5 ms·

I'm really trying to figure out what this case is really about, vs. what the players are saying it is about. The government says it just wants to unlock this o

I'm really trying to figure out what this case is really about, vs. what the players are saying it is about. The government says it just wants to unlock this one iPhone. But is it really just looking for a legal precedent in a case that the public is likely to support the unlocking? Apple says is it afraid of creating a "master key" that could fall into the wrong hands. But doesn't it already have such a key, in the form of a signing key controlling what payloads the iPhone will agree to load? Is Apple primarily concerned with both precedent and perception of security on its phones? I personally feel that any mechanism by which iPhones could be unlocked with a warrant -- but only with a warrant (ie. the gov't physically lacks the capability to do it themselves) -- is a good compromise. It's in Apple's interest to push back on such requests, so you have two powerful and well-funded entities adversarially fighting to define the line of what can get unlocked and what can't. Now NSL's, those are a whole different kettle of fish.

Bud 11y ago
The problem is that there is no mechanism by which iPhones can have a back door, but only for the good guys and only with a warrant. That does not exist. And it never can exist. There is no grey area for compromise here. The encryption is either secure and free of known backdoors—and thus it grants real security—or it isn't, and it doesn't.
- vectorjohn 11y ago
  You are making that up. Of course there is such a mechanism. What do you think software signing is but a way for the good guys and only the good guys to run code on your device? It's exactly the same. All Apple has to do is make a piece of software that only runs on this phone and sign it. Then nobody can be attacked except this one phone. And it had to go through a warrant and all! And to your last point: this software is not secure. That's why we have this backdoor option.
  - deleted 11y ago
    [deleted]
  - deleted 11y ago
    [deleted]
  - deleted 11y ago
    [deleted]
  - aljones 11y ago
    Now wait. If the passcode is complex then it is secure, which is a very typical requirement for security.
    - vectorjohn 11y ago
      Which doesn't change regardless of the outcome of this FBI case.
      - aljones 11y ago
        Indeed, people who valued their security highly, like terrorists, would still have security, but the common person would not.
  - deleted 11y ago
    [deleted]
  - Johnny555 11y ago
    The problem with that thinking is that there is no firm definition of the "Good Guys", and the guys you think are good today, may not be so good tomorrow. > this software is not secure. That's why we have this backdoor option. It's not perfectly secure, but still awfully secure if even the US Government can't break it themselves.
    - acqq 11y ago
      > still awfully secure I believe they were just sloppy: http://abcnews.go.com/US/san-bernardino-shooters-apple-id-passcode-changed-government/story?id=37066070 http://abcnews.go.com/US/san-bernardino-shooters-apple-id-pa... "San Bernardino Shooter's iCloud Password Changed While iPhone was in Government Possession" The information wasn't "awfully" secured.
      - imron 11y ago
        After watching this whole thing play out, I'm seriously wondering whether 'sloppy' was actually 'on purpose because this is a great chance to establish precedent'.
  - JupiterMoon 11y ago
    > All Apple has to do is make a piece of software that only runs on this phone and sign it. (Emphasis added) Just wondering how they can manage to produce something that will only run on this phone?
    - tlrobinson 11y ago
      Easy. Since iOS software must be signed by Apple they could simply hard code a check for a specific device ID, and immediately exit if it doesn't match. Then they sign that specific binary.
      - deleted 11y ago
        [deleted]
      - EdHominem 11y ago
        That isn't really easy. 99% of the phone can be tampered with when running, after the signature is checked at install. They'd need to put that check in the secure enclave to make sure that it wasn't simply bypassed. That might not even be possible on that model.
- haberman 11y ago
  By your definition then, the iPhone doesn't grant real security since Apple is capable of installing this modified iOS version. So given that the iPhone is not secure, what do you think about whether Apple should execute this court order?
  - sjwright 11y ago
    The iPhone does grant real security, it just requires the user to choose an encryption key that isn't trivially brute forced. (And depending on the circumstances, forego use of the fingerprint reader.) If the dead attacker had a twelve character passphrase, any amount of help from Apple would be utterly useless. Apple could write all the back-doors they liked but if the content is encrypted and the key is unknown, brute forcing is the only option. The addition of the secure enclave makes it potentially infeasible to extract the UID so that the brute forcing could be performed on a powerful supercomputer. It depends how well the enclave has been hardened against firmware changes. Can the enclave receive a seamless firmware update while in a locked state? Can the enclave firmware be rewritten to output the UID to the main CPU? We don't know.
