10 ms·

The US Government has no credibility to compel anybody to weaken security

313 points by StuntPope 11y ago

autopov 11y ago
Who's Tim Cooke?
- emiliobumachar 11y ago
  CEO of apple.
  - autopov 11y ago
    That would be Tim Cook...
  - deleted 11y ago
    [deleted]
mcculley 11y ago
This is exactly how I feel about this. There would be an actual interesting debate to be had about the powers of the state versus corporations versus the rights of individuals to perfect end-to-end encryption if the state hadn't been using warrantless wiretaps and National Security Letters for the last 15 years. As it is, the state has shown it can't be trusted with that power.
- ktRolster 11y ago
  It's an old debate, and I think it can be summed up in a single sentence: Government would be awesome if it worked right I would give the FBI everything if I trusted them. A monarchy/dictatorship would be most efficient if there were a way to guarantee a good monarch/benevolent dictator.
  - morgante 11y ago
    Madison said it best: > If men were angels, no government would be necessary. If angels were to govern men, neither external nor internal controls on government would be necessary.
    - woodman 11y ago
      People are bad, therefore we need a government made up of people are bad...
      - sremani 11y ago
        people are not perfect and that is why we need a government made up of people accountable to all people.
        woodman 11y ago
        So that they can imperfectly be held accountable by all imperfect people. Now let us find a nice foundation of sand to build a castle on.
        dsp1234 11y ago
        I could rip a piece of paper with my bare hands. Give me 300 million pieces of paper sandwiched together and I couldn't.
        venomsnake 11y ago
        But they burn quite good.
        danudey 11y ago
        Actually stacks, sheets, or bindings of paper are extremely difficult to burn compared to individual sheets.
- qbasic 11y ago
  This is the debate that needs to take place. How do we restore trust? Checks and balances are meant to prevent abuse of power, but they have been removed from the equation. Oversight by the judicial branch has been perverted with "top-secret" courts and the ability of the legislative branch to correct the abuse has been scuttled by the lack of transparency.
  - rm_-rf_slash 11y ago
    I generally advocate for a citizen's veto amendment, where any citizen can initiate a petition to veto legislation that will trigger a second and binding referendum if there are enough preliminary signatures. It's one thing to vote for the right people, it's something else to expect representatives to do what you want when everyone in Washington is brought there by the money and power of someone else.
    - woodman 11y ago
      If the State's power is derived from the consent of the governed, then a lack of political participation on the part of the governed should be considered a vote of no confidence. This would solve the problem of imbalanced lobbying incentive, government overreach following tragedy, etc. Most importantly it would solve the moral problem that Thomas Jefferson pointed out: "The question whether one generation of men has a right to bind another..." As it stands now, we have a garbage collected memory allocator with no reclamation function.
    - dragonwriter 11y ago
      > I generally advocate for a citizen's veto amendment, where any citizen can initiate a petition to veto legislation that will trigger a second and binding referendum if there are enough preliminary signatures. Many US states have this kind of referendum provision (notably, given the disproportionate Silicon Valley representation on HN, California.) I don't detect substantially greater trust for government in the states with it then is the case elsewhere or with the federal government, and it is, itself, a frequent influence point for special interest money.
- sandworm101 11y ago
  >>> sing warrantless wiretaps and National Security Letters for the last 15 years. 15 years? It was going on long long before 9/11. Google "echalon". If you want to get really oldschool, Google "cabinet noir".
  - mcculley 11y ago
    I am of course aware of Echelon. But it was designed around the limitations imposed by law. You've got to admit that the implementation of such eavesdropping since 9/11 is a huge difference.
FreedomToCreate 11y ago
Maybe Apple should have just stated that its impossible to create a backdoor (the way actual encryption should be). But since we all know that its possible to create one, the fact that there is an option will always spur debate. The most important thing that the author mentions though is "How can the government regain the trust of the people?".
- Grishnakh 11y ago
  >The most important thing that the author mentions though is "How can the government regain the trust of the people?". Why should it? And do the people even distrust the government? Just look at the Presidential candidates. All the Republicans left are totally in favor of mass surveillance, and Hillary, the choice of mainstream Democrats, of course is a big fan of ubiquitous surveillance. Face it, most of the American public, except maybe the Millenials and Gen-Z, love the idea of having the government spy on them all the time "for their safety".
  - goldbeck 11y ago
    > Face it, most of the American public, except maybe the Millenials and Gen-Z, love the idea of having the government spy on them all the time "for their safety". citation needed
    - Grishnakh 11y ago
      Um, I already did: Bernie's the only candidate really against spying, and it's mainly young liberal people who like him. Everyone else, plus conservatives, loves all the other candidates, who are all in favor of spying. Hence, the people want to be spied on. If they didn't, they wouldn't be fans of these candidates.
