5 ms·

> The best way to prevent governments from oppressing their citizens is to refuse to create tools that enable oppression. Are search warrants oppressive? Can y

> The best way to prevent governments from oppressing their citizens is to refuse to create tools that enable oppression. Are search warrants oppressive? Can you distinguish this request from the FBI requesting a safe manufacturer modify the firmware on a single safe? I doubt either of these can be reliably argued.

JoeAltmaier 11y ago
That's the whole issue, isn't it? You can't create software that operates only on a single instance of a computer. It'll run on all of them.
- hahainternet 11y ago
  Apple could write code that checks the hardware ID supplied and sign only that version. It's been sufficient to prevent hacking so far and is the major protection relied upon until the latest generation, so I don't think this is an issue at all.
  - JoeAltmaier 11y ago
    ...and they give it to the FBI who then changes that ID as they please? Remove signing altogether? Its the fear of a blank check that drives this issue.
    - matthewmacleod 11y ago
      No – iOS is signed, and changing the ID would invalidate the signature.
      - creshal 11y ago
        And can Apple guarantee that the ID can't be changed inside the device? If they can't it makes a lot of sense for Apple to refuse creating such a tool.
        hahainternet 11y ago
        That guarantee until the latest generation was the only thing protecting the hardware. It has never been altered or hacked that I am aware of. Doing so would require modifying the physical construction of the chips on the device. Possible? Maybe, but if it was that simple the FBI could simply change the signing key. It's not, and they can't.
        matthewmacleod 11y ago
        Pretty much, as far as I'm aware; the device ID cannot be changed. Bear in mind that this entire discussion is applicable only to older iPhones, in any case.
        zaroth 11y ago
        The ID can be easily changed. A quick Google search will easily confirm this. The question is can you change one devices ID to exactly match another. This might require hacking the BPP or finding a SHA1 hash collision, both of which are absolutely possible but not necessarily trivial.
      - pdkl95 11y ago
        Taking the private key from Apple with a warrant, national security letter, subpoena, or other methods is much easier than creating a custom version of iOS. It is foolish to assume that the FBI would stop at this special version of iOS, especially given how they have been arguing and fighting to break encryption for over two decades. edit, on icebraining's interpretation: That's exactly right - once the difficult part about targeting an individual phone is finished, it's easy to take the iOS signing key and target any device you want.
        hahainternet 11y ago
        > Taking the private key from Apple with a warrant, national security letter, subpoena, or other methods is much easier than creating a custom version of iOS. Clearly it is not, otherwise they would have done this. They did not.
        icebraining 11y ago
        I think it's meant taking the key used to signed that custom version of iOS. That is, if the FBI can force Apple to write the custom version, they can also coerce the key from them to sign their own copies, preventing your suggested blocking mechanism. This is what I understood, at least, from the parent's post.
  - coleca 11y ago
    The issue is the precedent that is made. Once they create the special firmware, even if it is locked to one device, they have stated that law enforcement have already told them they have hundreds more devices they want unlocked. They would have a much easier time going to court and compelling Apple to resign the existing special firmware they made to work on these other hundreds of devices. Apple could no longer argue they had to create something to fulfill the warrant, since it was already created.
  - zaroth 11y ago
    From what I can tell the UDID lock is not actually secure enough and is not designed to be a critical path around the encryption algorithm. An earlier comment with more technical detail: https://news.ycombinator.com/item?id=11141499 https://news.ycombinator.com/item?id=11141499 UDID lock is good enough for tying development builds to specific devices but is not an unbreakable guarantee the software cannot be run on another device.