  - MacsHeadroom 11y ago
    The iPhone is secure when used with a complex passcode (something like 11 years to crack an 8 character password), even if Apple aids the FBI. So individuals who know and care enough, like terrorists, will still be just as secure. But common people won't. So no, Apple should absolutely not destroy the security of hundreds of millions of individuals just because some government agency wants a shot at access to some dead guy's phone. What happens when the PRC or Saudi equivalent of the FBI demands the same for an FBI agents phone? Why should the populace and Apple have to suffer for making the world more secure?
    - deleted 11y ago
      [deleted]
    - vehementi 11y ago
      > So no, Apple should absolutely not destroy the security of hundreds of millions of individuals Wait, how did you get to that point?
- deleted 11y ago
  [deleted]
deleted 11y ago
[deleted]
- deleted 11y ago
  [deleted]
- iancarroll 11y ago
  I'm pretty sure iOS updates are signed per device, as that's why everyone backs up their signatures for old versions (so that they can go back while Apple isn't signing them). So Apple could only sign this backdoor for one device. http://www.saurik.com/id/12 http://www.saurik.com/id/12
- haberman 11y ago
  Did you miss the part where the government said they were fine with Apple keeping the custom iOS software version in their possession, and not giving it to the government? http://www.nytimes.com/aponline/2016/02/20/us/politics/ap-us-apple-encryption.html http://www.nytimes.com/aponline/2016/02/20/us/politics/ap-us... "Apple may maintain custody of the software, destroy it after its purpose under the order has been served, refuse to disseminate it outside of Apple and make clear to the world that it does not apply to other devices or users without lawful court orders," the Justice Department told Judge Sheri Pym on Friday. "No one outside Apple would have access to the software required by the order unless Apple itself chose to share it."
  - deleted 11y ago
    [deleted]
    - haberman 11y ago
      This argument just doesn't add up to me. Regardless of this court order, Apple already has possession of keys that can sign iOS updates to disable security features. So this "master key" already exists. Meanwhile the government is saying that Apple can delete the tool the moment after the court order is executed, so then what is there to steal? I just don't get the argument that this tool is any more of a "master key" than the actual "master key" Apple already has.
altitudinous 11y ago
It is about the precedent. Consider that the current fully secure Apple device situation is point A, and the fully exploited your private data is easily extracted by criminals easily cracked Apple device situation is point Z. The FBI is currently arguing for point B - just this device. The argument is - it is so close to point A, there is no issue! If the FBI wins point B, then they will argue for point C. - it is so close to point B, there is no issue! If the FBI wins point C, then they will argue for point D. - it is so close to point C, there is no issue! Repeat over and over. At about point M or sooner an exploit or the extraction processes to the gradually less secure device would probably become available to governments through means legal or otherwise and we would probably hit point Z straight away. Apple are trying to stop the inevitable by not starting, the FBI are arguing for point B.
- stephenboyd 11y ago
  It's not just the FBI. If Apple builds an OS update to make that specific iPhone easier to unlock, they'll be setting an international precedent for all countries that they do business in. So the Russians, Chinese, Saudis, etc will see it as an option when they want access to a phone that they see as in their national interest to unlock. This could even lead to a phone with US state secrets being cracked for a rival country.
  - aljones 11y ago
    And they wouldn't just ask Apple.
    - stephenboyd 11y ago
      And they wouldn't be limited to devices in their jurisdiction belonging to the dead or incarcerated. Governments can ask Apple or Microsoft to push updates that copy data to controlled cloud storage accounts. The unwitting target will just unlock their device in their home country like they usually do before the trojan security update starts working.
      - 11y ago
cft 11y ago
Theoretical question: can the FBI create the modified OS without Apple, and simply command Apple to sign it with Apple's private key, so that it can be installed on this phone without entering the passcode? Granted without the source code it would be quite difficult, but in theory, is signing the software with Apple's bootloader private key which is the same for each class of phones the only thing required?