      - mynameisvlad 11y ago
        You are going through so many logical fallacies I don't even know where to start. But that's not how logic works. None of that is how logic works.
newman314 11y ago
Here's the thing. Governmental credibility should not be a factor. Particularly in light of how things have and will continue to shift over time. Clinton tried to push the Clippet chip through and failed. We can't just say thing got better and now we should help weaken crypto because bad guys and now the government has more credibility. Obviously, things swung back in the opposite direction. So the only safe solution is to build strong crypto always.
- wlesieutre 11y ago
  The government having credibility now wouldn't guarantee that this would be a good idea forever going into the future. But the fact that the government already doesn't have any credibility on privacy and data protection is a factor. It means that this is already a bad idea as of right now.
rhino369 11y ago
I totally agree the US government shouldn't compel anyone to weaken security generally. So Apple shouldn't be forced to build in a backdoor into products that are released for sale. But this apple request is just exploiting a weakness that already exists. And it would only be doing it on a single phone. And it would be do it pursuant to a legal order by a US court. Also, the US government only has zero credibility in the minds of hardcore activists or extremists. The bulk of the America public trust the FBI to investigate ISIS.
- geographomics 11y ago
  I agree - this is the type of vulnerability that, assuming Apple is extremely careful about protecting their signing key, is only exploitable by court order or similar state request. This crypto implementation on iPhones and the like isn't really designed to protect against that, it's really more to prevent the common criminal from accessing your personal data. Apple already comply with law enforcement requests to access iCloud backups and other such data, so assisting with this passcode crack isn't really much of a stretch.
  - outworlder 11y ago
    > I agree - this is the type of vulnerability that, assuming Apple is extremely careful about protecting their signing key, is only exploitable by court order or similar state request. Apple has been trying to prevent jailbreaking for years - they've always failed, so I'm skeptical about this "only exploitable by court order" bit. Determined people will find ways around the protections. Heck, it is even possible that someone (think nation-states) has already found a way to circumvent the passcode lock. This will only lower the barrier of entry.
    - geographomics 11y ago
      Jailbreaks address a different type of vulnerability - that of incorrectly written code or poorly designed systems, that can lead to a privilege escalation. The vulnerability that the FBI are using is the ability of Apple to update the iPhone with arbitrary code, provided it has been signed with their secret key. It's an important feature, of course, but still a security vulnerability - albeit an irrelevant one for the vast majority of iPhone users.
deleted 11y ago
[deleted]
cortesoft 11y ago
If Apple can do something that will unencrypt the phone, then obviously the vulnerability is already present. How about Apple hacks the phone, then fixes the vulnerability so they can't do it again in the future?
- matheweis 11y ago
  The analysis I have read from those that understand the technicalities behind it better than I do is that it is because the phone in question is a 5C. e.g. Apple has already fixed the holes in the 6/6S; the concern here is the use of all writs to compel them to unlock the 5C, and the Pandora's box that doing so would open up.
  - tantalor 11y ago
    No, the devices with secure enclave (like 6/6S) are just as exploitable by the phonemaker. https://www.techdirt.com/articles/20160218/10371233643/yes-backdoor-that-fbi-is-requesting-can-work-modern-iphones-too.shtml https://www.techdirt.com/articles/20160218/10371233643/yes-b...
    - matheweis 11y ago
      Ugh, if Rob Graham and Bruce Schnier can't be used as a good source... Sounds like Apple needs to update Secure Enclave so that updating wipes the keys.
      - vectorjohn 11y ago
        Yep, exactly. If they did that, and the government was trying to somehow make that illegal, or demand a real backdoor, then it would be time to get up in arms. But that time is not yet.
- nxzero 11y ago
  How does this fix the issue? NY alone has said they will request Apple unlock roughly 200 phones they already have, so please explain how this is a solution.
yarper 11y ago
The debate is fairly pointless, govt will do whatever they want anyway. The vast majority of people just vote down predestined party lines, and swing voters aren't all the bright educated people we like to think they are. It's just a fact that half of all people are of below average intelligence. Politicians should be a better than average cohort for intelligence, but judging by the incomprehensible jabber they espouse on tech matters I doubt it'll change anytime soon. They seem to spend most of their time trying to dick each other over and make themselves look good rather than actually get shit done.
- rhizome 11y ago
  How do you figure the government has the ability to "do what they want" in this case?
  - qrendel 11y ago
    They can pass laws requiring software to be backdoored without allowing the company to notify the public (similar to what happened to Lavabit), or can use three letter agencies to backdoor most software anyway (similar to what happened with Dual_EC_DRBG).
    - rhizome 11y ago
      Those laws won't be passed in secret.
