86 ms·

A Message to Our Customers

• darthmaul 11y ago
  Apple stand is a bunch of BS. The main issue should be that the safety and protection of humanity. Terrorists are not humans they are bent on destroying humanity.
• darthmaul 11y ago
  seems that this forum is 'moderated'. Views that don't kiss the self proclaimed savior of freedom are deleted.
• darthmaul 11y ago
  Threat to humanity should trump all the garbage Apple and its lackeys are spewing out. Terrorists are not human.
• epaga 11y ago
  Huge props to Apple - here's hoping against hope that Google, Facebook, and Amazon get behind this. One thing I was wondering is how Apple is even able to create a backdoor. It is explained toward the end: "The government would have us remove security features and add new capabilities to the operating system, allowing a passcode to be input electronically. This would make it easier to unlock an iPhone by “brute force,” trying thousands or millions of combinations with the speed of a modern computer." This is actually quite reassuring - what this means is that even Apple can't break into an iPhone with a secure passphrase (10+ characters) and disabled Touch ID - which is hackable with a bit of effort to get your fingerprint.
  • Oletros 11y ago
    > Huge props to Apple - here's hoping against hope that Google, Facebook, and Amazon get behind this. Why against hope?
    • rincebrain 11y ago
      It's an idiom [1]. [1] - http://idioms.thefreedictionary.com/hope+against+hope http://idioms.thefreedictionary.com/hope+against+hope
      • Oletros 11y ago
        I know that it is an idiom, I asking why he has no hope
        • konradb 11y ago
          From the link that was posted in reply to you, 'hope against hope' means 'to have hope even when the situation appears to be hopeless'. Which means he does have hope, even though the situation appears to be hopeless.
          • Oletros 11y ago
            Yeees, I'm asking why he thinks there is little hope that they will stand
            • konradb 11y ago
              Sorry, misinterpreted you, in over-literal mind mode right now!
              • Oletros 11y ago
                No problem
          • div 11y ago
            I think Oletros understands that perfectly, but is wondering why OP feels that the situation appears to be hopeless.
          • jcrites 11y ago
            Why is the situation hopeless? Google, for example, has been undertaking efforts for years to improve security on the Internet, in part for the purpose of protecting privacy. Seven days ago they were featured in an article about how they're going to warn users of Gmail whose incoming emails are not protected by SSL: https://news.ycombinator.com/item?id=11067050 https://news.ycombinator.com/item?id=11067050 - this is part of their Safer Email initiative. Some time ago they released a Transparency Report as part of that initiative describing which senders to/from Gmail support encryption: https://www.google.com/transparencyreport/saferemail/ https://www.google.com/transparencyreport/saferemail/ - and that's not to mention their efforts promoting HTTPS. I see these efforts as Google going far out of its way to support privacy and security on the web.
  • deleted 11y ago
    [deleted]
  • rms_returns 11y ago
    With Google's Android, this issue will never arise because Android is open source. Any attempt to plant a backdoor will be outright monitored by the community.
    • firloop 11y ago
      Not too sure about this. Keep in mind that in most commercially sold Android phones, closed source, self updating, Google Play Services is installed by the manufacturer with system level privileges. That alone is enough to create a non insignificant back door.
      • rms_returns 11y ago
        But you can always root your phone and install Cyanogenmod from scratch, right? Agreed that this is not too trivial right now because of standardization issues, but it could be done if you really care about privacy.
        • cyphar 11y ago
          Not all of CyanogenMod is free software (you still have a bunch of binary blobs, and everyone has to use Google Play Services anyway because every app seems to implicitly require it). Replicant would be a much better alternative if it actually supported anything newer than 2G.
          • ionised 11y ago
            > and everyone has to use Google Play Services anyway This isn't true. You can stick to app repositories like F-Droid and use Raccoon to download Play Store apps via your desktop without using a Google account on your phone.
            • noarchy 11y ago
              It is true that you can get Play Store apps without a Google Account, but the Place Services framework does a lot more than this. Many apps rely upon the framework for certain pieces of functionality from Google's libraries.
  • legulere 11y ago
    Why wold Google and Facebook get behind this? They store their customers data in a way they can access and subsequently have to give it to persecuters when there's a court order
    • danieldk 11y ago
      If government agencies has unfettered access to data, it undermines the reputation of these companies. For instance, in Europe, many companies and organisations are likely even more hesitant to use Google's services since the Snowden leaks. This is a large loss of potential revenue. Google has been (even more) proactive about security and encryption since then, since part of their business model relies on trust.
    • Oletros 11y ago
      > Why wold Google and Facebook get behind this? They store their customers data in a way they can access and subsequently have to give it to persecuters when there's a court order Exactly like Apple. Or do you think that the emails in iCloud are not given to the prosecutors?
      • legulere 11y ago
        Yes exactly like apple. To quote the link: "When the FBI has requested data that’s in our possession, we have provided it." The point I was trying to make is that Google and Facebook have direct access to all the data of their customers, and already provide access to government agencies. Contrary to Apple they don't safely store some data of their costumers safely on the device, which this case is about.
        • Oletros 11y ago
          > The point I was trying to make is that Google and Facebook have direct access to all the data of their customers, and already provide access to government agencies. Contrary to Apple they don't safely store some data of their costumers safely on the device, which this case is about. Your point is wrong regarding Google and smartphones if the smartphone is encrypted
  • hosay123 11y ago
    What it sounds like is they've been asked to prepare a new OS release that allows an unlimited number of attempts to enter the passphrase via some network link. The press release is written to sound like without a software release, it wouldn't be possible to mount this kind of attack, however attacks like this are generally possible regardless of having some specially modified and signed OS image: for example, by cutting power to the hardware precisely when it is clear a password was incorrect, before the hardware has time to implement any destructive actions. Attacks like this have been used against SIM cards since the 90s. I'm ambivalent regarding Apple's stance. In principle they are doing the right thing, but in practice, it seems they may be kicking up a whole lot of fuss over a relatively minor issue (with the exception that providing an easy means to brute force a phone to the authorities sets a horrible precedent). As for creating a universal backdoor, it seems highly unlikely they couldn't produce a signed OS / coprocessor firmware image that wasn't locked to one of the various serial numbers associated with this particular device edit: as mentioned below, this order entirely originates with Apple's use of DRM to prevent software modification. Had users actual control over the devices they own the FBI wouldn't need to request a signed firmware in the first place. Please think twice about what Apple might really be defending here before downvoting
    • giovannibajo1 11y ago
      It used to be possible to do what you describe (cutting power at the right moment) and there were even physical bruteforce devices built to implement this but it's all been hardened in iOS 8 and there are no currently known ways to bruteforce a passcode. Obviously there might theoretically exist a software bug to do so, but there's no information around and it sounds even FBI couldn't find it if it exists
      • akavel 11y ago
        Could you elaborate on how's that prevented? I'm quite curious. [Or did someone already explain in some other post somewhere in this thread?] edit: self-answer: the following post seems to have an answer: https://news.ycombinator.com/item?id=11115579 https://news.ycombinator.com/item?id=11115579, although it seems to describe a newer device than the one in the case; but I was interested in how such protection is possible at all, so that seems to answer it for me.
  • ank_the_elder 11y ago
    Absolutely. I'm quite amazed they had the guts to go through with this and I applaud it. I will support them with my dollars as much as possible.
    • djkslgjeklas 11y ago
      Talk is cheap and these internet posts - from Tim Cooke, you, and me - are just talk. The security of this nation depends on Apple (and Google et. seq.) supporting us with its dollars as much as possible. And I'm not optimistic that the stockholders care about anything more than doing the opposite.
      • Umn44 11y ago
        You are correct... see this vid with Zbigniew Brzezinski, former United States National Security Advisor. https://www.youtube.com/watch?v=n7ZyJw_cHJY https://www.youtube.com/watch?v=n7ZyJw_cHJY Brezinski at a press conference https://www.youtube.com/watch?v=VWTIZBCQ79g https://www.youtube.com/watch?v=VWTIZBCQ79g Major powers, and imposing control over the awakened masses. https://youtu.be/4usbR_kKCDs?t=397 https://youtu.be/4usbR_kKCDs?t=397
      • tobylane 11y ago
        Some people already complain that the iPhone is too expensive, especially compared to non-equal Android phones. Not enough people complain about any company not fighting for their user's security. Talk is all we need so far. Publicly saying no to the FBI is a step rarely taken.
      • sjwright 11y ago
        Talk is not cheap when you have to back up such talk with a substantial legal defence. And any stockholder with an ounce of intelligence will understand that Apple's choices here are both morally right and effective marketing. As the information age matures, privacy is becoming a valuable asset, and Apple is starting to gain a positive reputation in this space.
        • 11y ago
  • bambax 11y ago
    I don't see how this "reassuring"; to me it's rather very confusing (as mentioned in many other comments). If Apple could in fact write a software backdoor, doesn't it mean that the backdoor exists, at least potentially? And how can one be sure that Apple is the only company able to build that door? At the very least, couldn't the right Apple engineer be either bribed or forced (by terrorists or the government) to build it? "Impossible" should mean "impossible", not "not yet done, but possible".
    • elmigranto 11y ago
      Not possible without backing it into iOS with some update that FBI is claiming will be used on one particular phone in this particular case. Apple reasons that there is no way to guarantee no one will take the same update and apply it to other iOS devices. Or government taking this a step further by making Apple to build that into future update for the whole user base.
    • epaga 11y ago
      What it means is that the best the FBI can come up with is "Make a way for us to brute force attack the passphrase." And brute force attack is worthless for a strong enough passphrase. That's what is reassuring. Not to mention that this is for the iPhone 5c. As other comments have mentioned, newer iPhones have the hardware-based Secure Enclave which add to the difficulty of breaking into the phone. https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
      • fnordfnordfnord 11y ago
        It could also be that the FBI has already obtained the info, or can obtain the info through illegal means and simply want to use the issue to force legislative and policy changes or public opinion changes in their favor, and or just want to legitimize their having the information.
      • andreyvit 11y ago
        My reading of that PDF is that Secure Enclave software can be updated too, it simply does an independent verification of the Apple's digital signature. So while the Secure Enclave enforces the delay between brute force attempts, Apple could still release an update that removes that delay.
  • threatofrain 11y ago
    I'm afraid I'm too skeptical to get the same assurances as you. Apple accuses the FBI of playing language games with the term "backdoor", but I think Apple has done the same. The fact that they can push weak OS updates to a locked phone is the backdoor. This means that they can already comply with the court order, and they likely will. This letter covers them from PR damage.
    • hardlianotion 11y ago
      This is not apparent from the article. Where could I find out about this ability?
      • forgotpwtomain 11y ago
        If such an ability doesn't exist than how does this potential threat follow? (article) > But that’s simply not true. Once created, the technique could be used over and over again, on any number of devices. I am also missing a key part of the technical details involved in this this situation.
    • em3rgent0rdr 11y ago
      Freedom from forced update is one of Stallman's motivations for free software. Just one terrorist attack + PR letter to customer + forced update away from loosing encryption on your phone.
      • kec 11y ago
        On the other hand, if iOS were open source / the iPhone was able to run unsigned code there would be nothing stopping the FBI from just doing what they've asked apple to do themselves (assuming it's actually technically possible).
        • deleted 11y ago
          [deleted]
        • cmurf 11y ago
  • jkn 11y ago
    Does Apple do an amazing job protecting their users' privacy? Yes! But frankly in this case I find the FBI makes more sense than Apple. Apple says: All that information needs to be protected from hackers and criminals who want to access it, steal it, and use it without our knowledge or permission As I understand, Apple complains about the introduction of this new threat model: 1. criminal steals someone's iPhone, 2. gets hold of a special iOS version that Apple keeps internally to assist the government, 3. pushes the OS update to the iPhone by themselves, 4. uses some tool to automate brute-forcing the user passcode At least that's what I get from these excerpts: Specifically, the FBI wants us to make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation. The government would have us remove security features and add new capabilities to the operating system, allowing a passcode to be input electronically. This would make it easier to unlock an iPhone by “brute force,” trying thousands or millions of combinations with the speed of a modern computer. Now how serious is this threat? And how useful is it to have the FBI be able to look into a phone when they have a warrant? Does the balance between the right to privacy and the need to assist criminal investigation really tilt towards privacy in this specific case? Meanwhile there are serious threats that do affect a lot of users in practice, where Apple does a good job but could do better still such as: - Remote code execution on iOS (6 vulnerabilities in 2016 so far[1]) - Phishing, brute force and social engineering attacks (the improved two-factor authentication is not yet available to everyone[2]) Am I wrong in thinking that users are way more likely to be affected by these threats except when the government has a warrant? If Apple is actually worried about the FBI getting access to the modified iOS version, they should focus their complaint on that and propose to do the whole data extraction in-house. [1] http://www.cvedetails.com/vulnerability-list/vendor_id-49/product_id-15556/year-2016/opec-1/Apple-Iphone-Os.html http://www.cvedetails.com/vulnerability-list/vendor_id-49/pr... [2] https://support.apple.com/en-us/HT204915 https://support.apple.com/en-us/HT204915
    • datashovel 11y ago
      I think the question is less about whether or not a "correct / valid use" of this new technology is acceptable. The problem is that it's impossible (once it exists) to guarantee it won't be used in malicious ways.
  • tosseraccount 11y ago
    Let's get behind Google, Facebook and Amazon to protect our privacy?
    • justin_oaks 11y ago
      Let's get behind Google, Facebook, and Amazon in their desire to not to hand over our data to the government. Even with as much data as each of them has, it's still better that the data isn't given to yet another party (the government, or each other).
      • tosseraccount 11y ago
        Is it "our" data? Or is it their data? You don't think they share this with their business partners?
  • SoMuchToGrok 11y ago
    Like you, I appreciate the sentiment - happy to hear Apple speaking up. However this shouldn't change how we use Apple products. I operate under the implication that the device is compromised from the factory. Closed source software cannot be trusted, good faith is not enough.
    • fixermark 11y ago
      I can't disagree with your point of view; I merely point out that a world where everyone who wants a secure smartphone needs to own their own smartphone factory isn't a very practical world.
      • em3rgent0rdr 11y ago
        Only needs to have access to software source code, and presumably a way to verify the binaries match. Not an entire factory.
        • HappyTypist 11y ago
          They also need to verify the hardware does what it's supposed to do, and the CPU doesn't have secret opcodes.
    • ufmace 11y ago
      Considering how many massive, gaping security flaws have been found in Open Source software in the last year or so alone that have been in place for years or decades, I think we can say that open source software cannot be trusted either.
      • SoMuchToGrok 11y ago
        Open source software can be trusted as much as we can trust ourselves - and that's as good as trust gets. I'll take that any day over trusting one party with a vested interest in making money.
  • tossaway1 11y ago
    What do you want thone other companies to get behind? They don't manufacture phones like Apple does, right...? Note that this letter says: "When the FBI has requested data that’s in our possession, we have provided it." Seels like that detail is getting very little attention in this announcement. Really? If the FYI requests any data, they hand it over...?
    • creshal 11y ago
      Goole makes Android; Amazon makes FireOS. No idea what't the deal with Facebook is. > Really? If the FYI requests any data, they hand it over...? They have to, there's no legal wiggle room here. Creating backdoors OTOH seems to be sufficiently legally questionable that Apple can risk noncompliance. (Of course, Apple could not accumulate all that data in the first place, but that would be silly, obviously. Now please sync your wifi passwords to iCloud.)
    • dr_zoidberg 11y ago
      Would you complain about Apple handing in information to solve the murder of a loved one? Why is it always the "bad government" argument? It's not that it doesn't happen, but usually those requests are aimed towards more "mundane" cases. For example, I have friends who work in law (though not in the US), and the number 1 data request -which is revised by a judge, and only then given by companies- are call logs from telephones (just from/to, date, time, duration, nothing fancy). And this are extremely helpful and information rich, if you know how to use them.
      • fixermark 11y ago
        Utilitarian philosophy argument. The benefit gained by solving one murdered loved-one case is badly offset by the loss accrued to everyone by no longer having the security protections they expected. This specific case, in fact, is pretty close to "murder of a loved one;" the phone's owner killed people, and the FBI wants to find out if they were part of a bigger plot.
