6 ms·

> This FAQ has more than 1000 words, but these are the words that matter: > > The only way to guarantee that such a powerful tool isn’t abused and doesn’t fall

by zeveb 11y ago

> This FAQ has more than 1000 words, but these are the words that matter: > > The only way to guarantee that such a powerful tool isn’t abused and doesn’t fall into the wrong hands is to never create it. And of course, that's also wrong. The only way to guarantee that such a powerful tool isn't abused it and doesn't fall into the wrong hands is to make it impossible for such a tool to exist, not to refuse to create it. Right now, today, Apple has the ability to create such a tool. Some finite number of human beings at Apple have the ability to create such a tool on their own initiative, e.g. were they disgruntled. It should be impossible for Apple, or disgruntled Apple employees, or any nation state, to create such a tool. Otherwise, it will eventually be created, because if something is possible then is eventually probable.

panarky 11y ago
Naturally "can't create" is better than "won't create", but this case is about the precedent and not this particular iPhone. If a court can force a company to create new technology that didn't exist before, what other tools might they be forced to build? 1) Stream keystrokes, audio, video, location to law enforcement prior to encryption 2) Replace actual search results with government-approved results 3) Force Apple to create target lists of suspects based on their location, apps installed, sites visited, keywords typed Bad things happen when the government can force private companies and individuals to create new tools for law enforcement. There is no technology that prevents Apple from subverting Apple's security. If Apple loses, the new precedent could open Pandora's box.
- dangirsh 11y ago
  "There is no technology that prevents Apple from subverting Apple's security." That's just in this universe. If users truly owned their devices, with full knowledge of the hardware and control of the software + data, we would never have this discussion. In this world, you have to jump through flaming hoops just to prevent Apple from automatically swapping out your OS!
  - cmdkeen 11y ago
    For what values of "full knowledge" - you bootstrapped your compiler and verify every line of source code you've downloaded. But then if you're up against nation state actors they can probably force your source code source to be compromised for you and only you - so those "many eyes" are seeing different code. You are after all checking that other people have the same hashes for the download that you use... Then we're getting into compromised hardware, you verified that the chips actually are the same as the circuit diagrams after all. There is only so much tinfoil you can deploy. If an advanced nation state truly has you in its sights there isn't much you can do about it, and to be honest that's the way it should be. We sacrifice individual liberties for the advantages of being part of an organised society, and the limitation of coercive power to the state is a key part of that. A well regulated state in which the right people get targeted, with an acceptably low false positive rate that scales based on the degree of privacy violation of the targeting seems to be a perfectly sensible state of affairs. Apple's argument that they are being asked to do something that isn't justified fits just fine into that.
    - CaptSpify 11y ago
      tl;dr: "it's hard to verify code. therefore, we shouldn't even try!"
      - freehunter 11y ago
        Not hard. Impossible. Have you seen obfuscated C? Is it possible for enough people to read it and understand it that it would make a difference? What about if you can read it but I can't? Do I trust you? How many people have to verify it before a non-expert can trust it? Theoretically, none. Everyone could be in on the conspiracy except me. And how do I verify that the code I've just read is what shipped on my computer? If I install it myself, how do I verify the CD or ISO I have is what I read? If I compiled it myself, how do I verify the compiler didn't change anything? What about the system that compiled the code, do I trust that? How far back do I have to go before I have trusted everything? And then what about hardware? Is there a chip that changes some of the code that's running? Can I verify every piece of hardware in my system, a 16-core CPU with 64GB of RAM and a high-end video card? How do I even do that? And what are the odds I am a world class C coder and a world-class hardware expert? And then what about client code? Am I a world-class Javascript expert too, with full source access to the Django backend? And the system that is running that server code, do I have access to that hardware to make sure it's not going to compromise my security? No. Fully trusting a computer is impossible. It doesn't mean we shouldn't try, we should at least make it as hard as possible for the bad guys to trick us. But what's better, IMO, is to create an environment where it's detrimental to companies to trick their users like that. Apple seems to have gotten a lot of great press for standing up in this situation. There's a market for it. Can you trust Apple tech? Maybe not. But can you trust it more than Google or Microsoft or Samsung or Facebook or Amazon etc etc? It does seem that way. Without being a world-class expert in everything, eventually you have to trust someone.