- vectorjohn 11y ago
  Nothing, but that would be terrible. We WANT Apple to do it because they could ensure the software is device locked.
  - umanwizard 11y ago
    Apple could just bindiff to figure out what changed in the FBI's version.
- vehementi 11y ago
  Yes that would be possible. It's weird to me that the phone will accept updates while locked...
  - cft 11y ago
    > It's weird to me that the phone will accept updates while locked... I suppose this was left there to be able to reset the phones to the factory state after 10 wrong attempts to enter the code.
EdHominem 11y ago
If the government honestly wanted that iPhone cracked it'd turn to someone like Chipworks and simply subpoena whatever info they needed from Apple. They're forcing Apple to kill its own children as a sick sort of game.
- mathiasrw 11y ago
  +1
Rapzid 11y ago
Apple's endgame is saving face and customer trust. Just last year they were touting customer controlled security and privacy. This year the FBI wants them to help access a phone and what do you, they actually can! Oops. Failure on Apple's part which I'll come back to. Now, it sounds to me like Apple is just going to disable the auto-erase on pin failure and retry timeout, but not many people will understand that. The FBI's endgame is requiring companies to build backdoors into their devices. Once they are able to successfully compel a company such as Apple to help them break into the phone, they are very close to compelling congress to pass laws to require that the option be available in the first place. "Hey, the court told them to do it before so why should they be allowed to block future need?". Here is where Apple's screw up comes into play. After all this they could shore up the security gaps to further remove themselves from the equation, but after a successful court order the FBI will move to block them from making an even more secure device.
eldavido 11y ago
IMO the main issue is how far the government can lawfully push a third party to help with an ongoing investigation. Putting aside the technical issues for a minute, let's say everyone agrees Apple ought to help the US government's investigation of the San Bernideno terrorism case. Fine, and Apple might want to help, but how does their desire to help weigh against the hassle and expense of creating a new build of the OS every time something bad happens? Will it eventually get to a point where every impounded phone, of which I have to believe there are millions, can have a warrant issued and Apple has to help get the data out? They'd have to set up an entire department just to comply with the FBI's requests. At the scale of global law enforcement, it doesn't look so unreasonable that this ongoing nusiance will cost a ton of money and impair their ability to operate for their shareholders. There's the encryption stuff, and how we have a right to privacy, but the real question is just how far a company has to go when the government asks for help with an investigation.
akerro 11y ago
Corporations make good PR so you can trust them with more of your personal data, while PRISM still is operating, Facebook and Apple are still cooperating with NSA. The more and more NSA friendly corporations back Apple the less I trust all of them.
- jonathankoren 11y ago
  > while PRISM still is operating, Facebook and Apple are still cooperating with NSA. [citation needed]
AceJohnny2 11y ago
Here you go: http://www.apple.com/customer-letter/answers/ http://www.apple.com/customer-letter/answers/
citizensixteen 11y ago
>I'm really trying to figure out what this case is really about, vs. what the players are saying it is about. If the government hacks the iPhone themselves, they don't get the legal precedent they are so desperate to establish in this case. This paves the way for legislation that forces technology companies to install backdoors in software/hardware. This case is not about the data on the phone itself, the government is simply continuing the crypto wars. https://en.wikipedia.org/wiki/Crypto_Wars https://en.wikipedia.org/wiki/Crypto_Wars
- vehementi 11y ago
  The government is not capable of hacking the phone themselves.
- droopybuns 11y ago
  I think that Apple is concerned about class action lawsuits that will target Tim Cooks claims that not even apple can access customer data. They are really in a terrible position. No CEO wants to do interviews dedicated to a conflict with law enforcement. This is about a massive pile of unaccessable cash and the threat of a major lawsuit. It makes sense that cook wants to invest in legislators who will listen to their lobbying cash and provide class action protection over gambling in the courts.
deepnet 11y ago
Facebook 'protecting' user data is so laughable that it suggests this is all public reassurance theatre.