      • tossaway1 11y ago
        I'm all for supporting law enforcement efforts, but the wording seemed to imply that Apple hands over any requested info to the FBI, which seems excessive. But I was mainly pointing out that quote because it wasn't clear what lesson the parent commenter wanted Google, Facebook, and Amazon to be learning from Apple. I would have guessed it'd have something to do with protection of user data, but the letter says they turn over any user data they have!
  • ChrisArgyle 11y ago
    Isn't it odd that this press release spends so much time discussing encryption? Neither the FBI nor Apple will be touching any encryption functions of the device. It seems the primary aim of this statement is to prevent rumors that would spook Apple users into thinking their data is fair game
  • ryanackley 11y ago
    The government wants Apple to disable the auto-erase after so many unlock attempts. Apple argues in this letter that with modern computing power, this amounts to a backdoor. The details of the gov't request are in another story on the HN front page https://www.techdirt.com/articles/20160216/17393733617/no-judge-did-not-just-order-apple-to-break-encryption-san-bernardino-shooters-iphone-to-create-new-backdoor.shtml https://www.techdirt.com/articles/20160216/17393733617/no-ju...
    • deleted 11y ago
      [deleted]
    • jandrese 11y ago
      The encryption key used on the root filesystem is too hard to brute force. It's not based on some crappy password that a human created, it's some hash value stored in the hardware. In a scenario like that it is easy to create a key that would require all of the computers working till the heat death of the universe to crack.
      • sre_ops 11y ago
        This phone does not have SE. It is purely software and Apple can defeat it easily. This is the exact attack vector that was addressed by Apple in the phones with SE.
      • dkonofalski 11y ago
        They're not trying to brute-force the encryption key. They're attempting to brute-force the PIN lock on the phone. Currently they can't because the settings on the phone cause a timeout after each unsuccessful login, the phone wipes after 10 failed attempts, and the PIN cannot be accepted from anywhere except the device display. These are the security functions that the FBI wants Apple to remove. They want to be able to hook up a computer via the lightning cable to brute-force the PIN and give them access to the phone's contents.
  • bobby_9x 11y ago
    Google worked with the NSA and Facebook not only worked with the NSA, but now has ties to China and the Chinese government (which have the most advanced spying and censoring Internet technology around). So, I'm doubtful.
  • ChuckMcM 11y ago
    ".. what this means is that even Apple can't break into an iPhone with a secure passphrase (10+ characters) and disabled Touch ID - which is hackable with a bit of effort to get your fingerprint." That is not exactly true. They wrote the OS, they designed the phone, they know where the JTAG connectors are. Cracking the phone apart and putting is logic board up on a debugger would likely enable them to bypass security. From what I understand Tim is doing, and I greatly admire, is trying to avoid a judicial requirement that they be able to do this on demand. The so called "back door" requirement, because he knows, as others do, that such a feature would be used by more than the intended audience, and for more than the intended uses, to the detriment of Apple's users. What I really find amazing is that I was at a talk hosted by the East-West Institute where the Air Force General of the new cyber command (whose name escapes me) complained that "we" (silicon valley) had let the government down by not writing strong enough crypto to keep our adversaries out. I remarked that it was the ITARS regulation and the Commerce department at the behest of the NSA which had tied our hands in that regard, and that with a free reign we would have, and could do, much better. Whit Diffie was there and also made the same point with them. And now, here we are 10 years later, and we "fixed" it, and now its our fault that they can't break into this stuff? Guess what? Our adversaries can't either! The right to privacy, and the right of companies to secure that right with technology for their customers, is a very important topic and deserves the attention. I am really glad that one of the most valuable companies in the world is drawing a bright line in the sand. So I really support Tim's position on this one.
    • jessedhillon 11y ago
      > That is not exactly true. They wrote the OS, they designed the phone, they know where the JTAG connectors are. Cracking the phone apart and putting is logic board up on a debugger would likely enable them to bypass security. Is this true? That would have to mean that either the passphrase is stored on the device or that the data is not encrypted at rest. Neither of these sound likely, frankly
      • shdon 11y ago
        It doesn't have to mean any of that. As long as the 10 mistakes limit is enforced in software or in a separate chip that can be replaced without replacing the actual encryption key, it can be bypassed. Then it is a simple matter of simply brute-forcing the pin code. Since these are usually 4 digits, there's only 10000 possibilities, which is laughable to a brute force attacked.
  • FIX_IT 11y ago
    When I forgot the password for my iPhone I tried untill it said "connect to ITunes" when I connected to iTunes nothing happened so I clicked restore realised I had not backed up my iPhone so I clicked backup hoping that it would backup but it said that I needed to sign in this then relied the boundary of not letting me type the password in or holding me back. So I have created a program that repeatedly does that. (There are no need for fancy backdoors)
  • bdrool 11y ago
    > here's hoping against hope that Google, Facebook, and Amazon get behind this I would assume that Google, Facebook, and Amazon are already sending every single keystroke we type straight to all the three letter agencies pretty much in real time. (I also assume the same about Apple, so I'm not sure what to make of this open letter.)
    • deleted 11y ago
      [deleted]
  • beloch 11y ago
    Important to remember: Anyone who has your phone also has an object covered in your finger prints. Don't rely on Touch ID for actual security.
    • r00fus 11y ago
      Important to remember: All iPhones since the 3GS have oleophobic surface coating (which combined with cloth pockets means the screen stays relatively clean). Also important to remember, fingerprints on a random surface are VERY hard to copy onto latex milk or PCB substrate. Please continue to think
  • hobarrera 11y ago
    > Huge props to Apple They may be doing it for people right to privacy, but don't forget they might also be doing this because their image would become tainted irrevocably if they complied with this. Trust in Apple devices would be shattered (across those who currently trust Apple).
  • adam12 11y ago
    What puzzles me is why the government didn't impose a gag order like they sometimes do in cases like this.
    • sjwright 11y ago
      Because a gag order would have to be absolutely legally watertight, which is likely impossible in this case.
  • skewart 11y ago
    "...and disabled Touch ID - which is hackable with a bit of effort to get your fingerprint." As long as we're on the topic of encryption, phones, and law enforcement it's worth keeping in mind that in the US at least courts can compel you to unlock your phone with Touch ID, even though they can't compel you to give them a password. Communicating a password is considered speech, so self-incriminating speech is protected by the fifth amendment. Physically holding your finger to a device is not considered speech and so it's not protected. I think this is an interesting, and perhaps underappreciated, aspect of a shift from passwords to biometrics for verifying identity. It would shift the power dynamic between civilians and government a bit - here in the US at least. Of course, hopefully no one is in a situation where they need to protect themselves against over-reaching or unjust government officials any time soon. http://www.engadget.com/2014/10/31/court-rules-touch-id-is-not-protected-by-the-fifth-amendment-bu/ http://www.engadget.com/2014/10/31/court-rules-touch-id-is-n...
    • spanktar 11y ago
      When entering any questionable law enforcement situation (TSA, walking near a protest, traveling internationally) I always switch my phone to not use TouchID. Say what you will.
  • grillvogel 11y ago
    it's probably pretty safe to assume google did the opposite
  • lwhalen 11y ago
    What this says to me is that the current iPhone encryption is able to be broken by Apple. Note: "[the FBI is asking us to] make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation." I interpret that as there is already a backdoor, but one that is controlled by Apple. If that is the case, the gov't is asking for dual control of that pre-existing backdoor in addition to Apple. If I encrypt a message with a public key, and Phil Zimmerman can decrypt it (in addition to the holder of the private half of that public key), then there's a backdoor in PGP, regardless of who owns/knows about it. The only secure system is one where the data is well and truly unrecoverable if the private key is gone, missing, or unavailable/unwilling to be applied by the owner.
• chillaxtian 11y ago
  if you are interested in the technical details of iOS security: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
• planetjones 11y ago
  With the due legal process the police can search property, safety deposit boxes, bank accounts, vehicles, etc. etc. Why should a smartphone be any different just because Apple says it is ? As much as I value privacy I really don't agree with Apple's stance here - if due legal process has been followed, why shouldn't they be able to read the contents of an iPhone ? And yes I get that third party encryption can be used, which isn't owned by Apple and that there's little the authorities could do about it - but that's not the case at hand here.
  • easytiger 11y ago
    > Why should a smartphone be any different just because Apple says it is ? Because it is possible to create a smartphone that is impossible to break into. The others it is impossible to create one that is impossible to break
  • sanatgersappa 11y ago
    "the police can search property, safety deposit boxes, bank accounts, vehicles, etc." - that they can, doesn't mean it is right. If you read the entire letter, you'll see that creating the backdoor means tomorrow the Chinese government can see the nude pics on your phone (with 'due legal process', of course).
  • GuiA 11y ago
    This is not the government asking to search a single vehicle or safebox, to take your examples. This is the government asking that every safebox or vehicle in the world be made instantly unlockable by design.
    • wildmXranat 11y ago
      Exactly. I think OP is a bit fast and loose on the definition of area of interest. It's not that it's bad if it's this case. It's that is bad if it applies as a built-in backdoor for whenever they feel like using it.
    • deleted 11y ago
      [deleted]
• jasonlingx 11y ago
  The fact that they can create this backdoor, doesn't that mean it already exists? What Apple needs to do then instead of writing this letter, is release an update that closes this backdoor.
  • SideburnsOfDoom 11y ago
    > The fact that they can create this backdoor, doesn't that mean it already exists? Quite likely. As I posted on the other discussion here: https://news.ycombinator.com/item?id=11116343 https://news.ycombinator.com/item?id=11116343 > If it's possible to make such a "backdoored" build of iOS, then there are state actors who will be throwing $Millions at doing it already, with or without any willing help from Apple.
    • danieldk 11y ago
      The security here is Apple's signing key that is used to sign updates. If you believe RSA is safe (which I assume is being used) and the key has a reasonable length, throwing a couple of millions at it won't bring you much. I guess what the FBI wants is a backdoored iOS version and to have Apple sign it with their signing key (which means that the FBI can use it over and over again).
      • SideburnsOfDoom 11y ago
        That is hard, we know. But it is not impossible for those with time, resources and willingness to think outside the box. For instance, signing keys can and have been stolen, on the principle of "if you can't brute-force it, hack in and take it". http://arstechnica.com/security/2013/02/cooks-steal-security-firms-crypto-key-use-it-to-sign-malware/ http://arstechnica.com/security/2013/02/cooks-steal-security... http://blogs.adobe.com/security/2012/09/inappropriate-use-of-adobe-code-signing-certificate.html http://blogs.adobe.com/security/2012/09/inappropriate-use-of... http://www.androidauthority.com/ssl-added-removed-google-mocks-nsa-crypto-code-easter-egg-390162/ http://www.androidauthority.com/ssl-added-removed-google-moc... http://arstechnica.co.uk/tech-policy/2016/02/its-legal-for-gchq-to-break-into-computers-and-install-spyware-tribunal-rules/ http://arstechnica.co.uk/tech-policy/2016/02/its-legal-for-g...
• deleted 11y ago
  [deleted]
• wildmXranat 11y ago
  Not getting an iPhone, even secured - Check! I bet hardware vendors are just salivating at the concept of having to produce thousands of iPhone cracking docking stations.
• marak830 11y ago
  Im generally not an apple supporter(i dont like the closed eco system), i am very plesantly surprised they posted this. I am quite disappointed that the us courts are trying to force apple todo this, and in my opinion, its just to use this case to set a precedent. I hope Apple cant get it to work, but id hate to see what the courts would do if that happened.
  • lazaroclapp 11y ago
    There are basically two groups of large software companies around right now: those which make their business by collecting data, and those which make their business by licensing software[1]. The first group has an overwhelming incentive to not support privacy too strongly. The second group has an overwhelming incentive to not allow too much openness. Until a better business model (or zero-knowledge machine learning) is found, no large for profit company can support both goals to their final conclusion[2]. So we are left choosing one evil or the other[3]. [1] Sure, Apple only really sells hardware directly, but the software is a significant part of the reason a lot of people by Apple hardware (e.g. 'Mac's don't get viruses', 'iPhones have a better user experience'). [2] Sure, Google has some significant internal efforts for supporting better user privacy (e.g. https://googleonlinesecurity.blogspot.com/2014/12/an-update-to-end-to-end.html https://googleonlinesecurity.blogspot.com/2014/12/an-update-... ) and Apple maintains some superb open-source software (e.g. http://llvm.org/ http://llvm.org/ ). But in the end, Google can't be a "privacy company" without hurting their business model and Apple can't be an "open source company" for the same reason. [3] Or the non-trivial inconvenience of being a self-hosting free software purist
    • S4M 11y ago
      I can't upvote enough that excellent summary of the situation of software companies. One way to solve that would be to have governments support and subsidies open source software development, but I don't see that happening in the next 5 years at the very least.
      • lazaroclapp 11y ago
        So, it is far from a simple problem. For common infrastructure, one can argue governments could fund open source in the same way they fund highways and bridges and physical fiber optic links. But I am not so sure that model would be the best to innovate in end user applications, and I say so as someone working on publicly funded research software. There is something to be said about the market's ability to make decentralized decisions and focus on satisfying people wants[1], so a centralized software economy is also not a good solution. The problem with markets here is that strong privacy and open source are, for the most part, positive externalities. As a user, the benefit you get from having strong privacy yourself is not usually noticeably high, nor that of having access to the source, specially for a non-technical user, yet society arguably benefits from both. Usually the answer to a problem of unaccounted externalities is government regulation, but in this case, large-enough-to-matter governments have been unanimously on the side of less privacy, rather than more (as is the case of the original article). [1] Ideally, software should be designed so that it preserves privacy as much as possible while achieving its function, and is open source, and it provides all the million features and reasons people use something like Facebook, Snapchat, Youtube, etc. Just having privacy preserving software written for and by technophiles is not and can never be a complete solution.
• owenwil 11y ago
  I really hope they actually physically can't access the data on this phone. It's entirely possible this could be the case -- I've been trying to consider the vectors they could use: - lightning cable delivered iOS patch (probably won't work because iOS won't negotiate over USB until you tap a dialog box) - OTA update (not connected to internet) - Cracking open the device and accessing the storage directly (encrypted until boot time) The most likely vector I can think of: - - Lightning cable delivered iOS patch from a trusted computer (i.e one that the terrorists actually owned) It's quite impressive that Apple is taking a stand like this, though perhaps unfortunate timing WRT the larger encryption debate.
• firloop 11y ago
  Even though the matters are slightly different, I couldn't help but think that Cook is giving off a Boards of Canada vibe in this post (in a good way). "Now that the show is over, and we have jointly exercised our constitutional rights, we would like to leave you with one very important thought: Some time in the future, you may have the opportunity to serve as a juror in a censorship case or a so-called obscenity case. It would be wise to remember that the same people who would stop you from listening to Boards of Canada may be back next year to complain about a book, or even a TV program. If you can be told what you can see or read, then it follows that you can be told what to say or think. Defend your constitutionally protected rights - no one else will do it for you. Thank you." https://youtu.be/1-FI6D8ZXpc https://youtu.be/1-FI6D8ZXpc
• rms_returns 11y ago
  This is quite unlike Apple. Is this the same company that insists on keeping its source proprietary and is always against FOSS? The idea that you care for your users' privacy and still like to keep control on them by not giving them the freedom to modify source-code is not what I buy.
  • nindalf 11y ago
    You're talking nonsense. Protecting users' privacy and keeping source code closed aren't mutually exclusive.
    • rms_returns 11y ago
      Yeah. Loving your spouse and hiding things from them are also not mutually exclusive. Yet, you hardly find people that do both. Not to mention, this situation would never have arisen if iphone were open-sourced, since all activity would have been monitored by the community.
      • solomon_gumball 11y ago
        Just stop.
      • aeonflux 11y ago
        You have way too much faith into the the idea, that open source projects are free of backdoors / exploits and that the community can prevent creation of those. Aside from that, there is currently no platform, where 100% code is open source.
        • ageofwant 11y ago
          Of course we can't. But we are in a vastly better position to positivity affect these things if we do have the source. It is immaterial whether or not any platform is currently 100% open source. rms_returns is right in noting the discrepancy between noble apple sticking it to the man and walled garden apple sticking it to the user.
• dovdov 11y ago
  "We have no sympathy for terrorists." They felt the need to state that, huh?
  • nindalf 11y ago
    I was surprised that they felt it necessary but its pre-emptive counter to a pretty common argument - that smartphone makers are aiding and abetting terrorists by providing them encryption tools.
