4 ms·

This could be possible if at setup time the user was asked to create their own key, which any update would have to be signed with. This would then unburden Appl

by nefitty 11y ago

This could be possible if at setup time the user was asked to create their own key, which any update would have to be signed with. This would then unburden Apple of having the "master key" needed to sign software updates, but would create an extra hoop for users to jump through to update their phone. I'm sure we've all experienced putting off a necessary update to software because of the inconvenience it would cause. Imagine millions of iPhones becoming vulnerable overnight because of mass user laziness.

abecedarius 11y ago
Presumably you could set up to automatically sign anything signed by Apple, if that tradeoff suits you.
- nefitty 11y ago
  The security issue of Apple being vulnerable to being compelled to create signed backdoors would still remain, in that case.
  - abecedarius 11y ago
    Yes, for the people who chose to be, when they chose. This choice would be decoupled from the OS choice.
nindalf 11y ago
How about a simpler rule like "no updates will install unless the phone is unlocked"? Such a rule would make discussion in the San Bernardino case moot. In response, the government would have to outlaw this practice and force device makers to retain the ability to push updates to a locked phone.
- cesarb 11y ago
  From what I understand, the discussion is about an update being installed through the low-level bootloader, while the phone being locked is a function of the higher-level operating system (which probably already has the "no updates will install unless the phone is unlocked" rule). The relevant rule would instead be something like "installing any update through the low-level bootloader always wipes the encryption keys and the data partition". Normal updates wouldn't be through the low-level bootloader, so this rule isn't too restrictive. Not that it makes any difference. The attackers in this case don't have to install the update in any normal way, be it through the normal operating system or the bootloader; they can instead desolder the NAND chips and write the update directly to them. What I believe the attackers actually need is a signature from Apple. If the bootloader chain checks the operating system's signature, it won't boot unless it's signed by Apple.

by nefitty 11y ago

abecedarius 11y ago

Presumably you could set up to automatically sign anything signed by Apple, if that tradeoff suits you.

nefitty 11y ago
The security issue of Apple being vulnerable to being compelled to create signed backdoors would still remain, in that case.
- abecedarius 11y ago
  Yes, for the people who chose to be, when they chose. This choice would be decoupled from the OS choice.

nindalf 11y ago

How about a simpler rule like "no updates will install unless the phone is unlocked"? Such a rule would make discussion in the San Bernardino case moot. In response, the government would have to outlaw this practice and force device makers to retain the ability to push updates to a locked phone.

cesarb 11y ago
From what I understand, the discussion is about an update being installed through the low-level bootloader, while the phone being locked is a function of the higher-level operating system (which probably already has the "no updates will install unless the phone is unlocked" rule). The relevant rule would instead be something like "installing any update through the low-level bootloader always wipes the encryption keys and the data partition". Normal updates wouldn't be through the low-level bootloader, so this rule isn't too restrictive. Not that it makes any difference. The attackers in this case don't have to install the update in any normal way, be it through the normal operating system or the bootloader; they can instead desolder the NAND chips and write the update directly to them. What I believe the attackers actually need is a signature from Apple. If the bootloader chain checks the operating system's signature, it won't boot unless it's signed by Apple.