Bud 11y ago

The problem is that there is no mechanism by which iPhones can have a back door, but only for the good guys and only with a warrant. That does not exist. And it never can exist. There is no grey area for compromise here. The encryption is either secure and free of known backdoors—and thus it grants real security—or it isn't, and it doesn't.

vectorjohn 11y ago
You are making that up. Of course there is such a mechanism. What do you think software signing is but a way for the good guys and only the good guys to run code on your device? It's exactly the same. All Apple has to do is make a piece of software that only runs on this phone and sign it. Then nobody can be attacked except this one phone. And it had to go through a warrant and all! And to your last point: this software is not secure. That's why we have this backdoor option.
- deleted 11y ago
  [deleted]
- deleted 11y ago
  [deleted]
- deleted 11y ago
  [deleted]
- aljones 11y ago
  Now wait. If the passcode is complex then it is secure, which is a very typical requirement for security.
  - vectorjohn 11y ago
    Which doesn't change regardless of the outcome of this FBI case.
    - aljones 11y ago
      Indeed, people who valued their security highly, like terrorists, would still have security, but the common person would not.
- deleted 11y ago
  [deleted]
- Johnny555 11y ago
  The problem with that thinking is that there is no firm definition of the "Good Guys", and the guys you think are good today, may not be so good tomorrow. > this software is not secure. That's why we have this backdoor option. It's not perfectly secure, but still awfully secure if even the US Government can't break it themselves.
  - acqq 11y ago
    > still awfully secure I believe they were just sloppy: http://abcnews.go.com/US/san-bernardino-shooters-apple-id-passcode-changed-government/story?id=37066070 http://abcnews.go.com/US/san-bernardino-shooters-apple-id-pa... "San Bernardino Shooter's iCloud Password Changed While iPhone was in Government Possession" The information wasn't "awfully" secured.
    - imron 11y ago
      After watching this whole thing play out, I'm seriously wondering whether 'sloppy' was actually 'on purpose because this is a great chance to establish precedent'.
- JupiterMoon 11y ago
  > All Apple has to do is make a piece of software that only runs on this phone and sign it. (Emphasis added) Just wondering how they can manage to produce something that will only run on this phone?
  - tlrobinson 11y ago
    Easy. Since iOS software must be signed by Apple they could simply hard code a check for a specific device ID, and immediately exit if it doesn't match. Then they sign that specific binary.
    - deleted 11y ago
      [deleted]
    - EdHominem 11y ago
      That isn't really easy. 99% of the phone can be tampered with when running, after the signature is checked at install. They'd need to put that check in the secure enclave to make sure that it wasn't simply bypassed. That might not even be possible on that model.
haberman 11y ago
By your definition then, the iPhone doesn't grant real security since Apple is capable of installing this modified iOS version. So given that the iPhone is not secure, what do you think about whether Apple should execute this court order?
- sjwright 11y ago
  The iPhone does grant real security, it just requires the user to choose an encryption key that isn't trivially brute forced. (And depending on the circumstances, forego use of the fingerprint reader.) If the dead attacker had a twelve character passphrase, any amount of help from Apple would be utterly useless. Apple could write all the back-doors they liked but if the content is encrypted and the key is unknown, brute forcing is the only option. The addition of the secure enclave makes it potentially infeasible to extract the UID so that the brute forcing could be performed on a powerful supercomputer. It depends how well the enclave has been hardened against firmware changes. Can the enclave receive a seamless firmware update while in a locked state? Can the enclave firmware be rewritten to output the UID to the main CPU? We don't know.
- MacsHeadroom 11y ago
  The iPhone is secure when used with a complex passcode (something like 11 years to crack an 8 character password), even if Apple aids the FBI. So individuals who know and care enough, like terrorists, will still be just as secure. But common people won't. So no, Apple should absolutely not destroy the security of hundreds of millions of individuals just because some government agency wants a shot at access to some dead guy's phone. What happens when the PRC or Saudi equivalent of the FBI demands the same for an FBI agents phone? Why should the populace and Apple have to suffer for making the world more secure?
  - deleted 11y ago
    [deleted]
  - vehementi 11y ago
    > So no, Apple should absolutely not destroy the security of hundreds of millions of individuals Wait, how did you get to that point?
deleted 11y ago
[deleted]