  • briandear 11y ago
    Well yes; look how this could play out on Main Street: "Apple supports terrorists by opposing Obama Admin's FBI investigation."
• Artemis2 11y ago
  Publicizing the case themselves in a very good move. However, the iPhone of the attacker is an iPhone 5C, which does not have Touch ID or a Secure Enclave. This means that the time between passcode unlock attempts is not enforced by the cryptographic coprocessor. More generally, there's no software integrity protection, and the encryption key is relatively weak (since it is only based on the user's passcode). The amount of work needed to turn security into good user experience is phenomenal: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
  • joeblau 11y ago
    You can still enable full disk wipe after 10 failed password attempts[1]. That was available in iOS 7 I believe (but someone on here will correct me if I'm wrong). [1] - http://i2.wp.com/ioshacker.com/wp-content/uploads/2014/09/Passcode-lock-erase-data.jpg http://i2.wp.com/ioshacker.com/wp-content/uploads/2014/09/Pa...
    • madeofpalk 11y ago
      It's been available for quite a while, long before iOS 7. It was at least available in iOS 5, probably available before that.
    • lern_too_spel 11y ago
      The FBI's point is that Apple can update the software on the device to not honor that setting, which means it is not effective against a government attacker.
  • heartbreak 11y ago
    And to think, just two weeks ago that same enforcement which prevents compromising the secure enclave was the target of vitriol right here on HN (Error 53).
• zobzu 11y ago
  What im reading is that apple can remote install an update that disable encryption. They dont want to do it. But that they have the capability is a bit scary.
  • briandear 11y ago
    Please read carefully. They don't have that capability. The FBI wants them to create it.
    • deleted 11y ago
      [deleted]
    • clort 11y ago
      if they can create it, they have the capability.
      • ThatPlayer 11y ago
        They never say they can create it. They say the FBI wants them to create it, which may or may not be possible and is not addressed in this letter.
        • zobzu 11y ago
          you've noticed auto updates yes?
  • burriko 11y ago
    You're not reading that, you're implying it. It doesn't say anything at all about remote installs, and it's not even suggested.
  • abritishguy 11y ago
    It doesn't say anything about remote install - in fact it says "physical possession" several times.
    • 11y ago
• teekert 11y ago
  Am I wrong to think that this brute forcing can still be applied when the raw memory chip is taken of the iPhone? The wipe-all-data-feature requires write access to the chip + some intelligence and monitoring. These capabilities should be physically removable from the actual memory chip, right?
  • chillaxtian 11y ago
    read section 'Hardware Security Features' here: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
    • teekert 11y ago
      Ok, so: "The UID allows data to be cryptographically tied to a particular device. For example, the key hierarchy protecting the file system includes the UID, so if the memory chips are physically moved from one device to another, the files are inaccessible. The UID is not related to any other identifier on the device." The secure enclave must still give it's UID under some circumstances? This still does not appear to be immune to hardware hacking. Moreover, this UID can also be brute forced imo, when the memory chip and secure enclave are physically separated. Whatever is needed to de-encrypt the data must be brute force-able, especially when the memory is separated from the wipe-all-data initiator which does not seem to be impossible if you know the chip design well enough?
      • chillaxtian 11y ago
        "The device’s unique ID (UID) and a device group ID (GID) are AES 256-bit keys fused (UID) or compiled (GID) into the application processor and Secure Enclave during manufacturing. No software or firmware can read them directly; they can see only the results of encryption or decryption operations performed by dedicated AES engines implemented in silicon using the UID or GID as a key." re: brute forcing. they are AES 256 bit keys. good luck.
      • teekert 11y ago
        Where is the reply button under your comment chillaxtian? Edit: hmm, now it suddenly appeared... How about disabling the wipe signal by cutting some interconnects in the silicon? Is the function by which the AES keys are calculated from the password really completely inaccessible?
• dcw303 11y ago
  Very impressive letter. They've expressed their position in language that a layman can understand, there's abundant evidence that they respect the intent of the law authorities, and even clearer evidence that they are drawing a line in the sand based on their principles. They will protect their customers. I wish more companies could speak so clearly and courageously.
  • wildmXranat 11y ago
    >They will protect their customers Where is this stated so that I can claim damages if they break said promise. I'm sorry, but how can it not be seen that it a really is bad sign that Apple has made this public. They may already have built the backdoor and this is a public stunt or no matter what you do, owning a smart is not that smart.
    • briandear 11y ago
      If you'd like to claim damages, you would have to prove damages.
    • zwarag 11y ago
      Love makes blind.
• unixhero 11y ago
  Plot twist. This is actually the result of a barter. The Gov gets to have some low level TOP-SECRET access in trade for this easy access code and that Apple gets to go public to keep the populace calm and pretend they are fighting this thing.
• eva1984 11y ago
  It makes sense for them. If they put a backdoor in iPhone for US government, they are effectively thrown out of Chinese market. Interesting enough, what will Apple do if Chinese government demand they to decrypt/put backdoor in exchange of staying in the market?
  • sberder 11y ago
    I was about to mention the Chinese case, the Chinese government asking foreign companies to install means of control and access in their products. Does that mean that apple will not provide such means or disable security for phones sold on the Chinese market? That would be surprising given the potential size of this market.
    • eva1984 11y ago
      They will probably produce some China-only version to please the government. A open letter like this, will instantly end their relationship with the government, they won't even attempt to do it.
      • squidlogic 11y ago
        I thought they already did this, but I have no proof. It seems reasonable because Google got evicted from China for not playing ball, so I find it hard to believe that Apple would get a free pass.
        • umanwizard 11y ago
          I don't know if they'll get a free pass or not, but Apple is a lot more popular among the Chinese youth/middle class/intelligentsia than Google. They may have a bit more sway.
• nindalf 11y ago
  I'm really impressed that Apple is standing up to the government and protecting its users' rights. I've never really considered the iPhone worth the premium price tag, but policies like this have changed my mind. Could someone answer a question I have though? The government wants Apple to create this backdoor and tailor it to the specific device, so presumably it will have a line that goes if (!deviceID.equals("san_b_device_id")) return; To make the backdoor general purpose, this line would need to be removed. But doing so would invalidate the signature and it can't be resigned afterwards because the attacker won't have Apple's signing key. So is the open letter a matter of principle that they won't build any backdoor, now or in the future, rather than a specific concern about this backdoor?
  • camillomiller 11y ago
    Technically you're right, legally think of the huge precedent. FBI is using the San Bernardino case as a legal crowbar, and it's awful.
    • BWStearns 11y ago
      If they beat the order they could always do what GP said, crack the password, and hand in a decrypted copy of the device. Everyone goes home happy: no precedent set, FBI gets their data, going into the future as old iOS devices die Apple won't even be able to pull that stunt again if they want to.
      • jonathankoren 11y ago
        But if they beat the order, and that they've made a big deal about going against the order, why would they go ahead and compromise the device's security? What would be the point? Just to tell the government, "Hey, don't worry about all that stuff we said, we didn't mean it?" If they do it once, they'll do it again.
        • BWStearns 11y ago
          1) They're not saying they don't want to help investigate the SB shooters, only that the order illegally expands the use of the All Writs Act and sets a bad precedent for democracy. 2) If they beat the order then the FBI needs to find a new way to compel Apple to help them do shit. That likely means the FBI needs federal legislation passed, which in the current climate will buy Apple considerable time. This is why they want to beat the order (though the feds could further appeal all the way to the.... wait for it.... 8 judge supreme court!) Though I think Scalia would have be on our side on this one). It's not about this particular case since there will be others, it's not about this particular order since there will eventually be legislation. 3) So why go ahead and do it anyways? Naive (but still valid) reason: they happen to be able to help and without it being ordered they can do it without handing over a tool for ad hoc decryption. They can even go to Hawaii after and throw the dev machines into a volcano to satisfy their inner hobbit (I highly recommend this part of the plan) to ensure that no one can abuse the power of the one ring. The non-naive answer is that for a quick project they get to show to the public that no, we the nerds are not so obsessed with abstract systems level thinking that we won't help when we can. It gets a lot harder for that moron Comey to hit the morning shows and throw shitty innuendo at the tech industry implying that we're aiding the terrorists. Both encryption and terrorism are complicated subjects that are scary to the average American and although they distrust the government, they also distrust Silicon Valley. The cryptowars aren't about being right or they'd have stayed dead in the 90s where they belong. Basically Apple makes tech look like the good guy fighting terrorism, and for anyone who cares (smaller audience than the fighting terrorism bit) they also defended your civil liberties. 4) This trick only works on older devices. They will die out soon anyways. Newer devices are safe anyways. If they beat the order and do this one case voluntarily then no precedent is set, so they can't be bullied into doing it and old devices are safe. One device compromised, all other devices safe, order beat, PR win, Comey looks like a prick even to the uninformed next time he insinuates that we're the enemy.
• deleted 11y ago
  [deleted]
• droithomme 11y ago
  Well they seem to be saying that the approach they describe, to make a modified OS, would actually work to circumvent encryption on a preexisting device. That means that they already know the device is not really actually secure. They aren't talking about putting a back door into systems to be used in the future, they are saying it's indeed feasible to place a backdoor on a device already out there and then use the backdoor to access the device. That means the device is not actually secure.
• mrmondo 11y ago
  Mods: can you please update title to add some context?
• mrb 11y ago
  Link to the FBI order: https://assets.documentcloud.org/documents/2714001/SB-Shooter-Order-Compelling-Apple-Asst-iPhone.pdf https://assets.documentcloud.org/documents/2714001/SB-Shoote... (Edit: deleted part where I was wrong. Thanks robbiet480 for correcting me. It's 2am here and I was tired.) Also, prediction: if Apple refuses to build a brute forcer, someone else will do it and sell it to the FBI. Just wait and watch.
  • wildmXranat 11y ago
    >Also, prediction: if Apple refuses to build a brute forcer, someone else will do it and sell it to the FBI. Just wait and watch. Just made a downvoted to death comment on this very same thing. This is literally a government creating a market situation.
  • mynameisvlad 11y ago
    Also disables the auto-lockout on entering the wrong PIN enough times, as well as the delays after the 3rd (IIRC) incorrect attempt.
  • robbiet480 11y ago
    iPhone brute force hardware already exists [1]. The issue is that when Touch ID and/or a passcode is enabled, the device locks itself for a few seconds-a few hours every time an incorrect pin is entered. So brute forcing would take an extremely long time. In addition, there is a setting on all iPhones to erase data after 10 failed pin code entry attempts. The FBI wants Apple to provide a custom iOS build that can be installed on the device that allows for remote (over the network) brute forcing with the increasing timeout/erase data protections totally disabled. 1. http://techcrunch.com/2015/03/19/iphone-bruteforce-pin/ http://techcrunch.com/2015/03/19/iphone-bruteforce-pin/
    • mrb 11y ago
      You are of course correct. I edited my comment.
    • interpol_p 11y ago
      But how can the custom iOS build be installed on the device while it is locked?
• mrmondo 11y ago
  Massive props to Apple, again I am impressed by their commitment to customer privacy.
• GreaterFool 11y ago
  This is interesting: "Specifically, the FBI wants us to make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation. In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession." Am I reading this right? Apple, if they chose to, can make a version of iOS that disables security features and encryption and load it onto existing phone even though the phone is locked and encrypted?
  • janaagaard 11y ago
    > Apple, if they chose to, can make a version of iOS that disables security features and encryption and load it onto existing phone even though the phone is locked and encrypted? As I understand it, the FBI wants Apple to create a version of iOS that would disable the current feature where the data is deleted after more than 10 failed passwords attempts. This would allow the FBI to brute force the password.
    • Cakez0r 11y ago
      That doesn't explain how they would get the update on to a locked and encrypted device, even if it existed.
      • mpdehaan2 11y ago
        It seems like it would be easy enough to crack it open and replace the OS boot data. That being said, I really WANT the data in this case. I hope Apple finds a compromise where they can help get this specific data without risking leaking a compromised OS.
        • aback 11y ago
          > I hope Apple finds a compromise where they can help get this specific data without risking leaking a compromised OS. I want pharmaceuticals without side effects, and real doughnuts that don't make you fat. Seriously, you are asking for "A" and "not-A" in one sentence. Take your pick. Are you willing to get this one phone unlocked so badly that you would be OK with nobody having security? Because that's what you're asking for, whether you realize it or not.
• asymmetric 11y ago
  I see a lot of people saying they're impressed, admired, etc. at Apple for doing this. It's not about giving props: Apple is not doing this out of goodwill, or because they believe in protecting privacy. Apple has a competitive advantage against Google/Facebook in that its business model does not depend on violating their customer's privacy. They are just exploiting that competitive advantage. Cfr. https://ar.al/notes/apple-vs-google-on-privacy-a-tale-of-absolute-competitive-advantage/ https://ar.al/notes/apple-vs-google-on-privacy-a-tale-of-abs...
  • conradk 11y ago
    What you're saying sound like a win-win situation for Apple and its customers. So whatever the reason is for them to speak out, it's a good thing that they do speak out. Isn't it?
  • aunty_helen 11y ago
    We've seen that bad that comes of corporations chasing a bottom line, perhaps this is the good. And honestly I don't mind if my digital rights are defended as an advertisment.
  • epaga 11y ago
    I don't see why it couldn't be both - seems to me like they both believe in protecting privacy and (possibly even therefore?) follow a business model which deeply respects privacy. Seems to me both of those things are worthy of respect in today's society.
  • rms_returns 11y ago
    You are right. What you say about Facebook is true, but Google's Android is open source, so there is no way they can plant a privacy-invading code and get away with that.
    • giovannibajo1 11y ago
      No phone on earth runs the open source version of Android that you can download from git. They all run custom versions that include not only closed source personalizations to the system, but they also run lots of closed code as root (play services first and foremost). The reason why this doesn't happen with Android is much more mundane: most Android phones are not encrypted so the FBI doesn't need help to read all the customer data. They just need to open the phone and dump the flash.
• Sealy 11y ago
  Huge respect to Tim Cook for standing up for the personal information security of Apples users around the world. When a non tech demands something as stupid as a back door, they do not acknowledge how weak they make data security.
• BWStearns 11y ago
  Good on them. I was hoping that they'd be able to manage a way to unlock this one without potentially breaking the whole model (by exploiting some bug in the presumably outdated version installed or something that wouldn't positively degrade the security model), but given that that's not the case then I think they're making the right choice.
• ghshephard 11y ago
  I'm surprised that nobody on this thread has commented on the real substance of this response. It has nothing to do with Apple brute forcing iPhones for the police (which it has done for years, with a simple court order) - but instead, is Apple making it abundantly clear, that if they comply (or are forced to comply) with the All Writs Act of 1789 to create this particular back door, then that opens the floodgate moving forward for all sorts of requests to add backdoors/decrease security. It's entirely possible, that the FBI can then use this precedent to simply have Apple remove all security from an iPhone in pursuit of an active investigation, which can be done with a straightforward firmware update - which IOS users tend to do without much thought.
  • Ntrails 11y ago
    But how do you get the firmware updated on a locked phone? My understanding is all updates (historically) have required the phone to be unlocked and connected to the internet?
    • ghshephard 11y ago
      If in pursuit of an active investigation (i.e. the devices are still in active use), a police agency could invoke the All Writs act of 1789, and have Apple be instructed to introduce security vulnerabilities, with the next regular upgrade of iOS, such that after the phone is upgraded, it can be captured by the FBI, or whatever police force is involved, and the data recovered. A large percentage (and presumably the the target in question) will willingly (at least today) upgrade their iOS to whatever Apple pushes out - we don't (for the most part) even question whether the purpose of that security patch is to reduce security. The only thing that secures an iPhone is the iOS following the rules of security such as the security enclave - it can just as easily (in a new release of iOS) be instructed to ignore it. What Apple/Tim Cook are doing here, is standing up for the importance of not being required to hodge-podge be at the whims and mercies of police agencies that demand they do whatever is required of it.
      • interpol_p 11y ago
        But this request was made specifically for the phone in the San Bernardino case. In which the owner is dead and the phone is locked. This implies it is possible for Apple themselves to apply an iOS update to a locked phone in order to disable the erase-on-repeated-failure feature.
