5 ms·

You're telling me you would trust that software to remain in the hands of trusted actors? In 2015, alone, the IRS was breached, LastPass, the director of the CI

by nefitty 11y ago

You're telling me you would trust that software to remain in the hands of trusted actors? In 2015, alone, the IRS was breached, LastPass, the director of the CIA, Hacking Team, even Kaspersky Labs was breached! There can be no absolute guarantee that this backdoor would remain safe indefinitely. That is just the most blatant problem, not to mention the overt displays of cynicism and misuse of authority by the NSA as revealed by the Snowden leaks. Consider the political climate in the US at the moment. Now imagine a truly evil actor came into power, being handed over control of organizations with unheard-of amounts of surveillance power. I don't mean to seem paranoid, but in this case the feeling is completely warranted.

marcoperaza 11y ago
So would it be okay for the FBI to have to bring the phone to Apple?
- lazaroclapp 11y ago
  Only if you think Apple should be an unhackable "trusted actor". Let's face it, the fact that Apple can be compeled to create this bypass is a civil rights issue, but the fact that it can create it at all is already a security bug. One that, in their defense, they seem to be trying to patch a step at a time in newer versions of their devices.
- nefitty 11y ago
  The main point here is that neither the government nor Apple could guarantee that this backdoor software would remain safe. If the FBI brought the phone to Apple to update the custom OS, the software would then exist, which is inherently a dangerous situation. Furthermore, suddenly a precedent is set wherein Apple is obliged to continue unlocking phones for the government with custom created software. I sincerely doubt any organizations involved would tolerate the continual creation and destruction(can data be truly destroyed?) of customized OS's each time the government needed access to a phone. That means, the incentive is to create and maintain this backdoored version of the OS, setting up the exact vulnerability Apple is trying to fend off. Basically, this project, from whatever angle it is approached, has a non-zero chance of backfiring dramatically thus risking the security and privacy of millions of iPhone users throughout the world.
  - spin 11y ago
    I'm under the impression that this "backdoor" is the fact that these phones can download updates to the OS. The phone checks that the update is signed by Apple. If Apple can be trusted to keep their code-signing keys secret, then surely they can be trusted to keep a special version of the OS secret. I'm still opposed to this, though... The FBI wants to be able to dictate to a private company what features to build (because of the All Writs Act).
- danieldk 11y ago
  Don't you see the slippery slope here? Next, the German or French police will knock on Apple's door. When they get access, China, Russia, and others will line up next. Moreover, who says that the FBI or some other agency will stop after this iPhone, or the next 12 iPhones. Why not push to get their own signing key after they succeed in this case? They will try to get as far as possible. We live in 2016. many of our devices with our private data are directly addressable from anywhere in the world. Intentionally weakening encryption and security in any way is a dangerous proposition. It's good that Apple fights this tooth and nail. Sure, it may align up with their PR. I don't care, it benefits every citizen of the net who wants privacy and security.
  - amatix 11y ago
    worse. If this becomes "normal", then rather than the CTO or CSO or VP iOS Engineering having to unlock the code-signing keys to sign releases (presumably via N of M), it'll have to be automated so that "oh, the FBI needs another custom build for the 4th time this week, just do the build and click here to sign it". At that point the security of the master code-signing keys has evaporated to nothing and we're all sunk.
    - rhizome 11y ago
      I think the precedent that emerges could be that law enforcement can force companies to sign specific functionality. This access-to-data power would be in line with their access to telephone and telegraph copper in centuries past.
  - plorg 11y ago
    People keep suggesting that on the slippery slope of Apple complying with cases of limited scope the next logical step is compelling the production of a signing key. This is the very essence of why a slippery slope is often a logical fallacy, because one does not necessarily follow from the other, and no supporting evidence is given that it would. There are plenty of things that would keep this step from occurring, primary among them that there would be no legal justification - in the context of the All Writs Act, there would already be a solution available to law enforcement that was less burdensome to Apple than providing the keys to the kingdom. I, too, think it is laudable that Apple would fight for privacy, but I also think that a lot of the argumentation around this case is soft and ideological.
- deleted 11y ago
  [deleted]
- Tempest1981 11y ago
  What if there were a limit of 3 unlocks a year? Like in NFL football, where the coach is only allowed to challenge 3 plays a game, even if each challenge is successful. (I know, still too slippery a slope) Or if each unlock cost the requester a $10 billion fee (donated to charity)? To make them think harder about when to use an unlock.
  - blisterpeanuts 11y ago
    How about forcing the prosecutor and Director Comey and the judge to place the entire contents of their own phones on a public server? Every call, every email, every GPS coordinate. Let them feel our p.
    - blisterpeanuts 11y ago
      pain.
  - jonesb6 11y ago
    Then there would be another terrorist attack and emergency legislation would be passed giving the coaches 6 challenges.
deleted 11y ago
[deleted]
deleted 11y ago
[deleted]
deleted 11y ago
[deleted]
ordbajsare 11y ago
>truly evil actor came into power Obama is already in power..
csandreasen 11y ago
A gaping "backdoor" already exists in the form of the software update mechanism. By the same logic you're using, Apple can't keep their source code and signing key secure forever, which would be a much worse leak than them losing control of a modified iOS that would let someone brute force a PIN for a phone in their physical possession without the phone being wiped.

