2 ms·

By your definition then, the iPhone doesn't grant real security since Apple is capable of installing this modified iOS version. So given that the iPhone is not

By your definition then, the iPhone doesn't grant real security since Apple is capable of installing this modified iOS version. So given that the iPhone is not secure, what do you think about whether Apple should execute this court order?

sjwright 11y ago
The iPhone does grant real security, it just requires the user to choose an encryption key that isn't trivially brute forced. (And depending on the circumstances, forego use of the fingerprint reader.) If the dead attacker had a twelve character passphrase, any amount of help from Apple would be utterly useless. Apple could write all the back-doors they liked but if the content is encrypted and the key is unknown, brute forcing is the only option. The addition of the secure enclave makes it potentially infeasible to extract the UID so that the brute forcing could be performed on a powerful supercomputer. It depends how well the enclave has been hardened against firmware changes. Can the enclave receive a seamless firmware update while in a locked state? Can the enclave firmware be rewritten to output the UID to the main CPU? We don't know.
MacsHeadroom 11y ago
The iPhone is secure when used with a complex passcode (something like 11 years to crack an 8 character password), even if Apple aids the FBI. So individuals who know and care enough, like terrorists, will still be just as secure. But common people won't. So no, Apple should absolutely not destroy the security of hundreds of millions of individuals just because some government agency wants a shot at access to some dead guy's phone. What happens when the PRC or Saudi equivalent of the FBI demands the same for an FBI agents phone? Why should the populace and Apple have to suffer for making the world more secure?
- deleted 11y ago
  [deleted]
- vehementi 11y ago
  > So no, Apple should absolutely not destroy the security of hundreds of millions of individuals Wait, how did you get to that point?

sjwright 11y ago

The iPhone does grant real security, it just requires the user to choose an encryption key that isn't trivially brute forced. (And depending on the circumstances, forego use of the fingerprint reader.) If the dead attacker had a twelve character passphrase, any amount of help from Apple would be utterly useless. Apple could write all the back-doors they liked but if the content is encrypted and the key is unknown, brute forcing is the only option. The addition of the secure enclave makes it potentially infeasible to extract the UID so that the brute forcing could be performed on a powerful supercomputer. It depends how well the enclave has been hardened against firmware changes. Can the enclave receive a seamless firmware update while in a locked state? Can the enclave firmware be rewritten to output the UID to the main CPU? We don't know.

MacsHeadroom 11y ago

The iPhone is secure when used with a complex passcode (something like 11 years to crack an 8 character password), even if Apple aids the FBI. So individuals who know and care enough, like terrorists, will still be just as secure. But common people won't. So no, Apple should absolutely not destroy the security of hundreds of millions of individuals just because some government agency wants a shot at access to some dead guy's phone. What happens when the PRC or Saudi equivalent of the FBI demands the same for an FBI agents phone? Why should the populace and Apple have to suffer for making the world more secure?

deleted 11y ago
[deleted]
vehementi 11y ago
> So no, Apple should absolutely not destroy the security of hundreds of millions of individuals Wait, how did you get to that point?