    - hahainternet 11y ago
      This comment simply makes claims like altering data in transit inside the architecture of the CPU. Yes, if you can do that, then you can flash anything to the phone. When someone shows me that happening, then I'll believe in this technology.
      - zaroth 11y ago
        No, I proposed 3 different ways of hacking the UDID in that comment. 1) disrupting the read of ECID in transit, 2) re-writing ECID by hacking the BPP, 3) a SHA1 hash collision. Any one of the 3 will do. Even then you cannot "flash anything" to the phone. But you can flash a build signed by Apple which hard-codes a UDID check.
        hahainternet 11y ago
        Wouldn't these mechanisms apply to key verification? How exactly can you argue that you can modify data in realtime inside the phone's architecture, but couldn't possibly modify data in realtime inside the phone's architecture?
        zaroth 11y ago
        Only certain parts of the hardware responsible for key storage and verification are architected to be resilient against physical and electronic attack, but the entire phone is not. For example changing the WiFi or Bluetooth MAC is not locked down and effects the UDID. Because the UDID was never intended to be a way to bypass the device encryption it was not designed with anywhere near the same level of care and sophistication as handling the encryption key itself.
- matthewmacleod 11y ago
  That's not the case – if Apple produce a signed iOS version that allows the passcode retry limit to be bypassed on a single device, then in what meaningful sense does it operate on another device?
  - JoeAltmaier 11y ago
    I guess when the FBI compels them again. Or once they have a foot in the door, compels them to remove the signing requirement, or wants their own ability to sign. This is not mysterious. Can the FBI require a software company to subvert their own security guarantees? Should they? Do bank vaults have back doors for the FBI?
    - matthewmacleod 11y ago
      I guess when the FBI compels them again That's a bit of a specious argument though – of course, if they produce different software in the future, it could be used again! If the FBI want their own ability to sign Apple updates, then that's obviously a different situation. But the point you were making – that it's not possible to write software that will run on only one device – is not true in this case. This is not mysterious. Can the FBI require a software company to subvert their own security guarantees? Should they? Do bank vaults have back doors for the FBI? I don't really know the right answer.
  - msbarnett 11y ago
    > if Apple produce a signed iOS version that allows the passcode retry limit to be bypassed on a single device, then in what meaningful sense does it operate on another device? What prevents the iOS image from being loaded onto another device? Apple isn't magic; the code they write to verify device identity isn't going to be the first perfect, unbuggy, unexploitable code written in human history. if(device_udid == terrorist_id) {...} might seem infallible, to you, but the reality is that the device_udid is just SHA1(Wifi MAC + Bluetooth MAC + ECID + Serial). All of those are writable, some via the Baseband and some via physical access. Generating SHA1 collisions is completely feasible for ~$1,000,000 of computing time, which is chump change to nation states. There is no infallible way for Apple to make an iOS version for one single device. Edit: And stories like http://abcnews.go.com/Technology/york-da-access-175-iphones-criminal-cases-due/story?id=37029693 http://abcnews.go.com/Technology/york-da-access-175-iphones-... make it absolutely clear that this is not stoping at a single device.
panarky 11y ago
> Are search warrants oppressive? A search warrant doesn't require me to create a new capability that did not exist before. From the FAQ: The digital world is very different from the physical world. In the physical world you can destroy something and it’s gone. But in the digital world, the technique, once created, could be used over and over again, on any number of devices... The only way to guarantee that such a powerful tool isn’t abused and doesn’t fall into the wrong hands is to never create it.
- hahainternet 11y ago
