5 ms·

> Tim Cook is the only one doing the right thing here. Because it was Tim Cook who was dragged into this mess. What if the shooter had an Android phone, rather

> Tim Cook is the only one doing the right thing here. Because it was Tim Cook who was dragged into this mess. What if the shooter had an Android phone, rather than an iPhone? I'm sure Lary Page would be penning a similar letter, in that situation.

vinceguidry 11y ago
Hah, that's a laugh. If it were an Android phone, the feds wouldn't have had to call anyone. They'd have just broken the device's security and gotten what they wanted. Only Apple takes security seriously.
- wosos 11y ago
  Sad but true
- davidamarquis 11y ago
  This is a recent development. Apple only started to care about iOS security around 2012 for example.
  - vinceguidry 11y ago
    At least someone is.
  - mixmastamyk 11y ago
    In a complex system great security takes years of work, it isn't flipped on like a light switch in v1.0. Wasn't the first version of iOS running as the root user?
  - 05 11y ago
    Oh really? iOS has page-based executable code hash/signing since at least iOS 2 (2008); Android still doesn't have any runtime code integrity protections.
    - jayd16 11y ago
      Of all the random security issues in the past 8 years you'd be hard pressed to find one where this was relevant.
- venomsnake 11y ago
  This is one of those citations needed statements. I have played with cyanogen with LUKS, luks nuke (a simple password that destroys the keys), firewall and tor without google services. And you can even make yourself a dead man's switch that will erase the keys dd if=/dev/zero - you know the drill if some condition is not met. The best part - even if google can make custom version of the OS it won't help the least. It is a tough nut to crack.
  - vinceguidry 11y ago
    Of course you can secure your own device yourself. But if you buy Apple you won't have to.
    - venomsnake 11y ago
      And in that case FBI will load their custom OS and open it. The entropy provided by the user in the apple current security solution is just too little for the device to not be vulnerable. Apple tried to do it by providing also their own key, but that helps little when a dedicated agency has physical access to the device. And legal hammer to compel Apple to spill the beans.
      - vinceguidry 11y ago
        This article explains the situation nicely: http://blog.trailofbits.com/2016/02/17/apple-can-comply-with-the-fbi-court-order/ http://blog.trailofbits.com/2016/02/17/apple-can-comply-with... The short answer is, Apple compensates for the low entropy of 4 digit PINs by rate-limiting the number of guesses you can make.
        venomsnake 11y ago
        But that is the root of the problem. Apple can control how the system is unlocked, they can update it, so they are able to circumvent their own measures. I wouldn't be surprised if they are able to do it with secure enclave too. So apple didn't provided their users security. They provided security with potential backdoor in the design. So I say - it is good if FBI can force apple to exploit their own backdoors - to learn their lesson.
- mintplant 11y ago
  I would wager that the FBI and CIA are technically capable of breaking the security on this phone. This is likely more about setting legal precedent via a case that is very much in the public eye.
  - vinceguidry 11y ago
    I very much doubt that. These agencies are very capable of operating outside of the law if it will get the job done. All a stunt like this does is raise public awareness, limiting their options. They wouldn't do that unless they couldn't get it done via other means. Only the fact that this is a terror case makes them willing to roll the dice at all on the craps table of public opinion. It gives them an advantage, but not an overwhelming one.
    - mahyarm 11y ago
      Well for a million + they could delaminate the chips and read the private keys off them in a painstaking way.
      - snowwrestler 11y ago
        But that is incredibly risky; it would be easy to make a mistake, and if they do, the information is gone forever, which is the worst case scenario for them. I absolutely believe that the FBI thinks this is the only way to get this data. Yes, they might like to get a strong precedent in favor of this, but what if the precedent goes against them? You never know what you're going to get in court. This would be appealed to the 9th Circuit, which has a history of being skeptical of government arguments in favor of collecting digital data. And if the Supreme Court deadlocks 4-4 (as it could now), the appellate ruling would stand.
        jsprogrammer 11y ago
        It seems like many people don't get the concept of evidence preservation. Apple put in a feature, which they may circumvent, that will effectively brick the device if it is tampered in certain ways. The lowest risk option for retrieving the data is to get the people who designed the device to implement their circumvention method. That is exactly what the FBI asked for and what the judge agreed to. Why should the FBI have to waste resources reverse engineering Apple's product (and risk destruction of evidence) when Apple is wholly capable of helping out?
- JustSomeNobody 11y ago
  Yeah! That's why you can't even jailbreak every single one of their phones!