canes123456 11y ago
I could be impossible for apple to more easily brute force iOS if they prevent installing updates when the device is unlocked. However, being forced to make changes to iOS to grant access to FBI opens the door to many ways which security can be weakened or removed.
snowwrestler 11y ago
It will never be impossible for Apple to weaken the security of Apple's sofware. For example, the government could require Apple to build future iPhone software to permit backdoor access. The question today is whether the government can do so with a court-issued warrant, or whether it will require legislation, as it did with CALEA.
- mindslight 11y ago
  It could be impossible for Apple of the future to break the security of a device sold by Apple in the present. Apple can hopefully win this case based on the forced creation aspect. But they'd likely lose the next iteration where the FBI subpoenas technical documentation about the key derivation function, and builds their own hardware to talk to the hardened chip. Of course the FBI has little interest in doing this, because the whole affair is a psyop. If you want to fully protect your customers, don't design backdoors into your products in the first place!
Spooky23 11y ago
The real answer is to do a Putin -- buy a typewriter. If you're doing something that will attract negative political attention, mail a letter.
- ryukafalz 11y ago
  >The real answer is to do a Putin -- buy a typewriter. Even that might not help: http://arstechnica.com/security/2015/10/how-soviets-used-ibm-selectric-keyloggers-to-spy-on-us-diplomats/ http://arstechnica.com/security/2015/10/how-soviets-used-ibm...
- cmurf 11y ago
  USPS logs all mail, i.e. metadata. http://www.nytimes.com/2013/07/04/us/monitoring-of-snail-mail.html http://www.nytimes.com/2013/07/04/us/monitoring-of-snail-mai...
  - Spooky23 11y ago
    So what? It's pretty trivial to obscure that metadata, and frankly the content of your correspondence is more important than the metadata. Your mail has fairly robust legal protection, and you can spend more money (i.e. Registered mail) to provide a higher level of tamper evidence and accountability in transit.
mempko 11y ago
Amen brother. Free software, in my opinion is the answer here. And of course actually working democracies. Tim Cook today doesn't create it. Cook Tim tomorrow will.
- superuser2 11y ago
  The democracy is actually working: the small minority of tech industry people who think security and privacy are important are correctly overruled by the majority who don't. If you think (and it's not crazy) that sometimes small, elite populations know better than the public at large, great, but please don't call that democracy.
  - rantanplan 11y ago
    You could argue that parliaments are a small elite population. https://en.wikipedia.org/wiki/Representative_democracy https://en.wikipedia.org/wiki/Representative_democracy This is what we mean when we use the word "democracy" today, unless you live in ancient Greece or some small village. So having experts on technology,security and privacy being overruled by an uneducated mob is madness, not democracy.
  - hifier 11y ago
    And this is exactly what the constitution is for. Changing the constitution requires much more than a simple majority.
finishingmove 11y ago
Correct, thank you for summing this up so nicely. I would just like to add that, when possible, such a thing often already exists. Food for thought.
notatoad 11y ago
Is that really true though? My understanding here is that the biggest blocker is the code signing process - the FBI or the NSA could probably build a backdoored OS, but they couldn't install it on the phone without apple's signing cert. Depending on Apple's internal security, it may very well be impossible for a single person to sign anything other than an official iOS release, making it impossible for an agressor nation or a disgruntled employee or anybody else other than apple as a whole to get a backdoor onto an iOS device.
- archgoon 11y ago
  I believe the parents point is that Apple having a signing key is no different in principle than them making an operating system and signing it. Apple possesses information that can compromise a phone, and if it's possible for an signed OS image to be compromised, then it's possible for the signing key to be compromised.
  - noelsusman 11y ago
    This is what I've been saying all along. If Apple has the ability to do this then the security is already compromised. The fact that it hasn't been physically created yet is a minor detail. I also don't understand why they couldn't provide the FBI with an OS that refuses to run on anything other than the specific device in question. Isn't that the whole point of code signing?
bonestamp2 11y ago
> Some finite number of human beings at Apple have the ability to create such a tool on their own initiative, e.g. were they disgruntled. Is that true? I mean, wouldn't those employees need the root signing certificate... something I suspect is very tightly protected even within apple.
