4 ms·

"Remember: Any time you introduce an access point for a trusted third party, you inevitably end up allowing access to anybody." See also: http://www.apple.com/

"Remember: Any time you introduce an access point for a trusted third party, you inevitably end up allowing access to anybody." See also: http://www.apple.com/customer-letter/ http://www.apple.com/customer-letter/ :)

m52go 11y ago
I came back here to post this line! It's so perfect.
elaineo 11y ago
Haha! Thanks for catching that :)
melted 11y ago
Except of course what FBI is proposing wouldn't give access to "anybody". Just unfettered access for FBI, CIA and NSA by way of gag orders and national security letters, forcing Apple to break security of their hardware and not speak about it publicly. Of note is the fact that it wouldn't even give direct access to FBI, since they don't have the firmware keys (yet).
- interpol_p 11y ago
  Yeah but if you don't trust those companies to be secure and to maintain that security throughout all their employees and contractors (see: Snowden). Then you must assume giving someone access is the same as giving everyone access.
- kbenson 11y ago
  In this example, the FBI is the "trusted third party", but by giving them access, we inevitably open access for everyone, as the system is no longer strongly secure. The trusted third party in the quote isn't asking for access for everybody either, but in the end that's what happens.
  - melted 11y ago
    Apple isn't giving access. Apple would be required (by court, unless they manage to fight this off) to install a signed custom build of the OS in order to give access to that particular device. FBI would not have this build, nor a key to create their own signed custom build.
    - lox 11y ago
      Yup, that's the FBI's pitch. The issue is that it sets a legal precedent as well as potentially leaking a backdoored iOS to the world. Yes I know "signed for a specific device", best of luck with that.
matheweis 11y ago
I was going to post here that there were ways around that; proper security, cryptographic access control... And then I saw the light. ;)
NKCSS 11y ago
Google also specifies the ip ranges of their boys; just UA checking is sloppy
- queeerkopf 11y ago
  Hmmm, the following seems to contradict that; instead google recommends verification by DNS lookup: https://support.google.com/webmasters/answer/80553 https://support.google.com/webmasters/answer/80553 'Google doesn't post a public list of IP addresses for webmasters to whitelist. This is because these IP address ranges can change, causing problems for any webmasters who have hard-coded them, so you must run a DNS lookup as described next.'
  - NKCSS 11y ago
    Ah, they must have changed that the ; last time I checked (few years ago) they listed IPv4 adddresses.
  - trasc 11y ago
    If anyone can tell me how to embed this particular DNS query into a firewall appliance ACL, please let me know. I have customers with Watchguard and Cisco gear who have intermittent trouble with Google's mail relay (formerly Postini). The solution is always to perform that record lookup and add the new IP address blocs.

m52go 11y ago

I came back here to post this line! It's so perfect.

elaineo 11y ago

Haha! Thanks for catching that :)

melted 11y ago

Except of course what FBI is proposing wouldn't give access to "anybody". Just unfettered access for FBI, CIA and NSA by way of gag orders and national security letters, forcing Apple to break security of their hardware and not speak about it publicly. Of note is the fact that it wouldn't even give direct access to FBI, since they don't have the firmware keys (yet).

interpol_p 11y ago
Yeah but if you don't trust those companies to be secure and to maintain that security throughout all their employees and contractors (see: Snowden). Then you must assume giving someone access is the same as giving everyone access.
kbenson 11y ago
In this example, the FBI is the "trusted third party", but by giving them access, we inevitably open access for everyone, as the system is no longer strongly secure. The trusted third party in the quote isn't asking for access for everybody either, but in the end that's what happens.
- melted 11y ago
  Apple isn't giving access. Apple would be required (by court, unless they manage to fight this off) to install a signed custom build of the OS in order to give access to that particular device. FBI would not have this build, nor a key to create their own signed custom build.
  - lox 11y ago
    Yup, that's the FBI's pitch. The issue is that it sets a legal precedent as well as potentially leaking a backdoored iOS to the world. Yes I know "signed for a specific device", best of luck with that.

matheweis 11y ago

I was going to post here that there were ways around that; proper security, cryptographic access control... And then I saw the light. ;)

NKCSS 11y ago

Google also specifies the ip ranges of their boys; just UA checking is sloppy

queeerkopf 11y ago
Hmmm, the following seems to contradict that; instead google recommends verification by DNS lookup: https://support.google.com/webmasters/answer/80553 https://support.google.com/webmasters/answer/80553 'Google doesn't post a public list of IP addresses for webmasters to whitelist. This is because these IP address ranges can change, causing problems for any webmasters who have hard-coded them, so you must run a DNS lookup as described next.'
- NKCSS 11y ago
  Ah, they must have changed that the ; last time I checked (few years ago) they listed IPv4 adddresses.
- trasc 11y ago
  If anyone can tell me how to embed this particular DNS query into a firewall appliance ACL, please let me know. I have customers with Watchguard and Cisco gear who have intermittent trouble with Google's mail relay (formerly Postini). The solution is always to perform that record lookup and add the new IP address blocs.