by nefitty 11y ago

marcoperaza 11y ago

So would it be okay for the FBI to have to bring the phone to Apple?

lazaroclapp 11y ago
Only if you think Apple should be an unhackable "trusted actor". Let's face it, the fact that Apple can be compeled to create this bypass is a civil rights issue, but the fact that it can create it at all is already a security bug. One that, in their defense, they seem to be trying to patch a step at a time in newer versions of their devices.
nefitty 11y ago
The main point here is that neither the government nor Apple could guarantee that this backdoor software would remain safe. If the FBI brought the phone to Apple to update the custom OS, the software would then exist, which is inherently a dangerous situation. Furthermore, suddenly a precedent is set wherein Apple is obliged to continue unlocking phones for the government with custom created software. I sincerely doubt any organizations involved would tolerate the continual creation and destruction(can data be truly destroyed?) of customized OS's each time the government needed access to a phone. That means, the incentive is to create and maintain this backdoored version of the OS, setting up the exact vulnerability Apple is trying to fend off. Basically, this project, from whatever angle it is approached, has a non-zero chance of backfiring dramatically thus risking the security and privacy of millions of iPhone users throughout the world.
- spin 11y ago
  I'm under the impression that this "backdoor" is the fact that these phones can download updates to the OS. The phone checks that the update is signed by Apple. If Apple can be trusted to keep their code-signing keys secret, then surely they can be trusted to keep a special version of the OS secret. I'm still opposed to this, though... The FBI wants to be able to dictate to a private company what features to build (because of the All Writs Act).
danieldk 11y ago
Don't you see the slippery slope here? Next, the German or French police will knock on Apple's door. When they get access, China, Russia, and others will line up next. Moreover, who says that the FBI or some other agency will stop after this iPhone, or the next 12 iPhones. Why not push to get their own signing key after they succeed in this case? They will try to get as far as possible. We live in 2016. many of our devices with our private data are directly addressable from anywhere in the world. Intentionally weakening encryption and security in any way is a dangerous proposition. It's good that Apple fights this tooth and nail. Sure, it may align up with their PR. I don't care, it benefits every citizen of the net who wants privacy and security.
- amatix 11y ago
  worse. If this becomes "normal", then rather than the CTO or CSO or VP iOS Engineering having to unlock the code-signing keys to sign releases (presumably via N of M), it'll have to be automated so that "oh, the FBI needs another custom build for the 4th time this week, just do the build and click here to sign it". At that point the security of the master code-signing keys has evaporated to nothing and we're all sunk.
  - rhizome 11y ago
    I think the precedent that emerges could be that law enforcement can force companies to sign specific functionality. This access-to-data power would be in line with their access to telephone and telegraph copper in centuries past.
- plorg 11y ago
  People keep suggesting that on the slippery slope of Apple complying with cases of limited scope the next logical step is compelling the production of a signing key. This is the very essence of why a slippery slope is often a logical fallacy, because one does not necessarily follow from the other, and no supporting evidence is given that it would. There are plenty of things that would keep this step from occurring, primary among them that there would be no legal justification - in the context of the All Writs Act, there would already be a solution available to law enforcement that was less burdensome to Apple than providing the keys to the kingdom. I, too, think it is laudable that Apple would fight for privacy, but I also think that a lot of the argumentation around this case is soft and ideological.
deleted 11y ago
[deleted]
Tempest1981 11y ago
What if there were a limit of 3 unlocks a year? Like in NFL football, where the coach is only allowed to challenge 3 plays a game, even if each challenge is successful. (I know, still too slippery a slope) Or if each unlock cost the requester a $10 billion fee (donated to charity)? To make them think harder about when to use an unlock.
- blisterpeanuts 11y ago
  How about forcing the prosecutor and Director Comey and the judge to place the entire contents of their own phones on a public server? Every call, every email, every GPS coordinate. Let them feel our p.
  - blisterpeanuts 11y ago
    pain.
- jonesb6 11y ago
  Then there would be another terrorist attack and emergency legislation would be passed giving the coaches 6 challenges.

deleted 11y ago

[deleted]

deleted 11y ago

[deleted]

deleted 11y ago

[deleted]

ordbajsare 11y ago

>truly evil actor came into power Obama is already in power..

csandreasen 11y ago

A gaping "backdoor" already exists in the form of the software update mechanism. By the same logic you're using, Apple can't keep their source code and signing key secure forever, which would be a much worse leak than them losing control of a modified iOS that would let someone brute force a PIN for a phone in their physical possession without the phone being wiped.