7 ms·

If it is malice - the order for Apple to help should be reversed. If it is incompetence then that bolsters the argument that any backdoor will lead to leaks and

If it is malice - the order for Apple to help should be reversed. If it is incompetence then that bolsters the argument that any backdoor will lead to leaks and unauthorized access to the backdoor, causing more harm to everyone.

a3n 11y ago
We fucked up the front door, but we totally won't fuck up the back door.
- WalterSear 11y ago
  And we can totally be trusted not to share your house keys with anyone.
  - a3n 11y ago
    Indeed. The best way to not have information stolen is to not have it, and particularly not have with someone proven to be incapable of security. http://www.softwar.net/stupid.html http://www.softwar.net/stupid.html EDIT: add after the comma.
- Cartwright2 11y ago
  > We fucked up the front door, but we totally won't fuck up the back door. This is the most apt summary of this whole situation. I expect to see a family-friendly version of this phrase in the media over the coming days.
rhino369 11y ago
>If it is incompetence then that bolsters the argument that any backdoor will lead to leaks and unauthorized access to the backdoor, causing more harm to everyone. The backdoor the FBI wants to exploit cannot be leaked. They are specifically requesting it be limited to the specific phone. If it were possible to take an apple update, edit it, and then apply to other phones, they wouldn't need Apple's help.
- specialist 11y ago
  You're describing a rootkit. What could possibly go wrong? No way that would ever get released into the wild. Once proven feasible, no way any one else would reverse engineer stuff and make their own.
  - teacup50 11y ago
    Proven feasible? We already know it's feasible. It's dead simple to binary patch the code -- but you need Apple's signing key to make it work. If you're worried about Apple's signing key being released into the wild, this one-off backdoor ought to be the least of your concerns.
    - specialist 11y ago
      My metaphor is likely wrong. Like the apologists for the FBI (and other enablers of authoritarians), I'm trying to gleen the real technical story from the public misinformation. You may know about FileVault's password protected volumes. https://en.wikipedia.org/wiki/FileVault https://en.wikipedia.org/wiki/FileVault Does the (pre-Secure Enclave) iPhone 5C which the FBI borked store its data the same way? I now believe that by changing the password, the FBI also borked (lost) the recovery key, so now neither the iPhone nor its backups are readable. You and the FBI want Apple to create a one-off patch to better crack the keys of an encrypted file, presumably one of the iCloud backups. Um, good luck with that. If you know better, please clarify with your understanding of the actual systems in use, vs arm waving apologia.
      - teacup50 11y ago
        If you want to talk about "enablers of authoritarians", consider that Apple has built a system in which they are the sole authority, that is opaque to all introspection by third parties, and against which Apple -- and only Apple -- must protect their users against all comers, for all time. In addition to which, our security relies on Apple themselves never changing their business priorities and choosing to exploit their position of absolute authority. The fact that they have that authority is why the government can compel them to do anything in the first place. If you want to talk technical specifics, then no, your assessment is incorrect. The Apple ID password was changed, but that doesn't affect the on-device keying. PIN numbers are the weakest link in the iPhone crypto chain. Apple strengthened that link through non-cryptographic means: tamper-resistent key derivation software that either runs on the main CPU, or in later devices, on the secure enclave CPU. That software enforces a limited number of retries, essentially strengthening the PIN number. However, Apple also retained the ability to subvert the owner's lock on the device and install new key derivation code that does not include those security features; this applies to both the 5c and later devices with secure enclave. If Apple hadn't retained that backdoor, the FBI would have nothing to ask for. Apple has, however, and has consistently made themselves the sole authority and gatekeeper of these devices.

a3n 11y ago

We fucked up the front door, but we totally won't fuck up the back door.

WalterSear 11y ago
And we can totally be trusted not to share your house keys with anyone.
- a3n 11y ago
  Indeed. The best way to not have information stolen is to not have it, and particularly not have with someone proven to be incapable of security. http://www.softwar.net/stupid.html http://www.softwar.net/stupid.html EDIT: add after the comma.
Cartwright2 11y ago
> We fucked up the front door, but we totally won't fuck up the back door. This is the most apt summary of this whole situation. I expect to see a family-friendly version of this phrase in the media over the coming days.

rhino369 11y ago

>If it is incompetence then that bolsters the argument that any backdoor will lead to leaks and unauthorized access to the backdoor, causing more harm to everyone. The backdoor the FBI wants to exploit cannot be leaked. They are specifically requesting it be limited to the specific phone. If it were possible to take an apple update, edit it, and then apply to other phones, they wouldn't need Apple's help.

specialist 11y ago
You're describing a rootkit. What could possibly go wrong? No way that would ever get released into the wild. Once proven feasible, no way any one else would reverse engineer stuff and make their own.
- teacup50 11y ago
  Proven feasible? We already know it's feasible. It's dead simple to binary patch the code -- but you need Apple's signing key to make it work. If you're worried about Apple's signing key being released into the wild, this one-off backdoor ought to be the least of your concerns.
  - specialist 11y ago
    My metaphor is likely wrong. Like the apologists for the FBI (and other enablers of authoritarians), I'm trying to gleen the real technical story from the public misinformation. You may know about FileVault's password protected volumes. https://en.wikipedia.org/wiki/FileVault https://en.wikipedia.org/wiki/FileVault Does the (pre-Secure Enclave) iPhone 5C which the FBI borked store its data the same way? I now believe that by changing the password, the FBI also borked (lost) the recovery key, so now neither the iPhone nor its backups are readable. You and the FBI want Apple to create a one-off patch to better crack the keys of an encrypted file, presumably one of the iCloud backups. Um, good luck with that. If you know better, please clarify with your understanding of the actual systems in use, vs arm waving apologia.
    - teacup50 11y ago
      If you want to talk about "enablers of authoritarians", consider that Apple has built a system in which they are the sole authority, that is opaque to all introspection by third parties, and against which Apple -- and only Apple -- must protect their users against all comers, for all time. In addition to which, our security relies on Apple themselves never changing their business priorities and choosing to exploit their position of absolute authority. The fact that they have that authority is why the government can compel them to do anything in the first place. If you want to talk technical specifics, then no, your assessment is incorrect. The Apple ID password was changed, but that doesn't affect the on-device keying. PIN numbers are the weakest link in the iPhone crypto chain. Apple strengthened that link through non-cryptographic means: tamper-resistent key derivation software that either runs on the main CPU, or in later devices, on the secure enclave CPU. That software enforces a limited number of retries, essentially strengthening the PIN number. However, Apple also retained the ability to subvert the owner's lock on the device and install new key derivation code that does not include those security features; this applies to both the 5c and later devices with secure enclave. If Apple hadn't retained that backdoor, the FBI would have nothing to ask for. Apple has, however, and has consistently made themselves the sole authority and gatekeeper of these devices.