• deleted 11y ago
  [deleted]
• wildmXranat 11y ago
  To all in-love-with-Apple downvoters, please read this Schneier sound analysis of the same type of situation that RIM(Blackberry) has been met with: https://www.schneier.com/blog/archives/2010/08/uae_to_ban_blac.html https://www.schneier.com/blog/archives/2010/08/uae_to_ban_bl... /quote: "RIM's carefully worded statements about BlackBerry security are designed to make their customers feel better, while giving the company ample room to screw them." /endquote I have lost enough points on this thread to simply double down on this issue. This is not a good sign at all. While Google can't compete with Apple on the principle of "not spying on their users". All Apple has to to is to publicize it and then ask for forgiveness from it's users later.
  • rconti 11y ago
    "This is not a good sign" != "This is a bad sign". I've re-read your comment several times, and I don't get how it's novel or how it applies here. Of course it could be true in this case, as it could be true in any decision any company makes. But I don't see how it's insightful or proves or suggests that Apple is doing the same. You're not some kind of martyr for the anti-Apple cause here. I think we all know that Apple could be saying one thing and doing another. That doesn't mean that they are, and it doesn't mean that this open letter is proof that they are.
• ohazi 11y ago
  This is the only acceptable response.
• deleted 11y ago
  [deleted]
• thorn 11y ago
  I wonder what will be response of other manufacturers making phones with Android.
• lemming 11y ago
  This may be one of the most important things Apple has done. Whether or not you agree with their position, it's incredibly important that tech companies start publicly explaining things like the fundamental problems with backdoors so that a lay person can understand it. Apple have the credibility to make non-technical people take their argument seriously, and the reach to get the message out to a vast number of people. I'm really pleased they're taking this position.
• boredatnight12 11y ago
  Hmmm. If this pans out in Apple's favor, I may finally buy an iPhone.
• rdl 11y ago
  I wonder how much of that was personally written by Tim Cook, vs. various other people within Apple (I'm sure legal, PR, product, etc. all had input, but this feels like something he wrote himself.)
  • WA 11y ago
    This is probably the reason why someone else wrote it. Because writing in "your voice" but without filling words is incredibly hard. But then, it's not the CEOs job to be a good writer.
    • rdl 11y ago
      It absolutely is the job of the CEO of the world's (second) most valuable company to be a good writer.
      • WA 11y ago
        Being a clear thinker (role of the CEO) and being a concise writer are two different things. The latter requires a lot of training. The CEO of the world's (second) most value company must be able to clearly articulate his goals and his vision, but he doesn't have to be a wordsmith to put his vision on paper. Writing != thinking != talking Writing might make you a better communicator in general, maybe a better thinker, too. But clear thinking and talking don't make you automatically a better writer.
        • rdl 11y ago
          I think CEOs (and even senior managers) end up communicating in writing to most of their teams most of the time, so clarity in written communication is essential to top tier people.
• yummybear 11y ago
  I can't read it from the letter - are they going to refuse to cooperate? Can they do that?
  • SEMW 11y ago
    They're not 'refusing to cooperate' in the sense of just ignoring the court or something. They'll file a motion to have the order lifted, with their reasons. If that's refused, they'll presumably appeal the refusal to a higher court, and so on, to the max extent they can. That's not being obstructionist, it's their legal right.
• rdl 11y ago
  As far as I'm aware, the most proper attacks here are, in order of cost: 0) Find some errata. Apple presumably knows as much as anyone except NSA. Have plausible deniability/parallel construction. 1) OS level issues, glitching, etc. if the device is powered on (likely not the case). Power stuff seems like a particularly profitable attack on these devices. 2) Get Apple, using their special Apple key, to run a special ramdisk to run "decrypt" without the "10 tries" limit. Still limited by the ~80ms compute time in hardware for each try. (vs. an iPhone 5S/6/6S with the Secure Enclave:) 3) Using fairly standard hardware QA/test things (at least chip-level shops; there are tens/hundreds in the world who can do this), extract the hardware key. Run a massively parallel cluster to brute force a bunch of passphrases and this hw key, in parallel. I'd bet the jihadizen is using a shortish weak passphrase, but we can do 8-10 character passphrases, too. They may have info about his other passphrases from other sources which could be useful. While I'm morally against the existence of #3, I'm enough of a horrible person, as well as interested in the technical challenge of #3, that I'd be willing to do it for $25mm, as long as I got to do it openly and retained ownership. In secret one-off, $100mm. I'd then spend most of the profits on building a system which I couldn't break in this way.
• okasaki 11y ago
  Since Apple is part of PRISM[0], the FBI can just ask the NSA. [0] https://en.wikipedia.org/wiki/File:PRISM_Collection_Details.jpg https://en.wikipedia.org/wiki/File:PRISM_Collection_Details....
  • elemenopy 11y ago
    No: data held on Apple servers (iCloud) can be provided with a warrant, but this is about data held on an iPhone but not saved to Apple servers. As a result, neither Apple nor the NSA can immediately provide it, and some means of hacking the iPhone is needed.
• lifeisstillgood 11y ago
  Does anyone have a decent architectural overview of iPhone (6)? Security - these enclaves etc sound good but devil is in the details
  • interpol_p 11y ago
    This is a good overview https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
• Cthulhu_ 11y ago
  What I think Apple should (also?) do is appeal to both the law enforcement themselves, and the government - basically go "All secret communications from law enforcement and government figures - up to the President - would be at risk", or something to that effect. I doubt the ones giving these orders would be comfortable with their own privacy being at risk.
• deleted 11y ago
  [deleted]
• uberneo 11y ago
  I remember the old dead community of OpenSource Phone - http://wiki.openmoko.org/wiki/Main_Page http://wiki.openmoko.org/wiki/Main_Page
• jaboutboul 11y ago
  Just unlock the freaking phone for them...
• deleted 11y ago
  [deleted]
• WA 11y ago
  I wonder why no one pointed out that privacy boils down to trust: That letter might be the truth or could be some kind of decoy. Maybe the backdoor will come and Apple knows that already and they try to limit the damage to their brand. Like "we tried to resist having a backdoor installed, but we couldn't do it ultimately".
• AshleysBrain 11y ago
  While basically being on Apple's side here, as I understand it, jailbroken devices are unofficial builds of iOS that have some security features removed (e.g. limits on which apps can be installed). Is it not possible for law enforcement to get what they want from that, if all they want is a custom build of iOS that can be hacked around? And why is it even possible for that to work if the data is supposed to be kept secure?
  • wilg 11y ago
    I think jailbreaking requires you to erase the phone first.
    • dh997 11y ago
      Most previous jailbreaks required an unlocked device with passcode disabled and find my iphone turned off (because passcode encrypts things). I'm still waiting for JB for 9.2.1 or 9.3 when released but there are already semijailbreaks (browser based installs a temporary app) and some unreleased PoCs, but Cydia MobileSubstrate and other tools need to be ported / verified too. Perhaps if Apple allowed the devices to be officially customer hackable (like flux, springboard replacements, transmission, 3G unrestrictor and changing fonts), there would be less need to develop exploits... Unfortunately, there is great demand from governments to buy exploits and keep those secret (not a conspiracy but tools in a market)
• amelius 11y ago
  Question: is it possible to design a cryptographic system that, whenever it is accessed by a third party (government), this is made publically visible in a log? Can blockchain technology help here?
  • jonathankoren 11y ago
    No, because I put the device in a faraday cage, with whatever proxies I need, crack it, then put it in a woodchipper. No one ever finds out.
    • aeonflux 11y ago
      Existence of such system wouldn't make much difference, because no authority would wan't to use it to access the data. They would claim that the target's inability to detect a wire is crucial to the ongoing investigation.
    • amelius 11y ago
      But what if you need the blockchain to crack it?
  • j1vms 11y ago
    Interesting, what if the security on the device was reduced purposely and in a manageable way, in exchange for one of the several steps or keys to decryption existing only in an online blockchain of some sort?
• jonathankoren 11y ago
  Apple does deserve the respect their getting for standing up to the government about this. They're absolutely right that this is an attempt to fatally undermine security for a whole host of devices, and sets a disturbing precedent. What do find interesting, is that Apple isn't the first manufacturer that the government as ordered to crack a device. An "unnamed smartphone manufacturer" was ordered to crack the lock screen on October 31, 2014.[1] No one made a fuss then, so someone caved. [1] https://en.wikipedia.org/wiki/All_Writs_Act https://en.wikipedia.org/wiki/All_Writs_Act
• vu3rdd 11y ago
  I don't see how this message is reassuring. Are they expecting the customers to just take their word? Without Apple showing the world, every bit of software that they run on their phones, these statements are at best, meant to mislead the users that Apple is doing something on the user's behalf.
• geocar 11y ago
  • Can Apple upgrade iOS on a single device that is locked, from a new untrusted laptop without wiping it? • Can Apple OTA upgrade iOS when the device is locked?
• hoodoof 11y ago
  A company with courage. Hard to believe when virtually no institution, government or corporate has it.
• kyle4211 11y ago
  It took me a bit, and I believe no one has summarized this very well yet. FBI: "You've built a device that makes it nation-state-difficult to install custom software without DRM keys. We'd like you to assist us in deploying software signed with your keys." Apple: "That feels way too much like asking a CA to sign a cert for you, so fuck off." I'm honestly not sure which side I'm on here.
• phkamp 11y ago
  The fact that Apple indicates that they would be able to produce such a software version is in itself a backdoor in the iPhone.
  • lern_too_spel 11y ago
    Correct. What this letter says is that if Apple wants to get around the wipe restriction because they want the data themselves, they can do it. This means that they will build the backdoor as soon as they are legally compelled to, but in the meantime, they can use it for a PR stunt.
• SCdF 11y ago
  > Specifically, the FBI wants us to make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation. In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession. They really need to put that paragraph closer to this one: > The government would have us remove security features and add new capabilities to the operating system, allowing a passcode to be input electronically. This would make it easier to unlock an iPhone by “brute force,” trying thousands or millions of combinations with the speed of a modern computer. The first paragraph without the second implies that iOS isn't actually secure at all.
• deleted 11y ago
  [deleted]
• vbezhenar 11y ago
  This is very disappointing letter for me. It means that Apple can indeed build a backdoor into existing phones, they just don't want to do it (or so they speak). I was under impression that Apple employs security hardware which protects keys and makes impossible to penetrate that defense. If it's not the case, iOS security is not as good as it could be.
  • edraferi 11y ago
    Other commentary suggests this capability is targeted at the iPhone 5C, and that at least some newer models do have protections against this technique.
  • ubernostrum 11y ago
    On their newer models, yes, there are hardware-based protections. The guy in this case didn't have the newest model iPhone; he has an older 5C which is at least theoretically vulnerable to Apple being forced to push a bad software update to it. It's hard not to see the effects of these things showing up in the way they design each successive generation of iPhones; each time, they add something which gives them more ways to say "nope, technically impossible to do what that court just ordered us to do".
• RalphJr45 11y ago
  Wouldn't many countries like Russia and China stop allowing the sale of iPhones or at least their use by government officials if the FBI succeeds?
• Robin_Message 11y ago
  If the UK record on anti-terror scope creep is anything to go by, not creating this backdoor is a very good idea. In the UK, laws originally intended for surveilling terrorists were/are routinely used by local councils (similar to districts I think) to monitor whether citizens are putting the correct rubbish/recycling into the correct bin. [1] This is a pandora's box, and the correct answer is not to debate whether we should open it just this once, it's to encase it in lead and throw it into the nearest volcano. Good on Apple for "wasting" shareholders money and standing up for this. [1] http://www.telegraph.co.uk/news/uknews/3333366/Half-of-councils-use-anti-terror-laws-to-spy-on-bin-crimes.html http://www.telegraph.co.uk/news/uknews/3333366/Half-of-counc... - and lest the source be questioned, this is one of the more reactionary newspapers in the UK.
  • madaxe_again 11y ago
    And that was eight years ago - the state of affairs has since worsened - and the sheer irony of those same tory critics now spearheading the push for even broader surveillance powers. It's like crack for the political class (except rob ford) - once they start they want more and more.
  • crimsoneer 11y ago
    RIPA was never designed for purely to fight terror - it was always designed to agglomerate all surveillance powers under one umbrella, including stuff like "putting up a covert camera to catch dog fowlers" or HRMC tapping your phone for serious tax avoidance investigation. All that has been written directly into the legislation since day 1.
• stefek99 11y ago
  "In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession." Someone who believes in conspiracy theories would make a statement that "now it is official" :)
• deleted 11y ago
  [deleted]
• 7GZCSdtn 11y ago
  As a software developer i'm always looking for the real bug. Weapons kill. Not Iphones.
• supergirl 11y ago
  sounds like the backdoor already exists, but only Apple knows how to use it. same as if Apple knew a master password for this phone but refused to give it. they are saying they don't want to give it because once the FBI has it, then they are free to use it anywhere. pretty strange post from Apple. probably they try to fight this request by arguing that the government is actually asking them to effectively remove security from all the phones (of this model at least). they would be happy to help break this one phone as long as it doesn't affect any other phone. in that case, then Apple should just break the phone and give it back to the FBI after removing the backdoor.
• empressplay 11y ago
  "Apple's reasonable technical assistance may include, but is not limited to: providing the FBI with a signed iPhone Software file, recovery bundle, or other Software Image File ("SIF") that can be loaded onto the SUBJECT DEVICE. The SIF will load and run from Random Access Memory and will not modify the iOS on the actual phone, the user data partition or system partition on the device's flash memory. The SIF will be coded by Apple with a unique identifier of the phone so that the SIF would only load and execute on the SUBJECT DEVICE." People hyperventilating that the tool could be used to crack other phones can relax, given the last clause in the quoted text (from the actual order).
• deleted 11y ago
  [deleted]
• lunasight 11y ago
  > The San Bernardino Case We were shocked and outraged by the deadly act of terrorism in San Bernardino last December. We mourn the loss of life and want justice for all those whose lives were affected. The FBI asked us for help in the days following the attack, and we have worked hard to support the government’s efforts to solve this horrible crime. We have no sympathy for terrorists. When the FBI has requested data that’s in our possession, we have provided it. Apple complies with valid subpoenas and search warrants, as we have in the San Bernardino case. We have also made Apple engineers available to advise the FBI, and we’ve offered our best ideas on a number of investigative options at their disposal. We have great respect for the professionals at the FBI, and we believe their intentions are good. Up to this point, we have done everything that is both within our power and within the law to help them. But now the U.S. government has asked us for something we simply do not have, and something we consider too dangerous to create. They have asked us to build a backdoor to the iPhone. Specifically, the FBI wants us to make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation. In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession. The FBI may use different words to describe this tool, but make no mistake: Building a version of iOS that bypasses security in this way would undeniably create a backdoor. And while the government may argue that its use would be limited to this case, there is no an way to guarantee such control This is just pure awful they admit to helping the fbi. how can we trust them
• ocean3 11y ago
  Even if Apple created a backdoor, how are they going to install it on locked phone? Are locked mobile able to update without access to internet or user passcode?
• dh997 11y ago
  Tim Cook: a really nice guy with blue whale-sized cohones. There can be no compromise because China, Syria and Turkey would also lean on Apple to break into phones of dissidents, and pretty soon, future whistleblowers here in US too in order to prevent leaks (iPhone 7 and iCar notwithstanding). That's the tradeoff in not giving in to faint, vague "maybes" that there were "external coordination" when in all likihood it was the ultraconservative, Saudi half leading this duo into the kookooland of violent extremism. The security services will just have to buy exploits, develop malware, cultivate human intelligence sources and monitor everything the old-fashioned way... It's not like that kid in a YouTube video finding a jailbreak exploit for an iPhone and not releasing a tool is going to sit on it, he's going to auction it off to the shop or country with the most $$$.
  • deleted 11y ago
    [deleted]
  • vacri 11y ago
    > Tim Cook: a really nice guy with blue whale-sized cohones. ... backed by a company that at one point literally had more cash than the US government. A company with a strong, expansive, and experienced legal team. He's not a small fish; he's a major captain of industry and has a lot of political clout. I mean, good on him for his standing on this issue, but he wields a lot of power here.
• rogersmith 11y ago
  Gotta give it to Apple, they sure know how to pull off a PR stunt.
• cant_kant 11y ago
  Link to the full order: https://assets.documentcloud.org/documents/2714005/SB-Shooter-Order-Compelling-Apple-Asst-iPhone.pdf https://assets.documentcloud.org/documents/2714005/SB-Shoote... It is a PDF.
