4 ms·
Similarly, you could reasonably argue that if there is a master key in this situation, it is Apple's firmware signing key, which the company already possess and
by plorg 11y ago
Similarly, you could reasonably argue that if there is a master key in this situation, it is Apple's firmware signing key, which the company already possess and has been using as a consequence of its inadequately examined security model.
Edit: LOL, downvotes because you don't like it. Apple made a bad design decision, and it's coming to bite them in the ass. Yeah, it sucks, but I'm not the one who designed the backdoor. Blame the corporate culture, not the messenger. Fix the problem and tell your customers about it. Don't pretend it doesn't exist.
- rtpg 11y agoYes, Apple's signing key + the lack of user confirmation for OS updates is the master key + backdoor here. User confirmation has come in later OS updates it seems, so the actual backdoor has been closed.
- plorg 11y agoThat's good to hear.
- mindslight 11y agoThere's nothing to argue. Apple's key is a designed-in backdoor, and this case is about whether they can be compelled to use it. The right thing would have been for Apple to unlock the phone in question, and issue a security advisory for the longstanding but newly-relevant vulnerability. Then, if they want their devices to be secure against USG, actually fix their security model to remove their own privilege. Instead, they walked right into the FBI's trap on a completely unsympathetic case. They're setting us up for a horrible precedent simply to continue pretending they can provide a level of security that they didn't actually build.