- zeveb 11y ago
  > something I suspect is very tightly protected even within apple. By, say, breaking up its custodianship among a … finite group of human beings.
  - rootusrootus 11y ago
    You just made an important distinction, however, between a singular employee, and a group.
gherkin0 11y ago
> And of course, that's also wrong. The only way to guarantee that such a powerful tool isn't abused it and doesn't fall into the wrong hands is to make it impossible for such a tool to exist, not to refuse to create it. And Apple has done that: the type of hack the FBI is asking for cannot work on newer iPhones.
- sbov 11y ago
  Source? Current discussions surrounding your statement point to it being false - that Apple can update the firmware of the secure enclave without it wiping out it's data.
  - gherkin0 11y ago
    > Source? Current discussions surrounding your statement point to it being false - that Apple can update the firmware of the secure enclave without it wiping out it's data. Do you have the source for that, too? I was still under the impression that the Secure Enclave would erase the keys if it's updated. It's a pretty huge flaw if the firmware can be updated and the keys preserved without first validating with the passcode.
    - smackfu 11y ago
      AFAIK, the only sources on this matter are the white papers that Apple has produced. You can't even attempt to update the firmware without having Apple's signing keys.
    - ikeboy 11y ago
      https://blog.trailofbits.com/2016/02/17/apple-can-comply-with-the-fbi-court-order/ https://blog.trailofbits.com/2016/02/17/apple-can-comply-wit...
  - jtuchsen 11y ago
    I think the confusion stems from the iOS security guide that Apple published. Page 7 of the guide states that "The Secure Enclave is a coprocessor fabricated in the Apple A7 or later A-series processor. It utilizes its own secure boot and personalized software update separate from the application processor," which implies that somehow updating it is more secure, without saying exactly how much control Apple has over updating it, and whether or not the phone needs to be unlocked before it accepts new firmware. Given that they haven't come out and said that they can't override the firmware for locked phones, I'd say they can. Although, before Apple's recent statements I would have assumed that they couldn't, so the confusions understandable. The guides at https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
derefr 11y ago
They made it impossible for the new versions of the hardware, I think. (The Secure Enclave, in the phones that have it, would delete the decryption keys stored within it after receiving ten incorrect auth attempt requests from the CPU. The Secure Enclave cannot be updated—as far as we know—to be brute-force-able.) It's just the old versions, before Apple started making privacy a political tentpole, that they could ever manage to backdoor in this particular way. That's still bad—but what Apple are mainly worrying about is that this precedent would force them to aid the FBI in other act-of-creation ways, not just in ways involving introducing backdoors. The FBI might compel Apple to, for example, build a monitoring and clustering service into iTunes Genius/Apple Music to de-anonymize people through their music preferences; or they might request Apple build a facility to censor all messages travelling through APNS that mention the names of informants in active sting operations. Or they might compel Apple to build a secret CPU ring-0 elevation handshake into the A10 chip. Even if the new generation of iOS devices was completely un-backdoor-able, and the usage of the old generation was effectively nil, that still wouldn't minimize the FBI's request. The FBI are likely much more concerned about all the orders they could give to, effectively, turn Apple's engineering talent into a domestic-surveillance consultancy.
- GCA10 11y ago
  Apple -- or any other tech company -- could probably prevail in court against a lot of the more outlandish FBI scenarios that you describe. Most appellate courts take privacy quite seriously. So does the Supreme Court, with both right- and left-leaning judges getting there just fine on their own. The Fourth Amendment is pretty clear on this. The problem for Apple, or any other tech company, is that once you say "okay" once, you can't swat away the next one by saying "Impossible" and being done with it. You have to lawyer up. That takes time and costs money. So Apple's real issue is that they don't want to spend many millions of dollars (billions?) on lawyers to get the FBI and other alphabet agencies to behave properly. That's a very legitimate business position. It's just a little more nuanced than what we were told on day one.
newman314 11y ago
I'm all for Apple here but this is kind of silly. At some point someone has to design the product so someone has to do the creation in that sense. Unless you are proposing a jesusphone will somehow spring forth fully secure safe from even Apple's design team. But that said I'm definitely for the stance that technology be designed in such a way to be unbreakable to Apple or anyone else once the device is sold.