  > A search warrant doesn't require me to create a new capability that did not exist before. I don't see how that's relevant. If I invent a new kind of lock you've never seen before, you'll have to come up with a way to break it. I'm asking for why a search warrant would be oppressive, even if it involved creating new firmware for a safe.
  - uxp 11y ago
    > If I invent a new kind of lock you've never seen before, you'll have to come up with a way to break it. Why?
- otterley 11y ago
  > A search warrant doesn't require me to create a new capability that did not exist before. It might, depending on the analytical outcome of the three-factor test introduced in the _New York Telephone_ case. (This case was decided before compelled pen register assistance was prescribed by Congressional legislation.) The case itself is illustrative and enlightening: https://supreme.justia.com/cases/federal/us/434/159/case.html https://supreme.justia.com/cases/federal/us/434/159/case.htm... "The power conferred by the [All Writs] Act extends, under appropriate circumstances, to persons who, though not parties to the original action or engaged in wrongdoing, are in a position to frustrate the implementation of a court order or the proper administration of justice..." The factors are: (1) whether the third party is "so far removed as a third party from the underlying controversy that its assistance could not permissibly be compelled by the order of the court" (2) Whether the burden placed on the third party is "unreasonable" (3) Whether the assistance is "essential to the fulfillment of the purpose" of the warrant It's unfortunate that Hacker News isn't commented upon by more attorneys, and that most news articles don't link directly to the legal filings in these cases; much confusion and false assumptions about the law could be clarified.
arrty88 11y ago
What is it the fbi is after? What data exists only on the phone and no where else? Phone call, texts, or data logs? Subpoena the cell company or the ISP. Email? Subpoena the hosting provider. Any communications used on that phone traveled over the Internet, and the logs are most likely preserved. They could get all of the logs of outgoing requests from the cell company and then go to each service provider and demand dumps of data from any accounts that Phone logged into right?
- hahainternet 11y ago
  > They could get all of the logs of outgoing requests from the cell company and then go to each service provider and demand dumps of data from any accounts that Phone logged into right? The primary service provider being Apple, who operates a fully encrypted messaging system where the cleartext only ever exists on the device. It's a child abuser's wet dream.
  - arrty88 11y ago
    OK, but sometimes when I send iMessages, they actually send as SMS if my service is poor or the receivers service is poor, someone is in the subway, on a flight, etc etc. Chances are, this happened at least once over the lifetime of the terrorists ownership of the phone - thus we can at least see who they are communicating with, right? Wouldn't that be a good starting point? And call records - they must have called someone - if only to talk about the weather.
    - hahainternet 11y ago
      > Chances are, this happened at least once over the lifetime of the terrorists ownership of the phone - thus we can at least see who they are communicating with, right? Is that really acceptable to you? Maybe they accidentally screwed up once so it's OK to keep the private affairs of a dead terrorist secret for no good reason? > Wouldn't that be a good starting point? I would have thought the best starting point was unlocking the phone, given the owner is dead and committed horrific crimes.
bradleyjg 11y ago
What about all the conversations the terrorist had with his fellow terrorists in person? Is it an awful, terrible, no good thing that the FBI can't retrieve those conversations? Should we put in place ubiquitous video and audio surveillance in every square foot of the country just in case the FBI ever wants to review something that happened? It's not "going dark" that is an unprecedented change, it was the brief "going light" period that preceded it. Law enforcement has apparently lost the ability to do on the ground investigation work in favor of whiz bang-ery (and intelligence has lost the ability to do humint). Well, whiz bang-ery is a two way street. Now is the time to revive those old skills and deal with a _return_ to a world where you can't just outsource your job to a wire tap.

