4 ms·

And in that case FBI will load their custom OS and open it. The entropy provided by the user in the apple current security solution is just too little for the d

And in that case FBI will load their custom OS and open it. The entropy provided by the user in the apple current security solution is just too little for the device to not be vulnerable. Apple tried to do it by providing also their own key, but that helps little when a dedicated agency has physical access to the device. And legal hammer to compel Apple to spill the beans.

vinceguidry 11y ago
This article explains the situation nicely: http://blog.trailofbits.com/2016/02/17/apple-can-comply-with-the-fbi-court-order/ http://blog.trailofbits.com/2016/02/17/apple-can-comply-with... The short answer is, Apple compensates for the low entropy of 4 digit PINs by rate-limiting the number of guesses you can make.
- venomsnake 11y ago
  But that is the root of the problem. Apple can control how the system is unlocked, they can update it, so they are able to circumvent their own measures. I wouldn't be surprised if they are able to do it with secure enclave too. So apple didn't provided their users security. They provided security with potential backdoor in the design. So I say - it is good if FBI can force apple to exploit their own backdoors - to learn their lesson.
  - vinceguidry 11y ago
    > They provided security with potential backdoor in the design. I'm not certain what you're asking for here. A device that is completely impregnable?
    - venomsnake 11y ago
      Depends on completely - but device that does not store critical encryption keys and allows users to set their master keys is a good start. The problem for apple is that every device that could be secured against malicious apple cannot be forced to be part of their walled garden. Or just some honest marketing. Like - your device is not secure if we cooperate with LEO and let consumer make their choice.
      - vinceguidry 11y ago
        I see. Never let profit stand in the way of principles. I can understand the appeal, even if I don't share it.

vinceguidry 11y ago

This article explains the situation nicely: http://blog.trailofbits.com/2016/02/17/apple-can-comply-with-the-fbi-court-order/ http://blog.trailofbits.com/2016/02/17/apple-can-comply-with... The short answer is, Apple compensates for the low entropy of 4 digit PINs by rate-limiting the number of guesses you can make.

venomsnake 11y ago
But that is the root of the problem. Apple can control how the system is unlocked, they can update it, so they are able to circumvent their own measures. I wouldn't be surprised if they are able to do it with secure enclave too. So apple didn't provided their users security. They provided security with potential backdoor in the design. So I say - it is good if FBI can force apple to exploit their own backdoors - to learn their lesson.
- vinceguidry 11y ago
  > They provided security with potential backdoor in the design. I'm not certain what you're asking for here. A device that is completely impregnable?
  - venomsnake 11y ago
    Depends on completely - but device that does not store critical encryption keys and allows users to set their master keys is a good start. The problem for apple is that every device that could be secured against malicious apple cannot be forced to be part of their walled garden. Or just some honest marketing. Like - your device is not secure if we cooperate with LEO and let consumer make their choice.
    - vinceguidry 11y ago
      I see. Never let profit stand in the way of principles. I can understand the appeal, even if I don't share it.