6 ms·

I'm actually wondering this, too. Is there a technological reason why Apple fulfilling this request makes their (not subject-to-warrant) customers less secure?

I'm actually wondering this, too. Is there a technological reason why Apple fulfilling this request makes their (not subject-to-warrant) customers less secure? Why isn't their private code-signing key the linchpin? I fully buy that there are legal, cultural, and diplomatic reasons that this could make Apple's customers less secure in the long run by setting a precedent, etc. I guess one argument is that whatever code they write to tie the "weaponized" iOS update to a particular device could have bugs.

JoeAltmaier 11y ago
It won't have 'bugs'. It'll be written to allow FBI access at will. That's the next step, right?
- twoodfin 11y ago
  Access to a single device. Access to other device would (if the "weaponized" iOS is written correctly in this regard) be impossible without Apple's private key to authenticate a modified version of the software.
  - JoeAltmaier 11y ago
    Which is one subpoena away.
    - twoodfin 11y ago
      Well, that's the ballgame no matter what Apple does right now.
      - studentrob 11y ago
        There's still the question whether or not government can compel a software company to weaken its own security policy. That will have a significant impact on the future of the US tech industry, world innovation, and the advancement of the human race.
tptacek 11y ago
It won't make phones less secure in any technological sense. Defeating the 5C's passcode counter is a capability Apple has today, and DOJ is willing to allow Apple to bypass it on Apple's own premises rather than providing DOJ with an image that does it. The kind of insecurity people are talking about is a policy concern; people will feel less secure if Apple can be compelled to exploit their capability this way. That's a valid concern, but it's not a concern that really touches on how much more the "token IT person" knows than a layperson with little technical knowledge. It annoys me a lot when people in technology deploy special- pleading logic like this.
- harryh 11y ago
  I think it has to do with a kind of black and white thinking that is common with people in technology. 2+2=4. 2+2!=5. Your code either compiles or it doesn't. A function is either correct or incorrect. It is either acceptable for Apple to bypass a security feature or it is unacceptable. Tech people seem to have a real hard time with the idea that: A) It might be acceptable some of time time but not others B) There are competing values at play here and even if we decide it's (un)acceptable there are some downsides to either choice.
- drewcrawford 11y ago
  You're drawing a false dichotomy when you talk about technology and policy as separate issues. If you are unable to overhear my encrypted messages, were you stopped by the technology of the Salsa20 algorithm or my policy of not giving you the keys? Or were you stopped by the government's policy of not compelling their production for you? Maybe you were stopped by your own policy of not beating people with rubber hoses? In the hypothetical that Apple did not have the capability to defeat the 5C's passcode counter, is the FBI thwarted because of a technically secure cryptosystem or because it is the policy in the United States to allow such cryptosystems to be marketed and sold? Policy and technology do not exist in a vacuum. Apple is obviously going to close the custom image loophole in response to this "debate"; so clearly the boundary between technology and policy is fluid. But merely taping a policy out for silicon, as Apple is going to do in the next chip, does not address any of the underlying issues. Sure, in the instant case Apple "technically can" unlock the iPhone, but that is always true: we could create a law such that all phones must be backdoored for example. Assuming Apple loses here, mark your calendar, because we'll have that battle next year when a terrorist uses the new silicon. There is a line somewhere for what is reasonable to compel. Reasonable people can disagree about where that line is, but let's not paint "people in technology" with a broad patronizing brush of "it's not technology, it's policy, therefore your rules don't apply". Technology is merely policy that's machine-readible.

JoeAltmaier 11y ago

It won't have 'bugs'. It'll be written to allow FBI access at will. That's the next step, right?

twoodfin 11y ago
Access to a single device. Access to other device would (if the "weaponized" iOS is written correctly in this regard) be impossible without Apple's private key to authenticate a modified version of the software.
- JoeAltmaier 11y ago
  Which is one subpoena away.
  - twoodfin 11y ago
    Well, that's the ballgame no matter what Apple does right now.
    - studentrob 11y ago
      There's still the question whether or not government can compel a software company to weaken its own security policy. That will have a significant impact on the future of the US tech industry, world innovation, and the advancement of the human race.

tptacek 11y ago

It won't make phones less secure in any technological sense. Defeating the 5C's passcode counter is a capability Apple has today, and DOJ is willing to allow Apple to bypass it on Apple's own premises rather than providing DOJ with an image that does it. The kind of insecurity people are talking about is a policy concern; people will feel less secure if Apple can be compelled to exploit their capability this way. That's a valid concern, but it's not a concern that really touches on how much more the "token IT person" knows than a layperson with little technical knowledge. It annoys me a lot when people in technology deploy special- pleading logic like this.

harryh 11y ago
I think it has to do with a kind of black and white thinking that is common with people in technology. 2+2=4. 2+2!=5. Your code either compiles or it doesn't. A function is either correct or incorrect. It is either acceptable for Apple to bypass a security feature or it is unacceptable. Tech people seem to have a real hard time with the idea that: A) It might be acceptable some of time time but not others B) There are competing values at play here and even if we decide it's (un)acceptable there are some downsides to either choice.
drewcrawford 11y ago
You're drawing a false dichotomy when you talk about technology and policy as separate issues. If you are unable to overhear my encrypted messages, were you stopped by the technology of the Salsa20 algorithm or my policy of not giving you the keys? Or were you stopped by the government's policy of not compelling their production for you? Maybe you were stopped by your own policy of not beating people with rubber hoses? In the hypothetical that Apple did not have the capability to defeat the 5C's passcode counter, is the FBI thwarted because of a technically secure cryptosystem or because it is the policy in the United States to allow such cryptosystems to be marketed and sold? Policy and technology do not exist in a vacuum. Apple is obviously going to close the custom image loophole in response to this "debate"; so clearly the boundary between technology and policy is fluid. But merely taping a policy out for silicon, as Apple is going to do in the next chip, does not address any of the underlying issues. Sure, in the instant case Apple "technically can" unlock the iPhone, but that is always true: we could create a law such that all phones must be backdoored for example. Assuming Apple loses here, mark your calendar, because we'll have that battle next year when a terrorist uses the new silicon. There is a line somewhere for what is reasonable to compel. Reasonable people can disagree about where that line is, but let's not paint "people in technology" with a broad patronizing brush of "it's not technology, it's policy, therefore your rules don't apply". Technology is merely policy that's machine-readible.