• roadnottaken 11y ago
  Can someone explain this to me? The FBI requests a new version of iOS to be installed on a single phone that was involved in the attack. What, exactly, does this mean? If the phone is locked, how will they install new software on it without unlocking? People are suggesting an update to iOS that will get pushed-out to all users, but contain a backdoor that is specific to that one particular device -- but how will the new iOS version be installed without unlocking first?
• deleted 11y ago
  [deleted]
• mcintyre1994 11y ago
  I don't quite understand - what is the actual purpose of being able to push a new version of iOS while locked? Apple don't seem to use this - people stick to whichever version they're comfortable with on old devices and accept whatever limitations.. so why does the functionality even exist? Even with the restriction of being plugged in, outside of Apple who needs to push iOS versions at tethered devices and will be hindered too badly by having to unlock them first?
• greggman 11y ago
  I think it's outstanding that Apple is standing up for this. Will they, can they do anything about data in iCloud as well? While you can turn off iCloud I'd guess the majority of people are using it. Given you can access much of it at iCloud.com that would seem like whether or not you can unlock an iPhone most customers' data is available directly from Apple. Mail, notes, messages, photos, etc. No idea about other apps data that get backuped Again I'm applauding Apple for standing up for encryption. If they could some how offer the same on iCloud I'd switch from Google (Google is not encrypted either. My point is I'd switch to a service that offers it)
• LeicaLatte 11y ago
  Possible or not, the FBI seems to have formalized the issue using this opportunity. They are asking the questions they have been wanting to ask since the release of smartphones.
  • joezydeco 11y ago
    Didn't they try this with another (smaller, less publicized) case about 4 months ago? https://www.eff.org/deeplinks/2015/10/apples-eula-gives-it-license-invade-your-privacy-government-claims https://www.eff.org/deeplinks/2015/10/apples-eula-gives-it-l...
• NicoJuicy 11y ago
  Would this really be true or is this just a decoy, to let you believe there is no backdoor? I do believe there is no backdoor for when a city court requests it, but i don't really believe that the FBI or CIA doesn't have access to it. Considering that iPhone already exists a long time, they must have some means to backdoor the "iCloud"...
• tdsamardzhiev 11y ago
  If they provide to the government what the government wants now, next year the government will come back with even more ridiculous request. Mr.Cook is right - it'd be great if we can avoid creating a precedent. Oh wait they already did by providing their clients' data. Trying to stop the government now is like trying to stop a high-speed train. Still, good luck to them! Good to know they are not just pushed around without any resistance.
• xlayn 11y ago
  While we believe the FBI’s intentions are good, it would be wrong for the government to force us to build a backdoor into our products. And ultimately, we fear that this demand would undermine the very freedoms and liberty our government is meant to protect. Tim Cook Kudos to this guy for standing up to an idea. Now on practical notes, this is about security, providing a digitally secure platform to both users and providers, prevent tampering, keeping data secure. Microsoft could take a cue.
  • empressplay 11y ago
    The court order says Apple should make the software only work on the specific phone in question. Nobody could modify the software to work on other phones any more than they could make the changes to iOS themselves. Apple is misrepresenting the situation and perhaps it's because they're afraid that in the future the government will come knocking again, but I think it hurts them to not be completely above-board about this.
    • Zigurd 11y ago
      That's not really possible. There isn't a mechanism to create this condition: "Nobody could modify the software to work on other phones" Tim Cook is right. Once this is unleashed, there are no limits and all iPhones are insecure.
    • xlayn 11y ago
      Thanks for the heads up about these details. As you mention if you agree to one request you agree to all requests plus proving you can do it. A nice side effect of agreeing to this request would be to put an update that closes all the loops that allowed to perform the request on first place.
• ordbajsare 11y ago
  Tim found dead under mysterious circumstances in 3...2....1
• blisterpeanuts 11y ago
  Everyone in the U.S., please write to your Congressional representatives and also to the Presidential candidates you support. They need to know they can't get away with this.
• thothamon 11y ago
  So the FBI is asking Apple to build a tool that will unlock security measures of an existing iPhone, like the one in the San Bernadino shooting, and allow it to be read. The problem with this is that no such tool should be possible to build. It should not be a matter of yes or no; it should be simply impossible for Apple to build such a tool without the private key of the user, which Apple does not have. If it is possible to write a piece of software which can circumvent the protections of the iPhone without the user's private key, then Apple wrote its security software incorrectly. Either they wrote it with an appalling lack of security understanding; or they left in important backdoors, either knowingly or through ignorance. But if they wrote the software correctly and did not create backdoors of which they're aware, then the government's request is actually impossible -- cannot be done. So which is it, Apple? Is the point moot because you did this right? Or have you already placed backdoors in the product which the FBI is now asking you to exploit for their benefit?
  • iSnow 11y ago
    I don't understand your comment. The iPhone in question is protected with an unknown passcode. Auto erase is enabled, so brute-forcing the passcode will erase the data. However, a new OS version without auto erase and that accepts passcode input from USB would allow the FBI to try all combinations. How is Apple at fault because most any passcode scheme can be cracked via brute-forcing all comginations?
    • orf 11y ago
      > However, a new OS version without auto erase and that accepts passcode input from USB would allow the FBI to try all combinations. It shouldn't be possible to just add a new OS onto the phone without the restrictions in place, without knowing the passcode first.
      • 0942v8653 11y ago
        I see what you're saying but this has never been done before. BIOS passwords could be bypassed by draining the battery. Encryption is practically the only way to protect your data, because the storage can be taken out of the phone and hooked up to something else if need be. Making a new OS is just the easiest way for Apple to do this; there are other ways.
• tosseraccount 11y ago
  Doesn't the phone belong to San Bernardino County?
• jacquesm 11y ago
  The real security risk is the ability to update the phone's OS without authorized user consent at least as strong as the original protection the FBI are trying to break. Right now it all hinges on Apple's private key and that's a very thin wire to hang all this privacy off.
• Overtonwindow 11y ago
  The way I read this, is that Tim Cook has and said it can't be done, only that it shouldn't be done. This leads me to suspect that Apple can decrypt your phone, and they know precisely how to do it, but in doing so would disrupt their entire marketing campaign around safe and secure encryption. I'm just a government relations guy, not a security person, so please forgive me, but I'm not sure where I fall on this. I want the FBI to be able to decrypt the San Bernardino attackers phone. The same time, I don't want the government to be able to decrypt my phone. This is one hell of a damned if you do, damned if you don't situation, and I'm really stuck.
• whack 11y ago
  I've never been an Apple fan but this was a fantastic and bold move by them. Software security and hacking is already an enormous problem that every single person has to deal with. Even major companies like the NYTimes have been hacked by malicious users in the recent past. We need to take every reasonable action to combat this threat. Building deliberate vulnerabilities (yes, every backdoor is a vulnerability) into our software and devices is going to make all of us less safe, and all of us more vulnerable to unforeseeable attacks in the future.
• datashovel 11y ago
  I'd love to know the names of the people within the FBI who are pushing this agenda. The only way this foolishness is going to stop is if those people are out of a job.
  • adam12 11y ago
    I'm sure this backdoor request is fully supported by Obama as well as Hillary.
• empressplay 11y ago
  It bothers me that Tim Cook lied: he stated in his open letter that if they provided the modified OS it could be used on other phones, but the court order specifically says Apple should make the software only work on the specific phone in question.
• mnglkhn2 11y ago
  There needs to be a distinction between state security and "retail" security. State security agencies have the legal framework to compel Apple to do anything and not even talk about it. What I call "retail" security is any act by any legal enforcement agency in the country. Their requests are bound to be in large numbers and for all kinds of things. On top of that, these requests, apparently, are not yet covered by a legal framework. Hence the need to force upon an old law to try and make Apple comply. What's at stake for Apple is not only their principles but also one of their marketing pillar: "you, the user, can trust us with your data/privacy." By asking Apple to give that up, and quietly, you actually are asking them to undermine their business model. Shareholders will not appreciate that if they wouldn't have a chance to hear about it first. The Apple brand would lose from its value and it would reflect in the AAPL share price. My point is that the whole thing needs to have legal backup. And Apple is asking for this exact thing: give me a law to use. And not something from the 1700's.
• neves 11y ago
  What happened that now the companies can talk about these gov requests? The most nefast thing in these gov orders about terrorism is that the companies were forbidden to discuss it publicly.
• DannoHung 11y ago
  Cook says any iOS device could be breached if this software were created. But other articles have led me to believe that any iOS model with touchid is immune due to the secure enclave being in play even for non-touch passcode access. Is this wrong?
• rodionos 11y ago
  Can they publish a copy of the FBI letter. Otherwise, Apple's description feels a bit circumstantial and opinionated. I feel like I can make a better judgement on this whole issue if the request is made public.
  • timv 11y ago
    https://news.ycombinator.com/item?id=11117222 https://news.ycombinator.com/item?id=11117222
• droopybuns 11y ago
  Applying an update to break encryption would violate chain of custody and render the information obtained inadmissible in court.
• bmoresbest55 11y ago
  As much as I would love to believe in Apple (and any other large tech company), a part of me still thinks that maybe they are working with the government in this letter. The FBI knows that the average US citizen does not want to be hacked. What is to stop the FBI from allowing Apple to say these things and put on a show publicly while simultaneously giving over the 'master key' anyway?
• kabdib 11y ago
  I'm betting there are similar vulnerabilities in the current "Apple doesn't have the keys" versions of iOS and the hardware. For instance, do a similar mandated firmware update to the secure enclave, and now you get unlimited guesses at a PIN. edit: Ah, I've found a couple of sources claiming that the secure enclave wipes its keys if its firmware is updated. Makes sense.
• andy_ppp 11y ago
  Surprising the FBI doesn't have a division of highly paid individuals who can crack iPhones... There are plenty of people online with a vested interest in this topic who I'm sure you could hire to help. My guess is that this is more about pushing back the law and peoples rights than is is about getting access to this device. But then I'm highly cynical about what the government claim they can do with technology for obvious reasons.
• Zigurd 11y ago
  This is why technology companies have to go farther than implementing proprietary security systems: They have to put the capability to circumvent security out of reach of themselves. Real data security has to be a mix of services that are friendly to reliable key exchange and strong unbreakable encryption, and verifiably secure endpoint software, which in practice means open source software where the user can control installation, that implements encryption.
• krylon 11y ago
  Given the way a lot of people (and the media) tend to go completely bonkers when somebody says "terrorist", this is commendable. It remains to be seen, though, what Apple will actually do, in legal terms. Will they flat-out refuse to cooperate, even if this means that they will be fined or Mr. Cook will be imprisoned for contempt or something like that? Will they actually send their lawyers to challenge the court decision? That would be very interesting to watch, and if they succeeded, it would create a precedent for a lot of other companies. But so would their failure.
• tomelders 11y ago
  Remember, iPhone's are available world wide. If the US wants to play world police, then I want a vote in the US election.
• leecarraher 11y ago
  Backdoor is somewhat of a misconception. What they want are two front doors, ie we encrypt your message with the recipients public key, and we make a copy with our(in this case apple's) public key. We send both messages over the internet, and apple or your isp/cell service provider (we can also assume nsa prism has it too) stores the apple key'd message or both. When the government wants access, they can issue a subpoena for information from the isp/cell provider for the encrypted data (or just download it from Saratoga Spings), then they issue a warrant to apple to decrypt it with their private key. This is likely the only reasonable and responsible outcome that I can see resulting from this debate. Or, pessimistically it becomes an issue for political fodder and we leave it up to politicians who have little to no understanding of the technology to devise some technologically inept solution.
• lucio 11y ago
  Can't they dump all the data from that particular device and then send it to the FBI? Maybe the judge will order that? Obviously they're confessing they can break the encryption but they would not do it, on principle. I don't see how they can win this fight. If it's the iphone of the shooter, and they can decrypt it, they should do it. It is not the same as to give the FBI a tool to unlock any iphone.
• Dolores12 11y ago
  You don't own apple hardware, so you can't protect your device.
• cognivore 11y ago
  If I were Cook, I'd draw a line in the sand. If we are force to comply, we exit the phone business, because we won't make phones that compromise our customer's security. But that would take more balls than anyone left here in this "Land of the free and home of the brave" seems to have left anymore.
  • JoeAltmaier 11y ago
    http://www.commondreams.org/news/2014/04/17/lavabit-company-defied-nsa-surveillance-loses-appeal http://www.commondreams.org/news/2014/04/17/lavabit-company-...
    • cognivore 11y ago
      Thank you, and I'm proud of Lavabit. They're at the top of my Balls list now.
    • makecheck 11y ago
      And, his letter is still posted on his web site, describing what he went through: http://lavabit.com/ http://lavabit.com/
  • castratikron 11y ago
    Apple could also put the software under a free license. The community could remove any backdoors that Apple is required to put in. They could still sell the hardware if they wanted to keep making money, just like Google does now.
  • rhino369 11y ago
    The board of directors would string him up. And if they didn't the stockholders would. No way would apple give up the phone business.
  • umanwizard 11y ago
    He'd be fired immediately.
  • unimpressive 11y ago
• castratikron 11y ago
  This is a great way to build public awareness for this issue. Hopefully this will allow more people to get involved in the fight.
• Fiahil 11y ago
  I like the position apple is taking, However, after reading the letter, I noticed it misses a point I consider even more important than just "a dangerous precedent". Apple is selling devices on the whole planet, not just in the USA. So, what's the FBI (an American agency) is requesting is not dangerous for only American citizen, but also for iPhones' owners in Europe, Asia, Africa, Oceania. Hell, these people are not even part of the debate, because they don't belong in the "American democracy". If I'm going to be affected by someone else's policies, I would like to be at least allowed in the discussion.
  • err4nt 11y ago
    I wouldn't worry too much about non-American apple users. Those of us outside the US know how tangled law and tech can be - and so people guarding information tend to use non-American cloud services for example. If this goes through I just expect more people internationally to choose something else. Not a big loss to them, but the loss of business to Apple (a US company) might be felt.
• z3t4 11y ago
  Instead of FBI paying apple engineers to hack a phone, why don't they ask their kids !? It would probably save millions of dollars.
  • VLM 11y ago
    Whats on the phone that isn't already on at least one cloud server and on NSA spy servers and telco records? That's the real question that everyone is carefully avoiding. I mean, you could break into my android phone at enormous effort to use my phone to access my gmail app, but isn't it easier to just ask google, and I'm sure the telco and NSA are already logging everything anyway? You could break into my phone to use my phone to use my facebook app to look at my uploaded pictures, but isn't it a million times easier to just contact facebook to access my facebook account? In this new era of dumb terminals, its like a FBI agent demanding access to the terminal settings screen of a vintage VT102 in order to track terrorists or whatever. Or a demand to know my modem init string. It demonstrates a fundamental lack of understanding of the entire ecosystem from top to bottom. The purpose of all this drama is to avoid discussion of the insecurity of cloud services. It might be that apple people use the cloud a lot less than us android people. I'd be interested and surprised to learn that.
• ageofwant 11y ago
  I am happy AAPL is taking this stance. But I can't help but believe that is has very little to do with liberty, and very much with the bottom line. Either way, I guess we should be grateful for little mercies.
• delinka 11y ago
  What's all this talk about pushing updates to locked phones? I have to get involved every time there's an OS update for any of my iDevices. That damn red dot on Settings.app just stares at me while I try to find a time I'd like to be without my device for half an hour.
• l3m0ndr0p 11y ago
  Apple's encryption appears to be done in such a way that government entities can safely use them as well as "consumers." But what may happen, is that Apple will be force to produce 2 kinds of iPhones. One for consumers, with strong encryption, but a "backdoor" for warrant "cough" based access. 2nd type of iPhones for government use (string encryption, no backdoors) They may already have this in place now, but what we are seeing now is a show. They are testing how people/consumers are going to react to this situation. Out government probably figures that nobody will care in the end. In the USA, we have lost our liberty. It's time to wake up and see what is happening. It's getting worse & the people within our government are working hard to enslave us even more.
• notthegov 11y ago
  It's hard for me to have respect for an organization that was built by J. Edgar Hoover, a person who did not respect the law or American's rights. The philosophy of corruption and oppression still echoes throughout the FBI. Even today, there are FBI agents that work for private interests. You can't reform a mafia, you must abolish it and start over.