by zeveb 11y ago

panarky 11y ago

Naturally "can't create" is better than "won't create", but this case is about the precedent and not this particular iPhone. If a court can force a company to create new technology that didn't exist before, what other tools might they be forced to build? 1) Stream keystrokes, audio, video, location to law enforcement prior to encryption 2) Replace actual search results with government-approved results 3) Force Apple to create target lists of suspects based on their location, apps installed, sites visited, keywords typed Bad things happen when the government can force private companies and individuals to create new tools for law enforcement. There is no technology that prevents Apple from subverting Apple's security. If Apple loses, the new precedent could open Pandora's box.

dangirsh 11y ago
"There is no technology that prevents Apple from subverting Apple's security." That's just in this universe. If users truly owned their devices, with full knowledge of the hardware and control of the software + data, we would never have this discussion. In this world, you have to jump through flaming hoops just to prevent Apple from automatically swapping out your OS!
- cmdkeen 11y ago
  For what values of "full knowledge" - you bootstrapped your compiler and verify every line of source code you've downloaded. But then if you're up against nation state actors they can probably force your source code source to be compromised for you and only you - so those "many eyes" are seeing different code. You are after all checking that other people have the same hashes for the download that you use... Then we're getting into compromised hardware, you verified that the chips actually are the same as the circuit diagrams after all. There is only so much tinfoil you can deploy. If an advanced nation state truly has you in its sights there isn't much you can do about it, and to be honest that's the way it should be. We sacrifice individual liberties for the advantages of being part of an organised society, and the limitation of coercive power to the state is a key part of that. A well regulated state in which the right people get targeted, with an acceptably low false positive rate that scales based on the degree of privacy violation of the targeting seems to be a perfectly sensible state of affairs. Apple's argument that they are being asked to do something that isn't justified fits just fine into that.
  - CaptSpify 11y ago
    tl;dr: "it's hard to verify code. therefore, we shouldn't even try!"
    - freehunter 11y ago
      Not hard. Impossible. Have you seen obfuscated C? Is it possible for enough people to read it and understand it that it would make a difference? What about if you can read it but I can't? Do I trust you? How many people have to verify it before a non-expert can trust it? Theoretically, none. Everyone could be in on the conspiracy except me. And how do I verify that the code I've just read is what shipped on my computer? If I install it myself, how do I verify the CD or ISO I have is what I read? If I compiled it myself, how do I verify the compiler didn't change anything? What about the system that compiled the code, do I trust that? How far back do I have to go before I have trusted everything? And then what about hardware? Is there a chip that changes some of the code that's running? Can I verify every piece of hardware in my system, a 16-core CPU with 64GB of RAM and a high-end video card? How do I even do that? And what are the odds I am a world class C coder and a world-class hardware expert? And then what about client code? Am I a world-class Javascript expert too, with full source access to the Django backend? And the system that is running that server code, do I have access to that hardware to make sure it's not going to compromise my security? No. Fully trusting a computer is impossible. It doesn't mean we shouldn't try, we should at least make it as hard as possible for the bad guys to trick us. But what's better, IMO, is to create an environment where it's detrimental to companies to trick their users like that. Apple seems to have gotten a lot of great press for standing up in this situation. There's a market for it. Can you trust Apple tech? Maybe not. But can you trust it more than Google or Microsoft or Samsung or Facebook or Amazon etc etc? It does seem that way. Without being a world-class expert in everything, eventually you have to trust someone.

canes123456 11y ago

I could be impossible for apple to more easily brute force iOS if they prevent installing updates when the device is unlocked. However, being forced to make changes to iOS to grant access to FBI opens the door to many ways which security can be weakened or removed.