JoeAltmaier 11y ago

That's the whole issue, isn't it? You can't create software that operates only on a single instance of a computer. It'll run on all of them.

hahainternet 11y ago
Apple could write code that checks the hardware ID supplied and sign only that version. It's been sufficient to prevent hacking so far and is the major protection relied upon until the latest generation, so I don't think this is an issue at all.
- JoeAltmaier 11y ago
  ...and they give it to the FBI who then changes that ID as they please? Remove signing altogether? Its the fear of a blank check that drives this issue.
  - matthewmacleod 11y ago
    No – iOS is signed, and changing the ID would invalidate the signature.
    - creshal 11y ago
      And can Apple guarantee that the ID can't be changed inside the device? If they can't it makes a lot of sense for Apple to refuse creating such a tool.
      - hahainternet 11y ago
        That guarantee until the latest generation was the only thing protecting the hardware. It has never been altered or hacked that I am aware of. Doing so would require modifying the physical construction of the chips on the device. Possible? Maybe, but if it was that simple the FBI could simply change the signing key. It's not, and they can't.
      - matthewmacleod 11y ago
        Pretty much, as far as I'm aware; the device ID cannot be changed. Bear in mind that this entire discussion is applicable only to older iPhones, in any case.
      - zaroth 11y ago
        The ID can be easily changed. A quick Google search will easily confirm this. The question is can you change one devices ID to exactly match another. This might require hacking the BPP or finding a SHA1 hash collision, both of which are absolutely possible but not necessarily trivial.
    - pdkl95 11y ago
      Taking the private key from Apple with a warrant, national security letter, subpoena, or other methods is much easier than creating a custom version of iOS. It is foolish to assume that the FBI would stop at this special version of iOS, especially given how they have been arguing and fighting to break encryption for over two decades. edit, on icebraining's interpretation: That's exactly right - once the difficult part about targeting an individual phone is finished, it's easy to take the iOS signing key and target any device you want.
      - hahainternet 11y ago
        > Taking the private key from Apple with a warrant, national security letter, subpoena, or other methods is much easier than creating a custom version of iOS. Clearly it is not, otherwise they would have done this. They did not.
        icebraining 11y ago
        I think it's meant taking the key used to signed that custom version of iOS. That is, if the FBI can force Apple to write the custom version, they can also coerce the key from them to sign their own copies, preventing your suggested blocking mechanism. This is what I understood, at least, from the parent's post.
- coleca 11y ago
  The issue is the precedent that is made. Once they create the special firmware, even if it is locked to one device, they have stated that law enforcement have already told them they have hundreds more devices they want unlocked. They would have a much easier time going to court and compelling Apple to resign the existing special firmware they made to work on these other hundreds of devices. Apple could no longer argue they had to create something to fulfill the warrant, since it was already created.
- zaroth 11y ago
  From what I can tell the UDID lock is not actually secure enough and is not designed to be a critical path around the encryption algorithm. An earlier comment with more technical detail: https://news.ycombinator.com/item?id=11141499 https://news.ycombinator.com/item?id=11141499 UDID lock is good enough for tying development builds to specific devices but is not an unbreakable guarantee the software cannot be run on another device.
  - hahainternet 11y ago
    This comment simply makes claims like altering data in transit inside the architecture of the CPU. Yes, if you can do that, then you can flash anything to the phone. When someone shows me that happening, then I'll believe in this technology.
    - zaroth 11y ago
      No, I proposed 3 different ways of hacking the UDID in that comment. 1) disrupting the read of ECID in transit, 2) re-writing ECID by hacking the BPP, 3) a SHA1 hash collision. Any one of the 3 will do. Even then you cannot "flash anything" to the phone. But you can flash a build signed by Apple which hard-codes a UDID check.
      - hahainternet 11y ago
        Wouldn't these mechanisms apply to key verification? How exactly can you argue that you can modify data in realtime inside the phone's architecture, but couldn't possibly modify data in realtime inside the phone's architecture?
        zaroth 11y ago
        Only certain parts of the hardware responsible for key storage and verification are architected to be resilient against physical and electronic attack, but the entire phone is not. For example changing the WiFi or Bluetooth MAC is not locked down and effects the UDID. Because the UDID was never intended to be a way to bypass the device encryption it was not designed with anywhere near the same level of care and sophistication as handling the encryption key itself.
matthewmacleod 11y ago
That's not the case – if Apple produce a signed iOS version that allows the passcode retry limit to be bypassed on a single device, then in what meaningful sense does it operate on another device?
- JoeAltmaier 11y ago
  I guess when the FBI compels them again. Or once they have a foot in the door, compels them to remove the signing requirement, or wants their own ability to sign. This is not mysterious. Can the FBI require a software company to subvert their own security guarantees? Should they? Do bank vaults have back doors for the FBI?
  - matthewmacleod 11y ago
    I guess when the FBI compels them again That's a bit of a specious argument though – of course, if they produce different software in the future, it could be used again! If the FBI want their own ability to sign Apple updates, then that's obviously a different situation. But the point you were making – that it's not possible to write software that will run on only one device – is not true in this case. This is not mysterious. Can the FBI require a software company to subvert their own security guarantees? Should they? Do bank vaults have back doors for the FBI? I don't really know the right answer.
- msbarnett 11y ago
  > if Apple produce a signed iOS version that allows the passcode retry limit to be bypassed on a single device, then in what meaningful sense does it operate on another device? What prevents the iOS image from being loaded onto another device? Apple isn't magic; the code they write to verify device identity isn't going to be the first perfect, unbuggy, unexploitable code written in human history. if(device_udid == terrorist_id) {...} might seem infallible, to you, but the reality is that the device_udid is just SHA1(Wifi MAC + Bluetooth MAC + ECID + Serial). All of those are writable, some via the Baseband and some via physical access. Generating SHA1 collisions is completely feasible for ~$1,000,000 of computing time, which is chump change to nation states. There is no infallible way for Apple to make an iOS version for one single device. Edit: And stories like http://abcnews.go.com/Technology/york-da-access-175-iphones-criminal-cases-due/story?id=37029693 http://abcnews.go.com/Technology/york-da-access-175-iphones-... make it absolutely clear that this is not stoping at a single device.