• lucio 11y ago
  Being realistic, ¿how many fewer iphones will apple sell if they remove the SE? ¿How many people will not buy an iphone if they are told that their info can be accessed with a judge's warrant? I'm guessing a 0.1% drop in sales?
• mckoss 11y ago
  A possible compromise would be to add a backdoor to the security module that would unlock the phone in exchange for a proof of work. It would be relatively easy for the chip to offer a challenge and accept, say, a $100,000 proof of work to unlock the phone. This way, we prevent bulk surveillance but still allow the government to access high value targets' devices.
• nateberkopec 11y ago
  Is there any doubt that when the FBI brings up a law from the 1700's to justify breaking digital encryption in 2016 that they are completely making it up as they go along?
  • rhino369 11y ago
    Sure. Laws don't have to be so specific and they are typically better if they aren't so specific. The law basically says courts can order anything to upload the law. Encryption is part of anything.
• ogezi 11y ago
  it's a slippery slope.
• pmarreck 11y ago
  HN is the first place I came to for discussion on this and I just wanted to thank you all for keeping it civil, intelligent, and objective
• thorntonbf 11y ago
  This is an interesting chapter in the "Tim will never be Steve" saga that so many people are infatuated with. This particular hill that Tim Cook has decided to defend is as important as anything Steve Jobs ever did at Apple.
• tibbon 11y ago
  I heard this morning on the (semi-conservative FM radio) that this was a national security issue, and that Apple is helping terrorists in not bypassing this. I don't get it- the shooters are dead. How is what is on their phone a matter of national security? We probably have 99% of the information we'll ever have on them. There is no larger plot. Not having what's on this device I cannot imagine puts anyone at risk.
  • rahoulb 11y ago
    > Rather than asking for legislative action through Congress, the FBI is proposing an unprecedented use of the All Writs Act of 1789 to justify an expansion of its authority. It's all about precedent.
• at-fates-hands 11y ago
  The easy solution to this is to have the gov send Apple the phone. They break into themselves and then hand back the phone with the pass code turned off and whatever software they need to install to do it removed, leaving no trace of how they actually did it. Win/Win No software backdoor is created, the FBI gets its data and we all go on with our lives. Why are we spending so much time gnashing teeth over something that has a very simple solution to it?
  • hunterjrj 11y ago
    Chain of custody. The guv would need to be able to prove, in a court of law, who touched it and when, for what purpose, etc. Handing it off to Apple in good faith would make it inadmissible as evidence in a trial. You could argue that Apple could allow an official to be present while work is being done on the phone, but then Apple risks having it's (to-be-developed) method being viewed and/or captured by said official. Very risky.
• thrillgore 11y ago
  Am I the only one buying a new iPad because of this announcement?
• imroot 11y ago
  If you look at past cases where the All Writs Act has been invoked, the Courts have rejected this type of government conscription. Effectively, the government is forcing Apple to take receipt of a device that it does not own or posses, then perform potentially destructive services on a device, and then perform services that could potentially require Apple to testify at a trial under the Confrontation Clause of the Sixth Amendment. I really think that Apple's in the clear here, and the AUSA's in the case are pulling all the stops to get Apple ordered to break the encryption.
• Twisell 11y ago
  [In walk the drones] "Today we celebrate the first glorious anniversary of the Information Purification Directives. [Apple's hammer-thrower enters, pursued by storm troopers.] We have created for the first time in all history a garden of pure ideology, where each worker may bloom, secure from the pests of any contradictory true thoughts. Our Unification of Thoughts is more powerful a weapon than any fleet or army on earth. We are one people, with one will, one resolve, one cause. Our enemies shall talk themselves to death and we will bury them with their own confusion. [Hammer is thrown at the screen] We shall prevail! [Boom!] On January 24th Apple Computer will introduce Macintosh. And you'll see why 1984 won't be like '1984.'" ------------------------------------------------------------ Apple Superbowl AD "1984" Transcription courtesy of George Gollin, 1997 Edit:Removed the link to the video. My goal wasn't to draw traffic anywhere it was just to point out that some of Big Brother sentences in an Ad aired 30 years ago still have strong resonance today. "Our enemies shall talk themselves to death" Hum... just read yesterday that NSA is believed to use machine learning over cell big-data to determine drone target...
• carsonreinke 11y ago
  Maybe I am missing something here, but the Washinton Post says "Federal prosecutors stated in a memo accompanying the order that the software would affect only the seized phone". What is so wrong with that? If they just use it only on this phone? Or is that the weapon has been created and could be used?
  • johnward 11y ago
    " Or is that the weapon has been created and could be used?" I'm pretty sure it's this. Once it's created it's only a matter of time until it's leaked and anyone can use it.
  • ncallaway 11y ago
    Apple is sayong that the federal prosecutors are wrong in this assertion. Apple is saying that any solution that is applied to specifically this phone can trivially be generalized to all other iPhones (or, at least other iPhone 5cs). Further, unlocking this phone in response to this order establishes a precedent that this is okay. You are much better off legally if you fight the first request than if you fight the thousandth request.
• znpy 11y ago
  Kudos to Apple for standing up to the US government and stand by its users.
• pg_is_a_butt 11y ago
  a message to everyone: fuck america, and fuck all you idiots.
• aidos 11y ago
  OT but this post is well on its way to becoming the most popular post since Steve Jobs died. https://hn.algolia.com/?q=&query=&sort=byPopularity&prefix&page=0&dateRange=all&type=story https://hn.algolia.com/?q=&query=&sort=byPopularity&prefix&p...
• jusben1369 11y ago
  I think, as a society, it boils down to this: "And while the government may argue that its use would be limited to this case, there is no way to guarantee such control." Can a private, for profit, company deny the will of an elected government working to solve a heinous crime based not on what they say they will do but because they cannot give a 100% guarantee that this is the only time/way it'll be used? Apple acknowledges that the government is saying it's limited to this case but because there's no guarantee (100% certainty) they feel they can deny it? If yes, what does that mean as a broader precedent. Are we comfortable with private companies denying an elected government based not on what they agree to, but instead because there's a chance it'll be used in other ways? As terribly flawed one might feel about government very few would think it has less accountability than a private company.
  • tdaltonc 11y ago
    I see your point. Defying a order from a democratic government is a big deal. But Apple isn't saying they wont do it. They just want to make it really clear that they're not happy about it and they want the government to change their mind. The government still has a monopoly on the legitimate use of force.
    • jusben1369 11y ago
      ```Opposing this order is not something we take lightly. We feel we must speak up in the face of what we see as an overreach by the U.S. government. We are challenging the FBI’s demands with the deepest respect for American democracy and a love of our country``` I read into that that they are in fact fighting this? And I agree, I think it's great that Apple is forcing this discussion into the public domain. These are key issues for us all.
• tommynicholas 11y ago
  No sympathy for terrorists, no sympathy for weakening encryption. I can understand someone outside of tech not understanding how those are comparable statements, but if anything the latter is more important.
• aiabgold 11y ago
  I'm curious: is it likely that Apple was under a gag order regarding the backdoor proposals/discussions? I've always wondered why large tech companies/corporations abide by such orders instead of speaking out. Even if Apple was under a gag order, they've created a PR nightmare for the alphabet agencies; Apple could be pursued in court, but that pursuit would now likely be done in the face of negative public opinion.
• ctstover 11y ago
  Flame bait: We need to surrender all firearms, encryption, and gold to our serf lords so as to ease the pain of "feeling the Bern". plus my obligatory comments: -believing apple is on the side of your rights is naive -gray text on white background promotes illiteracy
• cmsimike 11y ago
  Heads up that I just recently discovered - if your iphone has touch id enabled, you can go into the touch id settings and selectively disable touch id for phone unlocking while keeping it for the app store.
• mikeash 11y ago
  I'm clearly in the minority here, but I don't really understand Apple's position here, nor do I understand why everyone is rallying behind them. Apple built hardware which was not particularly secure. The software defaults to a four-digit PIN. They attempt to mitigate this by adding an escalating interval between entries, and by optionally wiping the phone after too many failed tries, but this is not set in stone and those limits can be removed with a software update. The government is coming to Apple and saying, "You can remove these limits. Do that for us on this phone." Coming as a legitimate court order, I see no problem with this request. The government isn't even asking them to crack the phone, they just want Apple to remove the limits so the government can try to brute force it. They're even paying Apple for their trouble. If Apple didn't want to be put in a position where the government can ask them to compromise their users' privacy, they should have built hardware which even they couldn't crack. And of course they did; starting with the A7 CPUs, the "secure enclave" system prevents even Apple from bypassing these limits. The phone in question just happens to predate that change. If the government was demanding that Apple do the impossible, I'd be on their side. If the government was demanding that Apple stop manufacturing secure phones, I'd be on their side. But here, all they're asking is for a bit of help to crack an insecure system. They're doing this in the open, with a court order. What's the problem?
  • eipipuz 11y ago
    Is it possible to update a phone without the user accepting the change (with the phone locked)? Do you want such a tool (the one the removes the security of updating) to exist so that anyone with physical access can replace the OS with something else?
    • mikeash 11y ago
      Apparently it is possible to update older phones like this. On newer ones, the OS in general is not an issue, since the security bits are handled by the secure enclave. I'm not sure what the software update policy is (it's only briefly mentioned in Apple's iOS security paper) but I'd wager that it's impossible to push an update to the secure enclave software without either unlocking it or erasing the crypto keys. I don't understand what you're getting at with the "tool" question. Nobody's talking about building something that lets anyone with physical access replace the OS. The phone's secure boot system will still require updates to be signed by Apple. Apple can replace the OS with physical access. On older hardware, it seems they can do this without wiping the data. Do I want Apple to be able to do this? It doesn't matter what I want, the fact is that they can. Since they can, and since the FBI has a court order, I don't see what's wrong with requiring them to do so. If you don't want them doing this to your phone, buy a newer one with the more secure hardware.
• deleted 11y ago
  [deleted]
• FIX_IT 11y ago
  Just so you know when I forgot the password to my password to my iPhone remembered that I choose 1 from the top section 2 repeated numbers from the row below 1 below that and then a zero. So I tried it untill it said "iPhone disabled connect to iTunes", this is when I found out you can reset the disabled time by clicking on a computer the backup button. So therefor you could successfully create a program that tries passcodes 5 or 10 times then tries and fails to back the iPhone up. (There is no need for a backdoor or anything fancy)
• blazespin 11y ago
  Apple should be more clear that this is 5C and not the latest version.
• joeclark77 11y ago
  Can someone explain this to me: if the data is encrypted, how does switching the operating system out enable one to read the data? I'm a layman in this area but I can only surmise that the data is stored unencrypted and it's the operating system itself that's somehow locked. If a change of operating system can open up encrypted data, then what's the point of encrypting hard drives or data sent over a network?
  • cmurf 11y ago
    It doesn't. Changing the OS allows removal of the anti-bruteforcing feature(s): the delay between attempts that increase exponentially, or the delay limit of 10 where the encryption key(s) are deleted and in effect all user data. This may not be possible on iPhones with secure enclave though, the anti-bruteforcing is in part built into the secure enclave, but the iPhone 5c in question in this case doesn't have a secure enclave so it might be possible. And further they want an automated way to iterate the password. Basically they want a backdoor to make it easier to bruteforce the phone through guessing the passphrase. So there is nothing for Apple to hand over. There are no actual keys (they're on the phone itself in an unaccessible way, practically). The court order in effect orders them to write a derivative OS without bruteforce inhibition features. They probably can do that, it probably isn't burdensome, but is it legal to compel a company to write code? Can a court order you to write a book? Or a letter? They can make you turn over facts or evidence, but it's specious they can make you create something, even if you have the capacity to create it.
• deleted 11y ago
  [deleted]
• grecy 11y ago
  Does anyone know what the consequences for Apple will be if they keep refusing, but the courts say they must? Massive fines? (we know they have the cash to cover it) Jail time for execs (whoa!) ?
• dawhizkid 11y ago
  So this was a work phone owned by his employer. Does that change things? Surprised they didn't have IT software installed already to monitor the device.
• mladenkovacevic 11y ago
  Way to go Apple. And Edward Snowden just tweeted this a few minutes ago in response to another tweet proposing Google back up Tim Cook: "This is the most important tech case in a decade. Silence means @google picked a side, but it's not the public's."
• caogecym 11y ago
  under what kind of pressure would Tim write this public letter?
• caogecym 11y ago
  under what kind of pressure would Tim decide to write this public letter?
• jwr 11y ago
  The important lesson here is that it is time to design the next phones in a way that makes it impossible to either install a software update without unlocking the device or implement auto-erase functionality in hardware. That way for future phones at least, the issue would become moot: there would be no way for Apple to build and/or install a custom software image that allows brute-force password cracking.
  • LeoNatan25 11y ago
    Already there with 5S and above.
• maindrive 11y ago
  I think Apple tried to prove that they don't give any user data to agencies. PR stunt. But actually they got it fundamentally wrong as this was actually case of national security and the attack that happened. So huge PR stunt, but a own goal
• cromwellian 11y ago
  There's a simple way to defeat Apple's argument. The judge could simply ask Apple to flash the new firmware on that phone, let the FBI run the brute force under their supervision and obtain the contents they need, and then flash back a non-compromised version of the OS. The government would never have access to a phone with a compromised version of an OS that they could use to repeat this trick. Rather, the government would have to obtain court orders and have forensics done under supervision. This isn't a backdoor and doesn't affect consumers, and sets a really high bar to trying to scale this for the government because it requires Apple as the gatekeeper every time to agree to do the one-off hack. The cynic in me thinks that this letter is more about brand image. Apple wants to claim they can't hack their own phones, even if the government asks, but clearly in the case of the iPhone 5C it IS possible for them to do it, and this creates a contradiction with their public marketing and privacy position. If they didn't release this open letter, then simply complying with the judges order would make them look bad.
  • ccvannorman 11y ago
    1) Merely creating the software/firmware in the first place is extremely dangerous, allowing for a failure point of any engineer or custodian of the firmware to leak it, destroying everything. 2) The strong precedent will be set that governments can get whatever they want from our devices by whatever means necessary, and it will only get worse.
  • will_be_ironman 11y ago
    If Apple doesn't fight this, a precedent will be set, allowing for the government to compel companies to release user information or ways of circumventing encryption in the future. 2) the government doesn't need to have access to the firmware for it to become dangerous, the sheer fact that this can be created is dangerous. What's to stop a determined, hacker from doing the same thing in the confines of his/her bedroom once it's confirmed that this is possible?
  • nroach 11y ago
    The problem is that once created, it would be easier for future warrants to ask Apple to simply re-perform the same trick it's done in the past. Apple's core argument is that allow this once opens the door to doing it repeatedly because right now Apple doesn't have the toolchain to do this. Once the toolchain exists, its deployment is trivial.
• Kenp77 11y ago
  I'm sorry but "Smartphones, led by iPhone"? Bit presumptuous.
• jsprogrammer 11y ago
  If it is possible to build the requested OS, then it can be said that the iPhone already has a backdoor. If the device were truely locked down, there would be no aftermarket solution to unlock it. My understanding is that Apple was asked to supply software that would prevent their software from destroying evidence on a particular device. They should comply with this order, especially given the device in question.
  • Synaesthesia 11y ago
    That's true for the iPhone 5 and earlier but for the iPhone 5S and later Apple actually made it impossible (see secure enclave). But it's not about that but rather the legal implications this has - it would set a precedent allowing the government to basically compel any company to provide keys to decrypt information which is a huge blow to privacy.
• StillBored 11y ago
  Ok, so I completely fail to see how a random crazy guy with a gun who shoots up a bunch of unarmed people has "national security implications". This seems to be a "fact" that everyone wants to agree on, but is frankly a load of BS if one considers the government probably already has his entire call/texting history for the last couple years. I see this as just another "its for the children" ploy, of which I'm completely sick of. In that I fully support Apple/etc for finally gaining a backbone. If more people stood up, then I wouldn't have to be naked body scanned at the airport, or the dozens of other privacy invasions the government performs on a daily basis simply to give themselves something to do. So, rather than admit they won't ever be able to predict or protect the population in any meaningful way from random people willing to give their lives to make a statement, they waste our time and money coming up with ever more invasive ways to peek into everyone's most private possessions.