  - kelvin0 11y ago
    I don't think it's a surprise that it has often been the case that some Elements in the gvmt are able to rationalize some objectives they have can trump the 'laws' and other rules ordinary citizens would be held accountable to. For example, The Patriot Act and other measures can be broad enough in scope to allow interpretation which would have some elements think they are invested with the power of spying on their own citizens living within the borders of their country. That's just one example. Iran Contra is also another one, and the list goes on ... The impetus for this type of rogue action will always be present in the circles of power, to allow them to keep their positions.
smileysteve 11y ago
To me, the more important aspect is the U.S.'s failures to maintain their own data integrity. * The OPM breach is a big part of this. * Government domains without SPF or requiring TLS (for instance email) * Social Security Numbers significantly insecure * Secretary of State (GA) losing identities
- rm_-rf_slash 11y ago
  This is a significantly under appreciated point. Let's assume that the software to unlock an iPhone exists only on one non-networked laptop. Even if it couldn't be remotely hacked, is it too much to expect that the US government - which couldn't even keep the atomic bomb designs from being stolen by the Soviets - is going to keep that information safe and secure forever?
- pdkl95 11y ago
  * Storing NSA documents without proper (air-gaped) compartmentalization such that it was even possible for one person to access them in bulk.
  - junto 11y ago
    Boom. Headshot. Nice point.
  - philovivero 11y ago
    In the future, add the proper number of p's into "gapped." The term "air-gaped" activates the neurons that cannot unsee goatse guy.
jwiley 11y ago
I think what's being lost in the shuffle is Apple has no credibility in claiming its protecting your privacy and security. http://money.cnn.com/2014/09/18/technology/security/apple-privacy/ http://money.cnn.com/2014/09/18/technology/security/apple-pr...
- white-flame 11y ago
  At the center of it all, everybody's scuffling to be the all-seeing eye of the internet. Google/Apple/Facebook/ad networks/etc all want to know everything, to be able to sell & exploit that information. They don't want that precious IP to be diluted and lose value, so they must defend their freedom and autonomy to do what they'd call "evil" if others did it.
- oldmanjay 11y ago
  That doesn't really seem to be related here. One of the reasons I gave up on Slashdot was how people used any story as a tangent to flog their unrelated hatred of some company. Please don't turn HN into Slashdot.
  - jwiley 11y ago
    I'm sorry I gave you the impression I hate Apple, thats certainly not what I intended. One of the implicit ideas underlying Apple's arguments is that they are more trustworthy than the government. But theres a lot of evidence that they are not as strong on privacy as they should be. Casting Apple, and private industry in general as privacy heros does a disservice to those very valid concerns. Heres an article from earlier this month: http://www.theguardian.com/money/2016/feb/05/error-53-apple-iphone-software-update-handset-worthless-third-party-repair http://www.theguardian.com/money/2016/feb/05/error-53-apple-... http://www.forbes.com/sites/gordonkelly/2015/09/16/apple-releases-ios-9/ http://www.forbes.com/sites/gordonkelly/2015/09/16/apple-rel...
    - oldmanjay 11y ago
      None of this gives me the impression that I should trust the government at all, so why bother making the argument against Apple here? It doesn't effectively rebut the article. It just comes off as axe-grinding.
Shivetya 11y ago
I know there is incredible dislike for Rush by many in this community, however his transcript today concerned the issue at hand and was very good. The reason its important is because his audience is large and he actually did a good job with the issue. Normally at the noon hour I simply turn off the radio but when I heard the discussion that came up it was so engrossing that I listened to the whole show. tl;dr no matter what is claimed, if Apple writes this for this one phone it will get out. http://www.rushlimbaugh.com/daily/2016/02/22/how_the_government_bungled_the_handling_of_the_san_bernardino_iphone http://www.rushlimbaugh.com/daily/2016/02/22/how_the_governm...
- deelowe 11y ago
  Pretty good read. I wish more people in the media would learn a bit about this stuff. He did a great job of keeping the callers in check when they through BS elementary arguments at him like "well why don't they just hack it!"
pdkl95 11y ago
This is the key issue in this entire debate: [T]he Government has ... violated the trust of the American people [and] broken the law themselves by already conducting wholesale surveillance of the citizenry ... Thus, the number one issue, the issue that should preempt all other issues, is how the government regains it's credibility and re-establishes trust. Far too many people - even here on HN - are taking about the government's order to Apple in isolation. The common arguments by the government and its supporters are based on the assumption that any action taken would be limited to the current situation. Except this isn't an isolated situation. The government has been fighting against the free use of encryption for decades. Saying the order given to Apple is limited to this single case is practically admitting ignorance (willful or not) about: * The investigation of Phil Zimmermann and the export of PGP as a a "munition" * Bernstein v. United States * The Clipper Chip (Skipjack) and other key escrow systems of the fist crypto war * "Total Information Awareness" (w/ John Poindexter of the