deleted 11y ago

[deleted]

deleted 11y ago
[deleted]
iancarroll 11y ago
I'm pretty sure iOS updates are signed per device, as that's why everyone backs up their signatures for old versions (so that they can go back while Apple isn't signing them). So Apple could only sign this backdoor for one device. http://www.saurik.com/id/12 http://www.saurik.com/id/12
haberman 11y ago
Did you miss the part where the government said they were fine with Apple keeping the custom iOS software version in their possession, and not giving it to the government? http://www.nytimes.com/aponline/2016/02/20/us/politics/ap-us-apple-encryption.html http://www.nytimes.com/aponline/2016/02/20/us/politics/ap-us... "Apple may maintain custody of the software, destroy it after its purpose under the order has been served, refuse to disseminate it outside of Apple and make clear to the world that it does not apply to other devices or users without lawful court orders," the Justice Department told Judge Sheri Pym on Friday. "No one outside Apple would have access to the software required by the order unless Apple itself chose to share it."
- deleted 11y ago
  [deleted]
  - haberman 11y ago
    This argument just doesn't add up to me. Regardless of this court order, Apple already has possession of keys that can sign iOS updates to disable security features. So this "master key" already exists. Meanwhile the government is saying that Apple can delete the tool the moment after the court order is executed, so then what is there to steal? I just don't get the argument that this tool is any more of a "master key" than the actual "master key" Apple already has.

altitudinous 11y ago

It is about the precedent. Consider that the current fully secure Apple device situation is point A, and the fully exploited your private data is easily extracted by criminals easily cracked Apple device situation is point Z. The FBI is currently arguing for point B - just this device. The argument is - it is so close to point A, there is no issue! If the FBI wins point B, then they will argue for point C. - it is so close to point B, there is no issue! If the FBI wins point C, then they will argue for point D. - it is so close to point C, there is no issue! Repeat over and over. At about point M or sooner an exploit or the extraction processes to the gradually less secure device would probably become available to governments through means legal or otherwise and we would probably hit point Z straight away. Apple are trying to stop the inevitable by not starting, the FBI are arguing for point B.

stephenboyd 11y ago
It's not just the FBI. If Apple builds an OS update to make that specific iPhone easier to unlock, they'll be setting an international precedent for all countries that they do business in. So the Russians, Chinese, Saudis, etc will see it as an option when they want access to a phone that they see as in their national interest to unlock. This could even lead to a phone with US state secrets being cracked for a rival country.
- aljones 11y ago
  And they wouldn't just ask Apple.
  - stephenboyd 11y ago
    And they wouldn't be limited to devices in their jurisdiction belonging to the dead or incarcerated. Governments can ask Apple or Microsoft to push updates that copy data to controlled cloud storage accounts. The unwitting target will just unlock their device in their home country like they usually do before the trojan security update starts working.
    - 11y ago

cft 11y ago

Theoretical question: can the FBI create the modified OS without Apple, and simply command Apple to sign it with Apple's private key, so that it can be installed on this phone without entering the passcode? Granted without the source code it would be quite difficult, but in theory, is signing the software with Apple's bootloader private key which is the same for each class of phones the only thing required?

vectorjohn 11y ago
Nothing, but that would be terrible. We WANT Apple to do it because they could ensure the software is device locked.
- umanwizard 11y ago
  Apple could just bindiff to figure out what changed in the FBI's version.
vehementi 11y ago
Yes that would be possible. It's weird to me that the phone will accept updates while locked...
- cft 11y ago
  > It's weird to me that the phone will accept updates while locked... I suppose this was left there to be able to reset the phones to the factory state after 10 wrong attempts to enter the code.