  • programmarchy 11y ago
    Good point. You'd think this would be something that local / state law enforcement should be handling, but the reason it's kicked up to the federal level is that the attack is politically motivated, which places it in the "terrorism" category. The irony is that most people are afraid to stand up (to body scanners, mass surveillance, etc.) because of threats of violence from their own government, which is in itself a form of terrorism.
  • omarforgotpwd 11y ago
    If it was many of the shootings perpetrated by non-muslims every day in the US, they wouldn't have cared. But because these Americans were muslims they need to scan their phones and make sure they weren't getting orders from some terrorist network.
    • pyre 11y ago
      Does it really matter? Most terrorist networks would be claiming responsibility for the attack if they were involved.
• tdaltonc 11y ago
  What are the odds that Apple has been ordered to do this before, but every other time they were asked it was in a FISA court? That would mean that this is the first time they've been allowed to talk about it.
• wskinner 11y ago
  As others have noted, this is probably mostly about branding. But that's why it is genius. Tim Cook is committing Apple to this pro-privacy position in a very public way. This means that a reversal of this position or a revelation that Apple has been acting contra it, would be extremely expensive to Apple's reputation with its customers, effectively costing the company a huge amount of money. By publicly committing Apple to this cause, Cook makes it more likely that internal teams at Apple as well as future versions of the company will adhere to this position. By defining a set of actions which, if made public, would ruin the company's brand, Cook makes it less likely Apple will take those actions.
  • apozem 11y ago
    You're exactly right about the effects on the company as a whole. A CEO is like a cheerleader and ship's captain for a company. Nilay Patel over at The Verge said on one of their podcasts he once asked Satya Nadella what it was like to be the CEO of a company as large as Microsoft. Nadella told him being CEO meant telling a big-picture vision to the press and the company over and over again until everyone started going in that direction.
• partiallypro 11y ago
  In the future, once terrorists have TouchID iPhones, couldn't they just use the corpse's finger to unlock the phone?
  • lololomg 11y ago
    Touch ID can't be used if - The phone was turned rebooted - It's been more than 48 hours since the last time the passcode was entered - The user didn't set up a touch ID fingerprint
• marmot 11y ago
  The FBI's intentions are not good. They have abused the data, tech, power they already have at every turn. They fabricate terror and crime, then use it as an excuse to violate our human and constitutional rights. Stopping crime and terror is secondary to undermining our security and maintaining a culture of fear.
• davidhariri 11y ago
  I'm no security expert, but how would Apple access previously encrypted data with a different version of iOS? Doesn't having that ability imply they already have a "back-door"? Could someone explain what I'm missing here or is it more that that would be a one-off solution and the FBI is asking for a global, remote, no apple needed solution...
  • kentonv 11y ago
    If you read the letter carefully, you'll notice it talks about brute-forcing the password. I guess the assumption is that the password is brute-forceable, but the FBI is unable -- or unwilling -- to write their own software to do it. This seems surprising to me; you'd think the FBI could employ a few hardware hackers for this. Maybe they are only pushing the issue for political reasons -- actual jihadist terrorist attacks on US soil don't happen very often, better milk it for all it's worth?
• davidhariri 11y ago
  I'm no security expert, but how would Apple access previously encrypted data with a different version of iOS? Doesn't having that ability imply they already have a "back-door"? Could someone explain what I'm missing here or is it more that that would be a one-off solution and the FBI is asking for a global, remote, no apple needed solution...
• bumbledraven 11y ago
  Cook wrote that "this software ... would have the potential to unlock any iPhone in someone’s physical possession." (emphasis mine) Is that true? What if it's locked with a secure 128-bit (e.g. 10-word diceware) passphrase?
  • sloanesturz 11y ago
    I believe you are correct. Cook probably meant that it would unlock any iPhone with the standard 4 or 6 number passcode.
• cdub32k 11y ago
  Bollucks. I'm sick and tired of these limp-wristed sissies cry babyin about their privacy
• joering2 11y ago
  > And while the government may argue that its use would be limited to this case, there is no way to guarantee such control. Good one Tim! I mean how long did the LE think they can abuse constitution, put spy devices on people's cars without warrant, use stingrays and do all sort of other crazy stuff including planning and executing white-flag attacks without any consequences whatsoever?? I mean, at some point, we the people - for a good reason - will lose all and any trust we have in them! And that's what Tim is saying in this one sentence that with overwhelming evidence, the US Gov would have hard time arguing against!
• ThinkBeat 11y ago
  If I were a betting man I would put good money on the bet that a bypass exists and is well known to the government. What parts of the government is a different matter. This is a perfect setup. Get all the bad guys to run out and buy iPhones (good for Apple) believing that they are safe from the US surveillance machine. Then the appropriate agency can slurp up whatever it wants.
• wicket 11y ago
  A phone without a backdoor would be illegal in the UK once the Snooper's Charter comes in to full effect. I'm very interested to see how the UK government will react to Apple's stance.
• AYBABTME 11y ago
  While I think protecting user data is important, I don't understand what the fuss is about. Anyone could (given technical knowledge + tools) take apart a phone, pull the encrypted data out of storage, and then brute force the encryption on a large machine. The FBI doesn't need the modified iOS code, and that Apple write/not-write it doesn't change anything in the end, since someone else could just as well write the software with some reverse engineering. [edit: if you downvote because I'm wrong, please explain because I'd love to know why]
• hackuser 11y ago
  My guess is that it's likely that the FBI can access the data without Apple's help. Based on what we know, how do we distingish between these two situations, and which seems more likely? A) Apple has created unbreakable security. The FBI cannot access the data and needs Apple's help. B) iPhone security, like all other security, is breakable. iPhones are a very high-value target (all data on all iPhones); therefore some national security organizations, probably many of them in many countries, have developed exploits. The FBI, following normal practice, does not want to reveal the exploits or capability and therefore must go through this charade.
• autoreleasepool 11y ago
  Wow this made my day. I think my faith in Apple's privacy concerns got a much needed revitalization. Privacy and encryption are the number one reason I stick with iPhone and Mac with File Vault. It was always hard to completely trust them after PRISM. However, that was arguably a different Apple. This stance against the government come poetry reaffirms my faith in the genuineness of Apple'e encryption efforts and Tim Cook specifically.
  • herbst 11y ago
    If this is your main reasons to choose a OS you clearly should use Linux then ;)
    • autoreleasepool 11y ago
      I prefer FreeBSD :) No code from [redacted] makes it an excellent choice for the privacy conscious. I use Slackware in the cases where I need a Linux kernel. I think that might give you an idea of what I'm trying to avoid. [redacted] Anyways, I use *BSD daily in VMWare Fusion for any development that isn't related to iOS. I also do my email and web surfing in OS X because it's simply more pleasant.
• Your_Creator 11y ago
  The All Writs Act is a United States federal statute, codified at 28 U.S.C. § 1651, which authorizes the United States federal courts to "issue all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law." well, as far as I can see, it is not agreeable to the use and principle of law to force a company (or a person since corporations are people) to spend money and waste resources to compromise its own security systems, which happens to be something they morally object to.
• a-b 11y ago
  well, no one protected from thermo-rectal crypto-analysis. The only difference is that gov guys want to keep it hidden from target
• Merad 11y ago
  What's the potential fallout on this case? I assume Apple is appealing the ruling - what happens if the ruling is upheld and Apple refuses to comply (unlikely IMO, but what if)? Could the DOJ target individual Apple engineers and order them to do it or face contempt of court charges?
  • programmarchy 11y ago
    Yeah, even if the DOJ ordered Apple the corporation, ultimately they would still have to force one or more Apple engineers to perform the task. That seems messed up. Would the Apple engineer at least have the option to quit?
    • dragonwriter 11y ago
      > Yeah, even if the DOJ ordered Apple the corporation, ultimately they would still have to force one or more Apple engineers to perform the task. More likely, they would impose consequences against Apple-the-corporation were it not to cause the task to be performed, rather than forcing an Apple engineer to perform the task.
• benevol 11y ago
  PSA: You can't just be skeptical like that. This is an Apple post. Praise the iLord.
  • dang 11y ago
    Please don't post unsubstantive comments. We detached this comment from https://news.ycombinator.com/item?id=11116803 https://news.ycombinator.com/item?id=11116803 and marked it off-topic.
• callumlocke 11y ago
  > "Specifically, the FBI wants us to make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation. In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession." So there is already a backdoor. Apple are refusing to let the FBI use the backdoor. The backdoor is the fact that Apple can push a firmware update that disables security features, without the device's password being entered at any point.
• mempko 11y ago
  > Specifically, the FBI wants us to make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation. In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession. The scary part here is that the iPhone data is really not that secure. If apple can overwrite the OS and get access to the data, this means the keys are stored on the phone somewhere, and not password protected, or "fingerprint" protected.
• agebronze 11y ago
  This is just huge hypocrisy and full of lies. First of all, Apple CAN attempt to brute force the password. Compiling whatever new firmware is needed and signing it with their keys will not introduce any new backdoor like they claimed and lied to the public - the backdoor is already there, and it is their private keys. Just like that "backdoor" somehow end up at some bad guy's hand, so could their private keys. I would agree with Apple if they wanted FBI to pre-submit all their guessed passcodes for brute force for apple to try, and for apple to have the sole responsibility for that, so that getting said "backdoor" (which really is nothing more than a door handle) will be as hard as getting their private keys, and governments will not keep the said backdoor in their hands. I would also agree if Apple claimed they don't want to be able to crack devices at a judge's order (although that would be against the law - so they can't claim that). But this is NOT what Apple said. This whole letter is just one big PR bulshit. They CAN brute force a passcode. They failed enforcing significant delay incurred when failing a passcode attempt - even tho this issue was already known for YEARS (will give citation if needed) when apple designed the discussed iPhone 5C - and they also failed requiring passcode to update the device. They already have their convenient backdoor in place in the form of their private keys.
  • voidpointer 11y ago
    > This is just huge hypocrisy and full of lies. First of all, Apple CAN attempt to brute force the password. Compiling whatever new firmware is needed and signing it with their keys will not introduce any new backdoor like they claimed and lied to the public - the backdoor is already there, and it is their private keys. Just like that "backdoor" somehow end up at some bad guy's hand, so could their private keys. Thank you! This is the most important technical point about this whole thing. All the talking about the SE (fascinating as it may be) is irrelevant. All strong crypto that is based on a private key being kept in a secure vault at some corporation does have a backdoor. The keeper of the key can be compelled to use it to sign something. This is exactly why this would be such a dangerous precedent. Government giving software specifications that are signed with a vendors public key. In this case, it's a one off but it's a step into the direction of "upload a screen-shot of the phone's display every minute to ftp.nsa.gov with your next iOS update". And no SecureEnclave will protect against that. It will just be a OS update signed by Apple.
• HoochTHX 11y ago
  This is the FBI going after a Parallel Construction path. They already have all the information from the NSA bag o'tricks, but none of those can be used in court. But an unlocked phone unlocks the legal obstacles.
• teacurran 11y ago
  Why is there very little talk about the First Amendment in this whole discussion? They are asking to write custom software. The supreme court has ruled in separate cases that: 1. that software is speech 2. that a person (corporations are people according to them) cannot be compelled to speak It would seem to me that the FBI could perhaps subpoena technical documentation from Apple but it should be required to hire their own developers to write this software.
• philip1209 11y ago
  Their iMessage encryption is fascinating. It basically makes it impossible to retroactively decrypt iMessages. With a court order, they can start MITMing conversations, but unless they intentionally generate a MITM keypair they are cryptographically locked out of the conversation. http://techcrunch.com/2014/02/27/apple-explains-exactly-how-secure-imessage-really-is/ http://techcrunch.com/2014/02/27/apple-explains-exactly-how-... (Link to Apple's paper is in the article) (Yes, Apple could add this key for everybody at the beginning, but if their intention is security then it is a brilliant system.)
• facetube 11y ago
  This was his employer's phone, right? As in, it was government-owned property being used in the course of terrorism. Were they using Apple's Mobile Device Management (MDM) framework or some other form of key escrow? If not, why should Apple bail out a government entity, at the expense of its own customers and security, that couldn't even be bothered to follow best practices?
• agebronze 11y ago
  Actually, someone other than Apple is already able to do the requested things in the court warrant (brute force passcode from a locked iPhone) - ih8sn0w has an iBoot exploit for A5 chipset (same as iPhone 5c), so he can probably boot an unsigned kernel, and use some public tools already published to crack the said passcode. If some lone hacker can do it don't be fooled for a minute that NSA can't, or that the feds couldn't buy something similar from another hacker. This is Apple covering their P ass from the press.
• huntleydavis 11y ago
  Privacy is obviously the foremost issue at hand with the Government's request here, but there is also a huge potential impact on the future of the iPhone software. There is a huge difference between granting access to a user's data at the Government's request vs demanding a customized build of the iPhone's OS. Imagine the long-term implications of having a third-party tether its misaligned feature requests to every OS update that the iPhone makes. What would be the continued relationship with Apple and the agency behind this? Would this evolve into something analogous to HIPAA compliance?
• uberdingo 11y ago
  This is all brave talk until they publicly say the same thing to China, until then this political bluster. http://qz.com/332059/apple-is-reportedly-giving-the-chinese-government-access-to-its-devices-for-a-security-assessment/ http://qz.com/332059/apple-is-reportedly-giving-the-chinese-...
• Synaesthesia 11y ago
  There is one way to brute force an iPhone called IP Box. It's a hardware device which can brute force a 4 digit pin in ~111 hours. http://blog.mdsec.co.uk/2015/03/bruteforcing-ios-screenlock.html http://blog.mdsec.co.uk/2015/03/bruteforcing-ios-screenlock.... But it only works on iOS 8.1 or earlier, was patched in iOS 8.1.1
• hughw 11y ago
  Is it possible for a human just to try all 9999 passcode combinations? Assuming the 10-failure erasure is switched off -- a bad assumption, I know. Is there an additional slowdown after a lot of failed attempts?
• Synaesthesia 11y ago
  I always wondered why Apple took so much trouble with the secure enclave design, I thought it was really overkill, now I see it was really necessary for instances like this.
• joshcrawford 11y ago
  "For years, cryptologists and national security experts have been warning against weakening encryption. Doing so would hurt only the well-meaning and law-abiding citizens who rely on companies like Apple to protect their data. Criminals and bad actors will still encrypt, using tools that are readily available to them." Sounds just like gun control :)
• drawkbox 11y ago
  Apple is doing the right thing, the American way, which has been forgotten, that puts freedom over security. Thanks Apple, don't give in. Their 1984 anti Big Brother superbowl ad has finally come to fruition[1]. [1] https://www.youtube.com/watch?v=VtvjbmoDx-I https://www.youtube.com/watch?v=VtvjbmoDx-I
• plorg 11y ago
  If I understand correctly, any piece of software that would be used would need to be signed by Apple. Furthermore, the FBI's warrant(?) says specifically that it would only need to work for one device ID. Thus it would be relatively straightforward to create an update for the FBI that could pretty clearly only be used on the phone in question. Unless the FBI had Apple's signing key they could not reuse the software (assuming they couldn't break the bootloader chain of trust, which they apparently cannot if this is the route they are taking). Capability is not the grounds on which they are arguing. This is a very clearly political refusal. Apple is saying that about as explicitly as they can in this message. Whether or not they can do it, Apple doesn't want to be caught in the game of being a government surrogate or having to determine for themselves if government requests are legitimate (imagine, say, if the Chinese government asked for data from a dissident's phone - would Apple want to risk that market by denying a request that they have complied with in the US?). It's unfortunate for them that the FBI is making this request while people still own phones like the 5c for which they could theoretically disable security features, as opposed to the newer phones which it is possible they are completely unable to defeat.
  • return0 11y ago
    > would be relatively straightforward to create an update for the FBI that could pretty clearly only be used on the phone in question How? Wouldn't the FBI reverse engineer it? It seems like apple would have to update all phones to a new version (which would prevent the exploit provided to the FBI) before handing it to them.
    • plorg 11y ago
      It's not that reverse engineering is difficult - the FBI could theoretically do that now. It's that it needs to be signed to be accepted by the phone. Edit: see, for example, here: https://stratechery.com/2016/apple-versus-the-fbi-understanding-iphone-encryption-the-risks-for-apple-and-encryption/ https://stratechery.com/2016/apple-versus-the-fbi-understand...
• maxnaut 11y ago
  Many may hate Apple, however it's undeniable that they're so committed to user security.