Iran–Contra affair) * The beam splitter in room 641A of AT&T's facility at 611 Folsom St. * The illegalities brought to light by Daniel Ellsberg, William Binney, Thomas Drake, Edward Snowden, and other patriots that kept their oath to defend the constitution. * How many public security standards were ruined as part of BULLRUN and related programs. * The recently-discovered use of "Stingray" devices ("IMSI-catchers") by the FBI. * (I'll just stop the here - there are many other examples that should be included) These actions clearly show a pattern of trying to gain backdoor access or other surveillance capabilities. Yet some people suggest - usually without any evidence - that the government should be trusted. What, specifically, has the government been doing in the area of communication security that has justified any amount of trust? Actions are more important than promises. It would be nice if this wasn't such an adversarial relationship. Unfortunately, this cold civil war we are in where the government treating everyone as a potential criminal by default doesn't leave us with a lot of options. Until we see real actions that regain some amount of the public's trust, the rational approach has to be to not trust the government at all. To do otherwise is either ignorance of history or blind faith that the government never lies.
- vectorjohn 11y ago
  The government absolutely should not be trusted. That's why Apple shouldn't give them a skeleton key to get into any phone, just the legally compelled access for this specific phone. Apple can make that happen trivially. If the government was telling Apple to make an actual backdoor for any phone, this would be different. Nobody (except the most unreasonable) has any problem with the FBI searching property when they have a legal warrant. That's what is happening here. It's the equivalent of asking a manager to open a storage unit. This specific case is not anything like any of the examples you gave.
redbeard0x0a 11y ago
If I was the NSA, the Chinese Government or a hacker group, I would be working really hard right now to get a foothold on the internal Apple network. To be able to grab any and all data (code, emails, files, etc) from anywhere on the network to try and capture the work that would be required to fulfill the request of this court order. Even if we could trust the US government, we shouldn't be forcing Apple to create this 'master key' anyway. The problem is that anything that has been created digitally cannot be destroyed after it is used. Once the tool is created, we cannot put that genie back in the bottle.
- vinceguidry 11y ago
  It's recently been shown that this action is purely political, there is nothing material that the FBI stands to gain in their investigation. The entire point is to let the genie out of the bottle.
- rtpg 11y ago
  It's been covered a couple of times, but Apple is being asked to make a tool that would check that the device ID is the same as the warranted device. That's the essential part. By having a device ID check (combined with digital signage), Apple could publicly release the tool without fear of anything happening on any other phone. Plus people couldn't modify it because that would break the signature.
  - swombat 11y ago
    Did you miss the bit where the DoJ has already declared it has hundreds of other phones it will want cracked if Apple is willing to comply to this? Also, if you think having a device ID check is going to do anything, you might want to have a look at the cracks scene and what they do with your pitiful attempts at DRM...
vacri 11y ago
> Ben Franklin's observation that "those who would trade liberty for security deserve neither" It is an opinion, not an observation ('deserve' in particular is not an observation). Just because someone famous said a thing doesn't make it true, or even true-ish. If you want to be such a purist about Franklin's comment, then abolish the police altogether; you'll rapidly see that Franklin's comment is not meant to be read in such a purist way. Or to put it another way: where do you draw the line with Franklin's comment? The article then goes on to talk about gun rights for some reason, with the usual canards thrown in, plus a bit of good ol' selective reporting: "gun deaths are down by half in the past 25 years!", neatly ignoring that they're measuring from the peak, not from the previous baseline. And the US homicide rate is still nearly four times higher than most other western democracies...
- dragonwriter 11y ago
  > > Ben Franklin's observation that "those who would trade liberty for security deserve neither" > It is an opinion, not an observation* ('deserve' in particular is not an observation). And the quote is both butchered here (the original is: "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety") and -- as it usually is -- applied poorly considering its original context. [0] [0] http://www.npr.org/2015/03/02/390245038/ben-franklins-famous-liberty-safety-quote-lost-its-context-in-21st-century http://www.npr.org/2015/03/02/390245038/ben-franklins-famous...
  - vacri 11y ago
    Ah, thanks for that. I've seen the shortened version so often I'd come to believe that was the actual quote. The longer version makes much more sense and is far less absolutist.
hifier 11y ago
I don't like this line of reasoning because it allows for a pro-surveillance outcome if you change the statistics. At what threshold do you switch sides? Ben Franklin is pretty clear and so is the constitution. We don't need to argue on the government agency's terms because we win this argument hands down on principal alone. Please don't weaken the argument.
tn13 11y ago
No governments around the world have any credibility defending the liberty of its people.