panarky 11y ago

> Are search warrants oppressive? A search warrant doesn't require me to create a new capability that did not exist before. From the FAQ: The digital world is very different from the physical world. In the physical world you can destroy something and it’s gone. But in the digital world, the technique, once created, could be used over and over again, on any number of devices... The only way to guarantee that such a powerful tool isn’t abused and doesn’t fall into the wrong hands is to never create it.

hahainternet 11y ago
> A search warrant doesn't require me to create a new capability that did not exist before. I don't see how that's relevant. If I invent a new kind of lock you've never seen before, you'll have to come up with a way to break it. I'm asking for why a search warrant would be oppressive, even if it involved creating new firmware for a safe.
- uxp 11y ago
  > If I invent a new kind of lock you've never seen before, you'll have to come up with a way to break it. Why?
otterley 11y ago
> A search warrant doesn't require me to create a new capability that did not exist before. It might, depending on the analytical outcome of the three-factor test introduced in the _New York Telephone_ case. (This case was decided before compelled pen register assistance was prescribed by Congressional legislation.) The case itself is illustrative and enlightening: https://supreme.justia.com/cases/federal/us/434/159/case.html https://supreme.justia.com/cases/federal/us/434/159/case.htm... "The power conferred by the [All Writs] Act extends, under appropriate circumstances, to persons who, though not parties to the original action or engaged in wrongdoing, are in a position to frustrate the implementation of a court order or the proper administration of justice..." The factors are: (1) whether the third party is "so far removed as a third party from the underlying controversy that its assistance could not permissibly be compelled by the order of the court" (2) Whether the burden placed on the third party is "unreasonable" (3) Whether the assistance is "essential to the fulfillment of the purpose" of the warrant It's unfortunate that Hacker News isn't commented upon by more attorneys, and that most news articles don't link directly to the legal filings in these cases; much confusion and false assumptions about the law could be clarified.

arrty88 11y ago

What is it the fbi is after? What data exists only on the phone and no where else? Phone call, texts, or data logs? Subpoena the cell company or the ISP. Email? Subpoena the hosting provider. Any communications used on that phone traveled over the Internet, and the logs are most likely preserved. They could get all of the logs of outgoing requests from the cell company and then go to each service provider and demand dumps of data from any accounts that Phone logged into right?

hahainternet 11y ago
> They could get all of the logs of outgoing requests from the cell company and then go to each service provider and demand dumps of data from any accounts that Phone logged into right? The primary service provider being Apple, who operates a fully encrypted messaging system where the cleartext only ever exists on the device. It's a child abuser's wet dream.
- arrty88 11y ago
  OK, but sometimes when I send iMessages, they actually send as SMS if my service is poor or the receivers service is poor, someone is in the subway, on a flight, etc etc. Chances are, this happened at least once over the lifetime of the terrorists ownership of the phone - thus we can at least see who they are communicating with, right? Wouldn't that be a good starting point? And call records - they must have called someone - if only to talk about the weather.
  - hahainternet 11y ago
    > Chances are, this happened at least once over the lifetime of the terrorists ownership of the phone - thus we can at least see who they are communicating with, right? Is that really acceptable to you? Maybe they accidentally screwed up once so it's OK to keep the private affairs of a dead terrorist secret for no good reason? > Wouldn't that be a good starting point? I would have thought the best starting point was unlocking the phone, given the owner is dead and committed horrific crimes.

bradleyjg 11y ago

What about all the conversations the terrorist had with his fellow terrorists in person? Is it an awful, terrible, no good thing that the FBI can't retrieve those conversations? Should we put in place ubiquitous video and audio surveillance in every square foot of the country just in case the FBI ever wants to review something that happened? It's not "going dark" that is an unprecedented change, it was the brief "going light" period that preceded it. Law enforcement has apparently lost the ability to do on the ground investigation work in favor of whiz bang-ery (and intelligence has lost the ability to do humint). Well, whiz bang-ery is a two way street. Now is the time to revive those old skills and deal with a _return_ to a world where you can't just outsource your job to a wire tap.