10 failed password attempts. This is so that the FBI can brute-force its way into the data.

whatwhatwhat999 11y ago
Yes, and that's effectively the same thing. Bypassing controls counts as a "backdoor".
- BinaryIdiot 11y ago
  Brute forcing a password could take more time, with today's technology, than we have left on Earth depending on complexity and if there are known vulnerabilities. I'm not sure I would effectively consider this order an order to "unencrypt".
  - kondro 11y ago
    Passcodes are only 4 or 6 digits.
    - gambiting 11y ago
      The encryption key is calculated from your passcode + the AES key etched into the chip inside the phone. There's no way to read that key directly, unless you do some crazy chip imaging where you read the actual electron state of the memory - could be done, but the chance of corrupting that memory is very high, and if they read even one bit wrong then the entire key is useless. So there are two ways to go about this - they can either brute force AES, which, quite simply, can't be done(and I don't mean can't be done with current computers, the number of possible combinations is larger than the atoms in the universe or something stupid like that), unless NSA has a way to crack AES faster(but if they do, they won't make that knowledge public). Or try every passcode combination going through the Apple's full algorithm, which takes about ~5 seconds to generate a key. So it's doable, but it would take some time.
      - kondro 11y ago
        5C doesn't have dedicated HSM.
    - Laforet 11y ago
      After a few attempts the OS would rate-limit guesses to prevent exactly that. On some iOS versions it is possible to override this mechanism by cutting power at the right moment[1] but this exploit has been patched for a while and I doubt this device is vulnerable. [1] http://observer.com/2015/03/watch-this-little-machine-brute-force-its-way-through-an-iphone-lock-screen/ http://observer.com/2015/03/watch-this-little-machine-brute-...
      - technofiend 11y ago
        Hence this part of the order (3) it will ensure that when the FBI submits passcodes to the SUBJECT DEVICE, software running on the device will not purposefully introduce any additional delay between passcode attempts beyond what is incurred by Apple hardware.
    - BinaryIdiot 11y ago
      Maybe? Do we even know what type of passcode they used? If they turned off simple passcode then they could have entered anything they wanted at varying lengths.
anonydsfsfs 11y ago
This could be example of parallel construction[1]. They may already have unencrypted it via a backdoor, but they wouldn't be able to use anything they find as evidence in court because they'd have to reveal the backdoor. If they can plausibly show they brute-forced it instead, they keep the backdoor hidden. [1] https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction
- wyldfire 11y ago
  Ok, but IMO this is a much lesser evil than (1) compulsory lawful-override of encryption/back door or (2) legislation to exclude devices which don't provide back doors. Ultimately states will develop the capacity for brute forcing and you have relatively little recourse. While I hate the idea of a three letter agency doing this at any scale large or small, the potential for corrupt local LEOs to abuse their power with an encryption backdoor is very great.
- Godel_unicode 11y ago
  "it could be parallel construction" is true in literally every instance since it's impossible to prove the negative case. This is becoming my cue to stop reading the comments; when parallel construction is the most obvious argument, you've read the interesting ideas up thread.
  - kevin_b_er 11y ago
    However, the US Government is known to have gathered hidden evidence in drug cases, then used parallel construction to hide the violation. So, now the government's presentation of evidence should always be considered in question. As it has shown dishonesty at the presentation and gathering of evidence and there's nothing that says they haven't changed their unethical ways, how can they be trusted to present evidence legally gathered? https://www.washingtonpost.com/news/the-switch/wp/2013/08/05/the-nsa-is-giving-your-phone-records-to-the-dea-and-the-dea-is-covering-it-up/ https://www.washingtonpost.com/news/the-switch/wp/2013/08/05...