313 points by StuntPope 11y ago

autopov 11y ago

Who's Tim Cooke?

emiliobumachar 11y ago
CEO of apple.
- autopov 11y ago
  That would be Tim Cook...
- deleted 11y ago
  [deleted]

mcculley 11y ago

This is exactly how I feel about this. There would be an actual interesting debate to be had about the powers of the state versus corporations versus the rights of individuals to perfect end-to-end encryption if the state hadn't been using warrantless wiretaps and National Security Letters for the last 15 years. As it is, the state has shown it can't be trusted with that power.

ktRolster 11y ago
It's an old debate, and I think it can be summed up in a single sentence: Government would be awesome if it worked right I would give the FBI everything if I trusted them. A monarchy/dictatorship would be most efficient if there were a way to guarantee a good monarch/benevolent dictator.
- morgante 11y ago
  Madison said it best: > If men were angels, no government would be necessary. If angels were to govern men, neither external nor internal controls on government would be necessary.
  - woodman 11y ago
    People are bad, therefore we need a government made up of people are bad...
    - sremani 11y ago
      people are not perfect and that is why we need a government made up of people accountable to all people.
      - woodman 11y ago
        So that they can imperfectly be held accountable by all imperfect people. Now let us find a nice foundation of sand to build a castle on.
        dsp1234 11y ago
        I could rip a piece of paper with my bare hands. Give me 300 million pieces of paper sandwiched together and I couldn't.
        venomsnake 11y ago
        But they burn quite good.
        danudey 11y ago
        Actually stacks, sheets, or bindings of paper are extremely difficult to burn compared to individual sheets.
qbasic 11y ago
This is the debate that needs to take place. How do we restore trust? Checks and balances are meant to prevent abuse of power, but they have been removed from the equation. Oversight by the judicial branch has been perverted with "top-secret" courts and the ability of the legislative branch to correct the abuse has been scuttled by the lack of transparency.
- rm_-rf_slash 11y ago
  I generally advocate for a citizen's veto amendment, where any citizen can initiate a petition to veto legislation that will trigger a second and binding referendum if there are enough preliminary signatures. It's one thing to vote for the right people, it's something else to expect representatives to do what you want when everyone in Washington is brought there by the money and power of someone else.
  - woodman 11y ago
    If the State's power is derived from the consent of the governed, then a lack of political participation on the part of the governed should be considered a vote of no confidence. This would solve the problem of imbalanced lobbying incentive, government overreach following tragedy, etc. Most importantly it would solve the moral problem that Thomas Jefferson pointed out: "The question whether one generation of men has a right to bind another..." As it stands now, we have a garbage collected memory allocator with no reclamation function.
  - dragonwriter 11y ago
    > I generally advocate for a citizen's veto amendment, where any citizen can initiate a petition to veto legislation that will trigger a second and binding referendum if there are enough preliminary signatures. Many US states have this kind of referendum provision (notably, given the disproportionate Silicon Valley representation on HN, California.) I don't detect substantially greater trust for government in the states with it then is the case elsewhere or with the federal government, and it is, itself, a frequent influence point for special interest money.
sandworm101 11y ago
>>> sing warrantless wiretaps and National Security Letters for the last 15 years. 15 years? It was going on long long before 9/11. Google "echalon". If you want to get really oldschool, Google "cabinet noir".
- mcculley 11y ago
  I am of course aware of Echelon. But it was designed around the limitations imposed by law. You've got to admit that the implementation of such eavesdropping since 9/11 is a huge difference.

FreedomToCreate 11y ago

Maybe Apple should have just stated that its impossible to create a backdoor (the way actual encryption should be). But since we all know that its possible to create one, the fact that there is an option will always spur debate. The most important thing that the author mentions though is "How can the government regain the trust of the people?".

Grishnakh 11y ago
>The most important thing that the author mentions though is "How can the government regain the trust of the people?". Why should it? And do the people even distrust the government? Just look at the Presidential candidates. All the Republicans left are totally in favor of mass surveillance, and Hillary, the choice of mainstream Democrats, of course is a big fan of ubiquitous surveillance. Face it, most of the American public, except maybe the Millenials and Gen-Z, love the idea of having the government spy on them all the time "for their safety".
- goldbeck 11y ago
  > Face it, most of the American public, except maybe the Millenials and Gen-Z, love the idea of having the government spy on them all the time "for their safety". citation needed
  - Grishnakh 11y ago
    Um, I already did: Bernie's the only candidate really against spying, and it's mainly young liberal people who like him. Everyone else, plus conservatives, loves all the other candidates, who are all in favor of spying. Hence, the people want to be spied on. If they didn't, they wouldn't be fans of these candidates.
    - mynameisvlad 11y ago
      You are going through so many logical fallacies I don't even know where to start. But that's not how logic works. None of that is how logic works.