EdHominem 11y ago

If the government honestly wanted that iPhone cracked it'd turn to someone like Chipworks and simply subpoena whatever info they needed from Apple. They're forcing Apple to kill its own children as a sick sort of game.

mathiasrw 11y ago
+1

Rapzid 11y ago

Apple's endgame is saving face and customer trust. Just last year they were touting customer controlled security and privacy. This year the FBI wants them to help access a phone and what do you, they actually can! Oops. Failure on Apple's part which I'll come back to. Now, it sounds to me like Apple is just going to disable the auto-erase on pin failure and retry timeout, but not many people will understand that. The FBI's endgame is requiring companies to build backdoors into their devices. Once they are able to successfully compel a company such as Apple to help them break into the phone, they are very close to compelling congress to pass laws to require that the option be available in the first place. "Hey, the court told them to do it before so why should they be allowed to block future need?". Here is where Apple's screw up comes into play. After all this they could shore up the security gaps to further remove themselves from the equation, but after a successful court order the FBI will move to block them from making an even more secure device.

eldavido 11y ago

IMO the main issue is how far the government can lawfully push a third party to help with an ongoing investigation. Putting aside the technical issues for a minute, let's say everyone agrees Apple ought to help the US government's investigation of the San Bernideno terrorism case. Fine, and Apple might want to help, but how does their desire to help weigh against the hassle and expense of creating a new build of the OS every time something bad happens? Will it eventually get to a point where every impounded phone, of which I have to believe there are millions, can have a warrant issued and Apple has to help get the data out? They'd have to set up an entire department just to comply with the FBI's requests. At the scale of global law enforcement, it doesn't look so unreasonable that this ongoing nusiance will cost a ton of money and impair their ability to operate for their shareholders. There's the encryption stuff, and how we have a right to privacy, but the real question is just how far a company has to go when the government asks for help with an investigation.

akerro 11y ago

Corporations make good PR so you can trust them with more of your personal data, while PRISM still is operating, Facebook and Apple are still cooperating with NSA. The more and more NSA friendly corporations back Apple the less I trust all of them.

jonathankoren 11y ago
> while PRISM still is operating, Facebook and Apple are still cooperating with NSA. [citation needed]

AceJohnny2 11y ago

Here you go: http://www.apple.com/customer-letter/answers/ http://www.apple.com/customer-letter/answers/

citizensixteen 11y ago

>I'm really trying to figure out what this case is really about, vs. what the players are saying it is about. If the government hacks the iPhone themselves, they don't get the legal precedent they are so desperate to establish in this case. This paves the way for legislation that forces technology companies to install backdoors in software/hardware. This case is not about the data on the phone itself, the government is simply continuing the crypto wars. https://en.wikipedia.org/wiki/Crypto_Wars https://en.wikipedia.org/wiki/Crypto_Wars

vehementi 11y ago
The government is not capable of hacking the phone themselves.
droopybuns 11y ago
I think that Apple is concerned about class action lawsuits that will target Tim Cooks claims that not even apple can access customer data. They are really in a terrible position. No CEO wants to do interviews dedicated to a conflict with law enforcement. This is about a massive pile of unaccessable cash and the threat of a major lawsuit. It makes sense that cook wants to invest in legislators who will listen to their lobbying cash and provide class action protection over gambling in the courts.

deepnet 11y ago

Facebook 'protecting' user data is so laughable that it suggests this is all public reassurance theatre.