snowwrestler 11y ago

It will never be impossible for Apple to weaken the security of Apple's sofware. For example, the government could require Apple to build future iPhone software to permit backdoor access. The question today is whether the government can do so with a court-issued warrant, or whether it will require legislation, as it did with CALEA.

mindslight 11y ago
It could be impossible for Apple of the future to break the security of a device sold by Apple in the present. Apple can hopefully win this case based on the forced creation aspect. But they'd likely lose the next iteration where the FBI subpoenas technical documentation about the key derivation function, and builds their own hardware to talk to the hardened chip. Of course the FBI has little interest in doing this, because the whole affair is a psyop. If you want to fully protect your customers, don't design backdoors into your products in the first place!

Spooky23 11y ago

The real answer is to do a Putin -- buy a typewriter. If you're doing something that will attract negative political attention, mail a letter.

ryukafalz 11y ago
>The real answer is to do a Putin -- buy a typewriter. Even that might not help: http://arstechnica.com/security/2015/10/how-soviets-used-ibm-selectric-keyloggers-to-spy-on-us-diplomats/ http://arstechnica.com/security/2015/10/how-soviets-used-ibm...
cmurf 11y ago
USPS logs all mail, i.e. metadata. http://www.nytimes.com/2013/07/04/us/monitoring-of-snail-mail.html http://www.nytimes.com/2013/07/04/us/monitoring-of-snail-mai...
- Spooky23 11y ago
  So what? It's pretty trivial to obscure that metadata, and frankly the content of your correspondence is more important than the metadata. Your mail has fairly robust legal protection, and you can spend more money (i.e. Registered mail) to provide a higher level of tamper evidence and accountability in transit.

mempko 11y ago

Amen brother. Free software, in my opinion is the answer here. And of course actually working democracies. Tim Cook today doesn't create it. Cook Tim tomorrow will.

superuser2 11y ago
The democracy is actually working: the small minority of tech industry people who think security and privacy are important are correctly overruled by the majority who don't. If you think (and it's not crazy) that sometimes small, elite populations know better than the public at large, great, but please don't call that democracy.
- rantanplan 11y ago
  You could argue that parliaments are a small elite population. https://en.wikipedia.org/wiki/Representative_democracy https://en.wikipedia.org/wiki/Representative_democracy This is what we mean when we use the word "democracy" today, unless you live in ancient Greece or some small village. So having experts on technology,security and privacy being overruled by an uneducated mob is madness, not democracy.
- hifier 11y ago
  And this is exactly what the constitution is for. Changing the constitution requires much more than a simple majority.

finishingmove 11y ago

Correct, thank you for summing this up so nicely. I would just like to add that, when possible, such a thing often already exists. Food for thought.

notatoad 11y ago

Is that really true though? My understanding here is that the biggest blocker is the code signing process - the FBI or the NSA could probably build a backdoored OS, but they couldn't install it on the phone without apple's signing cert. Depending on Apple's internal security, it may very well be impossible for a single person to sign anything other than an official iOS release, making it impossible for an agressor nation or a disgruntled employee or anybody else other than apple as a whole to get a backdoor onto an iOS device.

archgoon 11y ago
I believe the parents point is that Apple having a signing key is no different in principle than them making an operating system and signing it. Apple possesses information that can compromise a phone, and if it's possible for an signed OS image to be compromised, then it's possible for the signing key to be compromised.
- noelsusman 11y ago
  This is what I've been saying all along. If Apple has the ability to do this then the security is already compromised. The fact that it hasn't been physically created yet is a minor detail. I also don't understand why they couldn't provide the FBI with an OS that refuses to run on anything other than the specific device in question. Isn't that the whole point of code signing?

bonestamp2 11y ago

> Some finite number of human beings at Apple have the ability to create such a tool on their own initiative, e.g. were they disgruntled. Is that true? I mean, wouldn't those employees need the root signing certificate... something I suspect is very tightly protected even within apple.

zeveb 11y ago
> something I suspect is very tightly protected even within apple. By, say, breaking up its custodianship among a … finite group of human beings.
- rootusrootus 11y ago
  You just made an important distinction, however, between a singular employee, and a group.