vinceguidry 11y ago

Hah, that's a laugh. If it were an Android phone, the feds wouldn't have had to call anyone. They'd have just broken the device's security and gotten what they wanted. Only Apple takes security seriously.

wosos 11y ago
Sad but true
davidamarquis 11y ago
This is a recent development. Apple only started to care about iOS security around 2012 for example.
- vinceguidry 11y ago
  At least someone is.
- mixmastamyk 11y ago
  In a complex system great security takes years of work, it isn't flipped on like a light switch in v1.0. Wasn't the first version of iOS running as the root user?
- 05 11y ago
  Oh really? iOS has page-based executable code hash/signing since at least iOS 2 (2008); Android still doesn't have any runtime code integrity protections.
  - jayd16 11y ago
    Of all the random security issues in the past 8 years you'd be hard pressed to find one where this was relevant.
venomsnake 11y ago
This is one of those citations needed statements. I have played with cyanogen with LUKS, luks nuke (a simple password that destroys the keys), firewall and tor without google services. And you can even make yourself a dead man's switch that will erase the keys dd if=/dev/zero - you know the drill if some condition is not met. The best part - even if google can make custom version of the OS it won't help the least. It is a tough nut to crack.
- vinceguidry 11y ago
  Of course you can secure your own device yourself. But if you buy Apple you won't have to.
  - venomsnake 11y ago
    And in that case FBI will load their custom OS and open it. The entropy provided by the user in the apple current security solution is just too little for the device to not be vulnerable. Apple tried to do it by providing also their own key, but that helps little when a dedicated agency has physical access to the device. And legal hammer to compel Apple to spill the beans.
    - vinceguidry 11y ago
      This article explains the situation nicely: http://blog.trailofbits.com/2016/02/17/apple-can-comply-with-the-fbi-court-order/ http://blog.trailofbits.com/2016/02/17/apple-can-comply-with... The short answer is, Apple compensates for the low entropy of 4 digit PINs by rate-limiting the number of guesses you can make.
      - venomsnake 11y ago
        But that is the root of the problem. Apple can control how the system is unlocked, they can update it, so they are able to circumvent their own measures. I wouldn't be surprised if they are able to do it with secure enclave too. So apple didn't provided their users security. They provided security with potential backdoor in the design. So I say - it is good if FBI can force apple to exploit their own backdoors - to learn their lesson.
mintplant 11y ago
I would wager that the FBI and CIA are technically capable of breaking the security on this phone. This is likely more about setting legal precedent via a case that is very much in the public eye.
- vinceguidry 11y ago
  I very much doubt that. These agencies are very capable of operating outside of the law if it will get the job done. All a stunt like this does is raise public awareness, limiting their options. They wouldn't do that unless they couldn't get it done via other means. Only the fact that this is a terror case makes them willing to roll the dice at all on the craps table of public opinion. It gives them an advantage, but not an overwhelming one.
  - mahyarm 11y ago
    Well for a million + they could delaminate the chips and read the private keys off them in a painstaking way.
    - snowwrestler 11y ago
      But that is incredibly risky; it would be easy to make a mistake, and if they do, the information is gone forever, which is the worst case scenario for them. I absolutely believe that the FBI thinks this is the only way to get this data. Yes, they might like to get a strong precedent in favor of this, but what if the precedent goes against them? You never know what you're going to get in court. This would be appealed to the 9th Circuit, which has a history of being skeptical of government arguments in favor of collecting digital data. And if the Supreme Court deadlocks 4-4 (as it could now), the appellate ruling would stand.
      - jsprogrammer 11y ago
        It seems like many people don't get the concept of evidence preservation. Apple put in a feature, which they may circumvent, that will effectively brick the device if it is tampered in certain ways. The lowest risk option for retrieving the data is to get the people who designed the device to implement their circumvention method. That is exactly what the FBI asked for and what the judge agreed to. Why should the FBI have to waste resources reverse engineering Apple's product (and risk destruction of evidence) when Apple is wholly capable of helping out?
JustSomeNobody 11y ago
Yeah! That's why you can't even jailbreak every single one of their phones!