newman314 11y ago

Here's the thing. Governmental credibility should not be a factor. Particularly in light of how things have and will continue to shift over time. Clinton tried to push the Clippet chip through and failed. We can't just say thing got better and now we should help weaken crypto because bad guys and now the government has more credibility. Obviously, things swung back in the opposite direction. So the only safe solution is to build strong crypto always.

wlesieutre 11y ago
The government having credibility now wouldn't guarantee that this would be a good idea forever going into the future. But the fact that the government already doesn't have any credibility on privacy and data protection is a factor. It means that this is already a bad idea as of right now.

rhino369 11y ago

I totally agree the US government shouldn't compel anyone to weaken security generally. So Apple shouldn't be forced to build in a backdoor into products that are released for sale. But this apple request is just exploiting a weakness that already exists. And it would only be doing it on a single phone. And it would be do it pursuant to a legal order by a US court. Also, the US government only has zero credibility in the minds of hardcore activists or extremists. The bulk of the America public trust the FBI to investigate ISIS.

geographomics 11y ago
I agree - this is the type of vulnerability that, assuming Apple is extremely careful about protecting their signing key, is only exploitable by court order or similar state request. This crypto implementation on iPhones and the like isn't really designed to protect against that, it's really more to prevent the common criminal from accessing your personal data. Apple already comply with law enforcement requests to access iCloud backups and other such data, so assisting with this passcode crack isn't really much of a stretch.
- outworlder 11y ago
  > I agree - this is the type of vulnerability that, assuming Apple is extremely careful about protecting their signing key, is only exploitable by court order or similar state request. Apple has been trying to prevent jailbreaking for years - they've always failed, so I'm skeptical about this "only exploitable by court order" bit. Determined people will find ways around the protections. Heck, it is even possible that someone (think nation-states) has already found a way to circumvent the passcode lock. This will only lower the barrier of entry.
  - geographomics 11y ago
    Jailbreaks address a different type of vulnerability - that of incorrectly written code or poorly designed systems, that can lead to a privilege escalation. The vulnerability that the FBI are using is the ability of Apple to update the iPhone with arbitrary code, provided it has been signed with their secret key. It's an important feature, of course, but still a security vulnerability - albeit an irrelevant one for the vast majority of iPhone users.

deleted 11y ago

[deleted]

cortesoft 11y ago

If Apple can do something that will unencrypt the phone, then obviously the vulnerability is already present. How about Apple hacks the phone, then fixes the vulnerability so they can't do it again in the future?

matheweis 11y ago
The analysis I have read from those that understand the technicalities behind it better than I do is that it is because the phone in question is a 5C. e.g. Apple has already fixed the holes in the 6/6S; the concern here is the use of all writs to compel them to unlock the 5C, and the Pandora's box that doing so would open up.
- tantalor 11y ago
  No, the devices with secure enclave (like 6/6S) are just as exploitable by the phonemaker. https://www.techdirt.com/articles/20160218/10371233643/yes-backdoor-that-fbi-is-requesting-can-work-modern-iphones-too.shtml https://www.techdirt.com/articles/20160218/10371233643/yes-b...
  - matheweis 11y ago
    Ugh, if Rob Graham and Bruce Schnier can't be used as a good source... Sounds like Apple needs to update Secure Enclave so that updating wipes the keys.
    - vectorjohn 11y ago
      Yep, exactly. If they did that, and the government was trying to somehow make that illegal, or demand a real backdoor, then it would be time to get up in arms. But that time is not yet.
nxzero 11y ago
How does this fix the issue? NY alone has said they will request Apple unlock roughly 200 phones they already have, so please explain how this is a solution.

yarper 11y ago

The debate is fairly pointless, govt will do whatever they want anyway. The vast majority of people just vote down predestined party lines, and swing voters aren't all the bright educated people we like to think they are. It's just a fact that half of all people are of below average intelligence. Politicians should be a better than average cohort for intelligence, but judging by the incomprehensible jabber they espouse on tech matters I doubt it'll change anytime soon. They seem to spend most of their time trying to dick each other over and make themselves look good rather than actually get shit done.