• dfar1 11y ago
  I know that because this is on hacker news, everyone is talking about whether it's possible to access the data, and if possible... how easy or how hard it is. But the focus should be on the whether there should be a clear line/understanding between security and privacy, or should we keep everything black and white as it is now, just looking at extreme cases? If they cannot co-exist, I'd rather have more security and less privacy. But ideally, I shouldn't have to choose between them.
  • mcintyre1994 11y ago
    I don't really see how you propose to separate these though. If you have information about something you're planning that harms my personal security, there's always going to be a necessary tradeoff between your privacy and my security.
• larrymcp 11y ago
  To play devil's advocate: Mr. Cook expressed concern that "the government could intercept your messages, access your health records or financial data, track your location, or even access your phone's microphone or camera without your knowledge". As I read this I wondered, "what harm would actually happen if that occurred"? If the government did read my messages and get my health records & financial data and track my whereabouts, I can't think of anything bad that would actually happen as a result of that. Is there anything specific that I should be worried about in that scenario?
  • agentdrtran 11y ago
    "Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say"
• berkeleynerd 11y ago
  A friend of mine at Apple reported multiple Black Vehicles (Lincoln Town Cars and Escalades) with at least one having MD License Plates at the Apple Executive Briefing Center this morning between 11AM and Noon. Occupants had ear pieces and sun glasses and were accompanied by a CHP (California Highway Patrol) cruiser and three motorcycle escorts. I suppose it's possible this was a quick (less than 1 hour) VIP stop but given Tim's message last night, as well as the reaction of folks on campus who were bandying about comments like "I don't want to work on this or because I don't want to be deposed" the impression certainly was it was not a friendly visit. Given Tim's very public push-back I'd think delivery of an NSL with accompanying intimidation is at least possible. I submitted this HN and updated in real-time. There's a bit more discussion here: https://news.ycombinator.com/item?id=11120365 https://news.ycombinator.com/item?id=11120365
  • berkeleynerd 11y ago
    Just a follow-up to correct the record as much as possible. I believe this motorcade was related to the Prime Minister of Malaysia's visit to Apple per the following tweet. Hat tip to the redditor @frenvedd over on r/apple for this information! https://twitter.com/DelFazli/status/700133655444746241 https://twitter.com/DelFazli/status/700133655444746241
  • yung_badlady 11y ago
    What's intimidating about sun glasses and ear pieces?
    • rudolf0 11y ago
      Nothing. Bringing a bunch of special agents along with you to a meeting is intimidating, though. I suppose in their defense, they may be the particular agents working on the San Bernadino case, who arrived to explain exactly why they need the access or whatever.
      • yung_badlady 11y ago
        > Bringing a bunch of special agents along with you to a meeting is intimidating Again, what is intimidating about that? The agency they were dealing with was the FBI, right? And that's the correct agency to deal with this matter, right? Well in the FBI, 'special agent' simply means any worker who does investigatory work.
• SkidanovAlex 11y ago
  > People use them to store an incredible amount of personal information, from our private conversations to our photos, our music, our notes I wonder if this is a grammar mistake, or Apple actually considers the private conversations, nodes, photos to be theirs?
  • mcintyre1994 11y ago
    I think this is grammatically correct, Tim Cook is just identifying himself as part of the group that store personal information on their iPhone.
• la6470 11y ago
  Common good trumps individual privacy concerns. Apple created the lock that helped the bad guy ... Now as the locksmith they must produce the key. It is common sense. -20 for apple.
• rajacombinator 11y ago
  I can't recall any previous instance of a mega corporate opposing the tyrannical US Govt. I fully expect Apple to lose here but it is a valiant and rare effort.
• intrasight 11y ago
  And what happens to the engineer tasked with writing this hack if he fails and ends up bricking the phone?
• clarus 11y ago
  I think there are two orthogonal questions: * Does Apple pretend the FBI cannot access to its devices? * Can the FBI access to its devices? The only thing we learn here is the answer to the first question. We know nothing more for the second one.
• JoneyKing 11y ago
  Very important message!
• guylepage3 11y ago
  All of a sudden I'm starting to think my PiPhone is looking pretty good.
• muddi900 11y ago
  The court order was posted on HN hours before this letter and eother Tim Cook has not rrad the order or he's lying about the back door. What the court ordered was the removal of the auto-wipe.
• rcthompson 11y ago
  I see a lot of discussion about "Secure Enclave" and other hardware security features and such, and I'm not sure I see the relevance. Assuming that the data has already been properly encrypted, stored on disk, and purged from memory (by shutting down the phone) by a version of iOS that did not already contain a backdoor when the data was encrypted, there's no magic combination of hardware and software that can decrypt that data without the password, right? This seems to be supported by Apple's claim that the best they could possibly do is provide a channel for the FBI to brute force the password. So am I missing something that makes the iPhone's internal security architecture relevant here?
  • matthew-wegner 11y ago
    Yes. The target phone, an iPhone 5C, lacks a Secure Enclave. The password retry delay, and subsequent deletion of keys, is enforced by iOS here. Apple could provide some kind of software to allow for unlimited attempts (and an interface to do so in an automated way, which the FBI is specifically asking for). On newer phones, the Secure Enclave contains the keys, and enforces both the retry delay and the deletion of its contents. There isn't a way around this without also upgrading/flashing the SE system (and it isn't even clear if Apple can do this in a way that preserves the keys).
    • rcthompson 11y ago
      Ah, I see, so with newer hardware it wouldn't even be possible for Apple to enable brute forcing with a software update. But even with older hardware, presumably allowing brute forcing is still the worst they can do, right? (Assuming no prior backdoor exists.)
• atmosx 11y ago
  I thought Apple already had backdoors. I feel relieved that my iPhone is not backdoored and I'm also very happy for a company who's products I use daily.
• jwiley 11y ago
  So only Apple has the ability to do this...not the US government. So we trust Apple but not USG?
• p01926 11y ago
  Wow. This is the first HN submission to exceed 5,000 points! To honour Tim, and his advocacy for our industry, I'm going to spend the rest of my week developing privacy/security projects. I encourage everyone else to do likewise.
• Shivetya 11y ago
  Good for them. Freedom comes with a price, sometimes that price of freedom is protecting the privacy of the worst of us to protect all of us.
• ThrustVectoring 11y ago
  This is the sort of thing that a professional organization - like what medical doctors have - could help with. Let me explain. The court order gives Apple an out: "To the extent that Apple believes that compliance with this Order would be unreasonably burdensome, it may make an application to this Court for relief". Now, imagine if this was court ordering a company to engage in unethical medical procedures, rather than unethical software development. The professional medical community would sanction doctors that cooperated and support those that stood by their ethical principles and refused to cooperate. If there was a similar professional organization for software development, Apple could reasonably rebut that telling their engineers to work on this would be unreasonably expensive (since they'd expect to fire people or have them resign over it). This is another avenue for fighting the order - have a good chunk of Apple's engineering department sign an open letter saying that they'd resign before working on that project. The incentives seem like they'd work for making it a thing.
  • tarblog 11y ago
    Professional ethics of software engineering is definitely something we're going to have to grapple with more and more. Another aspect is being asked to use Dark Patterns in a UI or build a skinner box into a game or app. There's evidence that these things do harm to people and having a professional organization that could help stand up to such things could be part of a solution.
• mesozoic 11y ago
  And the government wonders why people from tech don't want to work for it.
• ratfacemcgee 11y ago
  I have never been more proud to have worked for Apple. Tim isn't afraid to give the government the old double forks when it counts!
• rloc 11y ago
  I feel like Apple is intentionally over simplifying it for the purpose of this letter or maybe to push back on the FBI ask more easily. Apple could propose to secure access to the FBI using the same level of security that it uses to protect the access to the phone content for the owner of the phone himself. Tim Cook only talks about one solution of a "tool" that it could install. If the same level (and method) of security is used then saying that there is a risk of the backdoor being hacked would be equivalent to saying that there is a similar risk of the user access being hacked.
  • thetruthseeker1 11y ago
    I dont know if there can be a practical solution based on what you said. If an FBI agent could do it, he could lose that methodology due to him getting hacked or he could do that on purpose with malicious intent( theoretically speaking).
• lisper 11y ago
  It is worth pointing out one salient fact: the phone in question did not belong to the shooter, it belonged to the shooter's employer, which in this case is the county government. That makes Apple's position much less tenable because the owner of the phone is (presumably) consenting to -- maybe even actively encouraging -- the recovery of the data.
• intrasight 11y ago
  Apple's OSs are closed and therefore inherently unsecure. When Apples caves, and they undoubtedly will, it will have the beneficial consequence of being a boon to open source communications software.
• danbmil99 11y ago
  Techie question: if Apple can compile a neutered version of iOS to bypass encryption, why can't a hacker (or US govt nerd) at least in theory reverse engineer iOS and patch it accordingly? (guess answer: iOS needs to be signed. So what they are really asking of Apple is to sign a lobotomized iOS image...)
• sandworm101 11y ago
  Google CEO Sundar Pichai has thrown in with Apple in a series of tweets explaining his position. https://twitter.com/sundarpichai https://twitter.com/sundarpichai
• fiatjaf 11y ago
  Cry, US Government!
• rubicon33 11y ago
  I hope apple employees + executives read this: I am now officially, an Apple fanboy. That's right, I'm gloating to family and friends, about how Apple is standing up to the man, doing the right thing, and refusing to compromise their security. Keep up the good fight.
• arel90 11y ago
  #)WATCH BOX OFFICE MOVIE NOW!! Find the Film click here MOVIE FREE https://t.co/nLGLMehTaI https://t.co/nLGLMehTaI & here TV MOVIE SHOWS https://t.co/zJWRHf75RF https://t.co/zJWRHf75RF *)My website provides a lot of movie box office include: Jurassic World Trailer (2015) The Stanford Prison Experiment Trailer (2015) Ex Machina Trailer (2015) Ant-Man Trailer (2015) The Wedding Ringer Trailer (2015) Child 44 Trailer (2015) Poltergeist Trailer (2015) Aloha Trailer (2015) Faith of Our Fathers Trailer (2015) Terminator Genisys Trailer (2015) Mad Max Fury Road Trailer (2015) Jupiter Ascending Trailer (2015) The Age of Adaline Trailer (2015) Cinderella Trailer (2015) The DUFF Trailer (2015) Entourage Trailer (2015) Danny Collins Trailer (2015) Bedlam Trailer (2015) Southpaw Trailer (2015) Little Boy Trailer (2015) Chappie Trailer (2015) Zon 261 Trailer (2015) Maggie Trailer (2015) Rage Midsummer's Eve Trailer (2015) Tomorrowland Trailer (2015) Anegan Trailer (2015) Ex-Free Trailer (2015) Insectula! Trailer (2015) Inside Out Trailer (2015) McFarland Trailer (2015) and many other box office movies
• illumin8 11y ago
  If you oppose this, please let President Obama know. The FBI is part of the executive branch of the government, and as such, directly reports to the president. In other words, if he tells them to stop, they must comply. Please register your complaint here: https://www.whitehouse.gov/contact https://www.whitehouse.gov/contact Here is my letter to them: Dear President Obama, I've voted for you in both elections, and have been a firm supporter on all your causes (affordable care act, and more). However, your FBI has clearly overstepped it's authority by demanding that Apple spend engineering resources building a software product that can break the encryption of a terrorist's iPhone. Seriously, you need to stop this. You are the head of the executive branch of the government, of which the FBI is directly underneath your jurisdiction. Director James Comey is directly within your chain of command. What the FBI is asking for is a master key to be created that can decrypt any iPhone. This makes all Americans with Apple devices insecure in the face of threats to our personal security and privacy. I hope you can understand that this is clearly unacceptable, and needs to be stopped. I want to register my complete opposition to the FBI in this circumstance. Please stop this. Thanks, xxxx
  • user9982 11y ago
    >Seriously, you need to stop this. You are the head of the executive branch of the government, of which the FBI is directly underneath your jurisdiction. Director James Comey is directly within your chain of command. You don't need to tell the man what he can do in his capacity as president, he knows what he can do. Identify the issue clearly and concisely, but don't try and tell him what he can and cannot do. Whether you intended that or not, that's how it comes across. > What the FBI is asking for is a master key to be created that can decrypt any iPhone. Not true, they're asking for a way to submit guesses electronically and removing the auto-wipe and 10 guess limit. If you are going to request help on an issue, ensure you know what you the issue is. I wouldn't send this message in, and I'd suggest you restructure what you're writing because this is simply not effective, and if other people begin sending the same message in it's going to make everyone who opposes this issue look misinformed with a superiority complex (that is how the entire second paragraph comes across).
    • 11y ago
• dang 11y ago
  This is now the most-upvoted story HN has ever had.
  • jey 11y ago
    And apparently #2 is also by Tim Cook? http://www.hntoplinks.com/all http://www.hntoplinks.com/all
    • dang 11y ago
      That's #4, behind 3078128 and 3742902 (though that one cheated).
• mirimir 11y ago
  It may well be that Cook's stand will soon become unworkable in the US. The US is always at war, after all, at least effectively. I wonder if Apple would just leave. It's already earning ~60% of revenue outside the US, after all. And hey, it's sitting on tons of offshore cash. Maybe it could build its own country on an unclaimed reef somewhere.
• cft 11y ago
  The numerical passcode is likely his ATM pin, or a code from his bank/PayPal or some such. I hope the government can simply subpoena his bank/PayPal etc and this will end at that.
• ezoe 11y ago
  It's almost certain that Apple helped American government to violate customer's privacy. It looks to me this is just a marketing stunt for post-Snowden revelation. If Apple cared customer's privacy and security so much, how could they sell non-free software that is hard to audit, computer with baseband processor, relies on central server which allows the single point of failure. My understanding is Apple customer don't much care about their own privacy and security but has weakness on marketing.
• thetruthseeker1 11y ago
  Are iphone hard disks (and the files within it) and cloud content encrypted based on this single private key that is stored in the secure enclave on iphone?
• joelbondurant 11y ago
  Tim Cook admits iOS is already back-doored in the most weaselly worded message I've ever seen.
• puppetmaster3 11y ago
  I'm a libertarian. But islamic terrorist phone is just evidence - Apple must unlock it for the FBI.
• iamshs 11y ago
  Cannot be more glad to see Apple's stand on this. Let's not forget what happened with Blackberry some 5 years ago. India, Saudi Arabia and UAE got monitoring ability on its platform:- 1)http://timesofindia.indiatimes.com/tech/tech-news/telecom/Government-BlackBerry-dispute-ends/articleshow/20998679.cms http://timesofindia.indiatimes.com/tech/tech-news/telecom/Go... 2) http://www.reuters.com/article/us-blackberry-saudi-idUSTRE6751Q220100810 http://www.reuters.com/article/us-blackberry-saudi-idUSTRE67... 3) http://www.thestar.com/business/2010/08/16/threats_of_blackberry_ban_in_india_saudi_arabia_echo_us_debate_on_encryption.html http://www.thestar.com/business/2010/08/16/threats_of_blackb...
• HighPlainsDrftr 11y ago
  This is ugly. If Apple can indeed break into the phone, they need to say, "We have to stop production now. All of our engineers will need to be behind this. It will cost us at least a billion dollars, if we can do it. We will miss deadlines for new products and software. Write us a check for $1 billion and we will start on it. We may need a few billion more. Write the check - we'll do what we can do. And lets hope we don't accidentally destroy the evidence doing it."
• satyajeet23 11y ago
  Dear Tim Cook, Thank you!
• NinoScript 11y ago
  Can't they dump the drive's data to protect it from being erased?
• bigolebutt666 11y ago
  Wouldn't one assume that once the phone is powered up there is some kind of code at startup or scheduled that would query an apple update server about updates,fixes,etc. At that point it is reasonable that a company such as Apple would force certain updates into the phone whether the customer wanted that or not? All Apple would have to do is direct the phone to a phoney update site containing code that would dump RAM to an outside server. No other phones would be affected and the data would be retrieved
• bigolebutt666 11y ago
  Wouldn't one assume that once the phone is powered up there is some kind of code at startup or scheduled that would query an apple update server about updates,fixes,etc. At that point it is reasonable that a company such as Apple would force certain updates into the phone whether the customer wanted that or not? All Apple would have to do is direct the phone to a phoney update site(for this IMEI only)containing code that would dump RAM to an outside server. No other phones would be affected and the data would be retrieved. World saved!