5 ms·

Did you miss the part where the government said they were fine with Apple keeping the custom iOS software version in their possession, and not giving it to the

Did you miss the part where the government said they were fine with Apple keeping the custom iOS software version in their possession, and not giving it to the government? http://www.nytimes.com/aponline/2016/02/20/us/politics/ap-us-apple-encryption.html http://www.nytimes.com/aponline/2016/02/20/us/politics/ap-us... "Apple may maintain custody of the software, destroy it after its purpose under the order has been served, refuse to disseminate it outside of Apple and make clear to the world that it does not apply to other devices or users without lawful court orders," the Justice Department told Judge Sheri Pym on Friday. "No one outside Apple would have access to the software required by the order unless Apple itself chose to share it."

deleted 11y ago
[deleted]
- haberman 11y ago
  This argument just doesn't add up to me. Regardless of this court order, Apple already has possession of keys that can sign iOS updates to disable security features. So this "master key" already exists. Meanwhile the government is saying that Apple can delete the tool the moment after the court order is executed, so then what is there to steal? I just don't get the argument that this tool is any more of a "master key" than the actual "master key" Apple already has.
  - cft 11y ago
    This begs the question: can FBI in theory write the modified OS without Apple, and just command Apple to sign it with Apple's private key so it can be loaded without knowing the passcode and booted?
  - deleted 11y ago
    [deleted]
  - deleted 11y ago
    [deleted]
  - jonathankoren 11y ago
    Monday, create a tool for phone A. Tuesday, delete the tool. Wednesday, recreate that same tool, but now for phone B. Thursday, delete the tool. Friday, recreate that same tool, but now for phone C. ... What do you think is going to happen? Oh yeah, there's the git logs too. This is not about one phone. It never was. It's about establishing a behavior. Also, there's no master key. It does not exist. Apple does not have an "actual master key". Maybe Google does, but Apple has said quite clearly, that no such software or key to decrypt phones exists.
    - vectorjohn 11y ago
      The master key they have is the ability to sign firmware updates for all phones that could disable security. The point is, it isn't a new master key. If the key was somehow lost, Apple phones would be vulnerable, just like in the dystopian hypotheticals being thrown around here.
  - oldmanjay 11y ago
    You're thinking of this from the wrong angle. What the FBI is working to build is a legal master key to get information from modern smartphones. It's not difficult to determine this is their objective, as the director of the FBI has asked for as much from Congress. If you didn't realize that, it's easy to see how you're caught up in the wrong argument.
2bitencryption 11y ago
The problem is, Apple designs the software, loads it onto the device, and gives it to the government so they can do their brute force on it. What's preventing the government from just copying the software off the device and keeping it for themselves? Obviously they'd have to do some work to make it universal, but do we really think an agency with pretty much unlimited budget, and brilliant mathematicians, couldn't get it done?
- haberman 11y ago
  Interesting question. I don't know the answer but would be interested to hear anyone with more information weigh in.
- eldavido 11y ago
  "To do some work to make it universal" = code change = thrown hash (the signature which requires the Apple key to create, and proves the software hasn't been tampered with, will be broken/no longer valid) Cryptographic hashes like SHA and AES are designed for "dispersion" meaning, in the idea case, flipping only one bit of the input leads to a 50% probability of every single bit in the hash flipping. So while it's theoretically possible to make a change to the code, and find a way to insert that change that both (1) does the same thing and (2) hashes the same way as the original build, it's probably beyond the realm of what even a motivated attacker could do today.
- plorg 11y ago
  The warrant allows that the phone could be entirely in Apple's possession with the FBI having only programmatic access to the PIN input. Imagine, say, an isolated SSH server with serial access to a PIN input API.
deleted 11y ago
[deleted]
95014_refugee 11y ago
did you miss the part where the government said they would never do this ever again? once the precedent is set, the floodgates will open.

deleted 11y ago

[deleted]

haberman 11y ago
This argument just doesn't add up to me. Regardless of this court order, Apple already has possession of keys that can sign iOS updates to disable security features. So this "master key" already exists. Meanwhile the government is saying that Apple can delete the tool the moment after the court order is executed, so then what is there to steal? I just don't get the argument that this tool is any more of a "master key" than the actual "master key" Apple already has.
- cft 11y ago
  This begs the question: can FBI in theory write the modified OS without Apple, and just command Apple to sign it with Apple's private key so it can be loaded without knowing the passcode and booted?
- deleted 11y ago
  [deleted]
- deleted 11y ago
  [deleted]
- jonathankoren 11y ago
  Monday, create a tool for phone A. Tuesday, delete the tool. Wednesday, recreate that same tool, but now for phone B. Thursday, delete the tool. Friday, recreate that same tool, but now for phone C. ... What do you think is going to happen? Oh yeah, there's the git logs too. This is not about one phone. It never was. It's about establishing a behavior. Also, there's no master key. It does not exist. Apple does not have an "actual master key". Maybe Google does, but Apple has said quite clearly, that no such software or key to decrypt phones exists.
  - vectorjohn 11y ago
    The master key they have is the ability to sign firmware updates for all phones that could disable security. The point is, it isn't a new master key. If the key was somehow lost, Apple phones would be vulnerable, just like in the dystopian hypotheticals being thrown around here.
- oldmanjay 11y ago
  You're thinking of this from the wrong angle. What the FBI is working to build is a legal master key to get information from modern smartphones. It's not difficult to determine this is their objective, as the director of the FBI has asked for as much from Congress. If you didn't realize that, it's easy to see how you're caught up in the wrong argument.

2bitencryption 11y ago

The problem is, Apple designs the software, loads it onto the device, and gives it to the government so they can do their brute force on it. What's preventing the government from just copying the software off the device and keeping it for themselves? Obviously they'd have to do some work to make it universal, but do we really think an agency with pretty much unlimited budget, and brilliant mathematicians, couldn't get it done?

haberman 11y ago
Interesting question. I don't know the answer but would be interested to hear anyone with more information weigh in.
eldavido 11y ago
"To do some work to make it universal" = code change = thrown hash (the signature which requires the Apple key to create, and proves the software hasn't been tampered with, will be broken/no longer valid) Cryptographic hashes like SHA and AES are designed for "dispersion" meaning, in the idea case, flipping only one bit of the input leads to a 50% probability of every single bit in the hash flipping. So while it's theoretically possible to make a change to the code, and find a way to insert that change that both (1) does the same thing and (2) hashes the same way as the original build, it's probably beyond the realm of what even a motivated attacker could do today.
plorg 11y ago
The warrant allows that the phone could be entirely in Apple's possession with the FBI having only programmatic access to the PIN input. Imagine, say, an isolated SSH server with serial access to a PIN input API.

deleted 11y ago

[deleted]

95014_refugee 11y ago

did you miss the part where the government said they would never do this ever again? once the precedent is set, the floodgates will open.