gherkin0 11y ago

> And of course, that's also wrong. The only way to guarantee that such a powerful tool isn't abused it and doesn't fall into the wrong hands is to make it impossible for such a tool to exist, not to refuse to create it. And Apple has done that: the type of hack the FBI is asking for cannot work on newer iPhones.

sbov 11y ago
Source? Current discussions surrounding your statement point to it being false - that Apple can update the firmware of the secure enclave without it wiping out it's data.
- gherkin0 11y ago
  > Source? Current discussions surrounding your statement point to it being false - that Apple can update the firmware of the secure enclave without it wiping out it's data. Do you have the source for that, too? I was still under the impression that the Secure Enclave would erase the keys if it's updated. It's a pretty huge flaw if the firmware can be updated and the keys preserved without first validating with the passcode.
  - smackfu 11y ago
    AFAIK, the only sources on this matter are the white papers that Apple has produced. You can't even attempt to update the firmware without having Apple's signing keys.
  - ikeboy 11y ago
    https://blog.trailofbits.com/2016/02/17/apple-can-comply-with-the-fbi-court-order/ https://blog.trailofbits.com/2016/02/17/apple-can-comply-wit...
- jtuchsen 11y ago
  I think the confusion stems from the iOS security guide that Apple published. Page 7 of the guide states that "The Secure Enclave is a coprocessor fabricated in the Apple A7 or later A-series processor. It utilizes its own secure boot and personalized software update separate from the application processor," which implies that somehow updating it is more secure, without saying exactly how much control Apple has over updating it, and whether or not the phone needs to be unlocked before it accepts new firmware. Given that they haven't come out and said that they can't override the firmware for locked phones, I'd say they can. Although, before Apple's recent statements I would have assumed that they couldn't, so the confusions understandable. The guides at https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf

derefr 11y ago

They made it impossible for the new versions of the hardware, I think. (The Secure Enclave, in the phones that have it, would delete the decryption keys stored within it after receiving ten incorrect auth attempt requests from the CPU. The Secure Enclave cannot be updated—as far as we know—to be brute-force-able.) It's just the old versions, before Apple started making privacy a political tentpole, that they could ever manage to backdoor in this particular way. That's still bad—but what Apple are mainly worrying about is that this precedent would force them to aid the FBI in other act-of-creation ways, not just in ways involving introducing backdoors. The FBI might compel Apple to, for example, build a monitoring and clustering service into iTunes Genius/Apple Music to de-anonymize people through their music preferences; or they might request Apple build a facility to censor all messages travelling through APNS that mention the names of informants in active sting operations. Or they might compel Apple to build a secret CPU ring-0 elevation handshake into the A10 chip. Even if the new generation of iOS devices was completely un-backdoor-able, and the usage of the old generation was effectively nil, that still wouldn't minimize the FBI's request. The FBI are likely much more concerned about all the orders they could give to, effectively, turn Apple's engineering talent into a domestic-surveillance consultancy.

GCA10 11y ago
Apple -- or any other tech company -- could probably prevail in court against a lot of the more outlandish FBI scenarios that you describe. Most appellate courts take privacy quite seriously. So does the Supreme Court, with both right- and left-leaning judges getting there just fine on their own. The Fourth Amendment is pretty clear on this. The problem for Apple, or any other tech company, is that once you say "okay" once, you can't swat away the next one by saying "Impossible" and being done with it. You have to lawyer up. That takes time and costs money. So Apple's real issue is that they don't want to spend many millions of dollars (billions?) on lawyers to get the FBI and other alphabet agencies to behave properly. That's a very legitimate business position. It's just a little more nuanced than what we were told on day one.

newman314 11y ago

I'm all for Apple here but this is kind of silly. At some point someone has to design the product so someone has to do the creation in that sense. Unless you are proposing a jesusphone will somehow spring forth fully secure safe from even Apple's design team. But that said I'm definitely for the stance that technology be designed in such a way to be unbreakable to Apple or anyone else once the device is sold.