rhizome 11y ago
How do you figure the government has the ability to "do what they want" in this case?
- qrendel 11y ago
  They can pass laws requiring software to be backdoored without allowing the company to notify the public (similar to what happened to Lavabit), or can use three letter agencies to backdoor most software anyway (similar to what happened with Dual_EC_DRBG).
  - rhizome 11y ago
    Those laws won't be passed in secret.
- kelvin0 11y ago
  I don't think it's a surprise that it has often been the case that some Elements in the gvmt are able to rationalize some objectives they have can trump the 'laws' and other rules ordinary citizens would be held accountable to. For example, The Patriot Act and other measures can be broad enough in scope to allow interpretation which would have some elements think they are invested with the power of spying on their own citizens living within the borders of their country. That's just one example. Iran Contra is also another one, and the list goes on ... The impetus for this type of rogue action will always be present in the circles of power, to allow them to keep their positions.

smileysteve 11y ago

To me, the more important aspect is the U.S.'s failures to maintain their own data integrity. * The OPM breach is a big part of this. * Government domains without SPF or requiring TLS (for instance email) * Social Security Numbers significantly insecure * Secretary of State (GA) losing identities

rm_-rf_slash 11y ago
This is a significantly under appreciated point. Let's assume that the software to unlock an iPhone exists only on one non-networked laptop. Even if it couldn't be remotely hacked, is it too much to expect that the US government - which couldn't even keep the atomic bomb designs from being stolen by the Soviets - is going to keep that information safe and secure forever?
pdkl95 11y ago
* Storing NSA documents without proper (air-gaped) compartmentalization such that it was even possible for one person to access them in bulk.
- junto 11y ago
  Boom. Headshot. Nice point.
- philovivero 11y ago
  In the future, add the proper number of p's into "gapped." The term "air-gaped" activates the neurons that cannot unsee goatse guy.

jwiley 11y ago

I think what's being lost in the shuffle is Apple has no credibility in claiming its protecting your privacy and security. http://money.cnn.com/2014/09/18/technology/security/apple-privacy/ http://money.cnn.com/2014/09/18/technology/security/apple-pr...

white-flame 11y ago
At the center of it all, everybody's scuffling to be the all-seeing eye of the internet. Google/Apple/Facebook/ad networks/etc all want to know everything, to be able to sell & exploit that information. They don't want that precious IP to be diluted and lose value, so they must defend their freedom and autonomy to do what they'd call "evil" if others did it.
oldmanjay 11y ago
That doesn't really seem to be related here. One of the reasons I gave up on Slashdot was how people used any story as a tangent to flog their unrelated hatred of some company. Please don't turn HN into Slashdot.
- jwiley 11y ago
  I'm sorry I gave you the impression I hate Apple, thats certainly not what I intended. One of the implicit ideas underlying Apple's arguments is that they are more trustworthy than the government. But theres a lot of evidence that they are not as strong on privacy as they should be. Casting Apple, and private industry in general as privacy heros does a disservice to those very valid concerns. Heres an article from earlier this month: http://www.theguardian.com/money/2016/feb/05/error-53-apple-iphone-software-update-handset-worthless-third-party-repair http://www.theguardian.com/money/2016/feb/05/error-53-apple-... http://www.forbes.com/sites/gordonkelly/2015/09/16/apple-releases-ios-9/ http://www.forbes.com/sites/gordonkelly/2015/09/16/apple-rel...
  - oldmanjay 11y ago
    None of this gives me the impression that I should trust the government at all, so why bother making the argument against Apple here? It doesn't effectively rebut the article. It just comes off as axe-grinding.

Shivetya 11y ago

I know there is incredible dislike for Rush by many in this community, however his transcript today concerned the issue at hand and was very good. The reason its important is because his audience is large and he actually did a good job with the issue. Normally at the noon hour I simply turn off the radio but when I heard the discussion that came up it was so engrossing that I listened to the whole show. tl;dr no matter what is claimed, if Apple writes this for this one phone it will get out. http://www.rushlimbaugh.com/daily/2016/02/22/how_the_government_bungled_the_handling_of_the_san_bernardino_iphone http://www.rushlimbaugh.com/daily/2016/02/22/how_the_governm...

deelowe 11y ago
Pretty good read. I wish more people in the media would learn a bit about this stuff. He did a great job of keeping the callers in check when they through BS elementary arguments at him like "well why don't they just hack it!"

pdkl95 11y ago

This is the key issue in this entire debate: [T]he Government has ... violated the trust of the American people [and] broken the law themselves by already conducting wholesale surveillance of the citizenry ... Thus, the number one issue, the issue that should preempt all other issues, is how the government regains it's credibility and re-establishes trust. Far too many people - even here on HN - are taking about the government's order to Apple in isolation. The common arguments by the government and its supporters are based on the assumption that any action taken would be limited to the current situation. Except this isn't an isolated situation. The government has been fighting against the free use of encryption for decades. Saying the order given to Apple is limited to this single case is practically admitting ignorance (willful or not) about: * The investigation of Phil Zimmermann and the export of PGP as a a "munition" * Bernstein v. United States * The Clipper Chip (Skipjack) and other key escrow systems of the fist crypto war * "Total Information Awareness" (w/ John Poindexter of the Iran–Contra affair) * The beam splitter in room 641A of AT&T's facility at 611 Folsom St. * The illegalities brought to light by Daniel Ellsberg, William Binney, Thomas Drake, Edward Snowden, and other patriots that kept their oath to defend the constitution. * How many public security standards were ruined as part of BULLRUN and related programs. * The recently-discovered use of "Stingray" devices ("IMSI-catchers") by the FBI. * (I'll just stop the here - there are many other examples that should be included) These actions clearly show a pattern of trying to gain backdoor access or other surveillance capabilities. Yet some people suggest - usually without any evidence - that the government should be trusted. What, specifically, has the government been doing in the area of communication security that has justified any amount of trust? Actions are more important than promises. It would be nice if this wasn't such an adversarial relationship. Unfortunately, this cold civil war we are in where the government treating everyone as a potential criminal by default doesn't leave us with a lot of options. Until we see real actions that regain some amount of the public's trust, the rational approach has to be to not trust the government at all. To do otherwise is either ignorance of history or blind faith that the government never lies.

vectorjohn 11y ago
The government absolutely should not be trusted. That's why Apple shouldn't give them a skeleton key to get into any phone, just the legally compelled access for this specific phone. Apple can make that happen trivially. If the government was telling Apple to make an actual backdoor for any phone, this would be different. Nobody (except the most unreasonable) has any problem with the FBI searching property when they have a legal warrant. That's what is happening here. It's the equivalent of asking a manager to open a storage unit. This specific case is not anything like any of the examples you gave.

redbeard0x0a 11y ago

If I was the NSA, the Chinese Government or a hacker group, I would be working really hard right now to get a foothold on the internal Apple network. To be able to grab any and all data (code, emails, files, etc) from anywhere on the network to try and capture the work that would be required to fulfill the request of this court order. Even if we could trust the US government, we shouldn't be forcing Apple to create this 'master key' anyway. The problem is that anything that has been created digitally cannot be destroyed after it is used. Once the tool is created, we cannot put that genie back in the bottle.

vinceguidry 11y ago
It's recently been shown that this action is purely political, there is nothing material that the FBI stands to gain in their investigation. The entire point is to let the genie out of the bottle.
rtpg 11y ago
It's been covered a couple of times, but Apple is being asked to make a tool that would check that the device ID is the same as the warranted device. That's the essential part. By having a device ID check (combined with digital signage), Apple could publicly release the tool without fear of anything happening on any other phone. Plus people couldn't modify it because that would break the signature.
- swombat 11y ago
  Did you miss the bit where the DoJ has already declared it has hundreds of other phones it will want cracked if Apple is willing to comply to this? Also, if you think having a device ID check is going to do anything, you might want to have a look at the cracks scene and what they do with your pitiful attempts at DRM...

vacri 11y ago

> Ben Franklin's observation that "those who would trade liberty for security deserve neither" It is an opinion, not an observation ('deserve' in particular is not an observation). Just because someone famous said a thing doesn't make it true, or even true-ish. If you want to be such a purist about Franklin's comment, then abolish the police altogether; you'll rapidly see that Franklin's comment is not meant to be read in such a purist way. Or to put it another way: where do you draw the line with Franklin's comment? The article then goes on to talk about gun rights for some reason, with the usual canards thrown in, plus a bit of good ol' selective reporting: "gun deaths are down by half in the past 25 years!", neatly ignoring that they're measuring from the peak, not from the previous baseline. And the US homicide rate is still nearly four times higher than most other western democracies...

dragonwriter 11y ago
> > Ben Franklin's observation that "those who would trade liberty for security deserve neither" > It is an opinion, not an observation* ('deserve' in particular is not an observation). And the quote is both butchered here (the original is: "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety") and -- as it usually is -- applied poorly considering its original context. [0] [0] http://www.npr.org/2015/03/02/390245038/ben-franklins-famous-liberty-safety-quote-lost-its-context-in-21st-century http://www.npr.org/2015/03/02/390245038/ben-franklins-famous...
- vacri 11y ago
  Ah, thanks for that. I've seen the shortened version so often I'd come to believe that was the actual quote. The longer version makes much more sense and is far less absolutist.

hifier 11y ago

I don't like this line of reasoning because it allows for a pro-surveillance outcome if you change the statistics. At what threshold do you switch sides? Ben Franklin is pretty clear and so is the constitution. We don't need to argue on the government agency's terms because we win this argument hands down on principal alone. Please don't weaken the argument.

tn13 11y ago

No governments around the world have any credibility defending the liberty of its people.