3 ms·

So would it be okay for the FBI to have to bring the phone to Apple?

lazaroclapp 11y ago
Only if you think Apple should be an unhackable "trusted actor". Let's face it, the fact that Apple can be compeled to create this bypass is a civil rights issue, but the fact that it can create it at all is already a security bug. One that, in their defense, they seem to be trying to patch a step at a time in newer versions of their devices.
nefitty 11y ago
The main point here is that neither the government nor Apple could guarantee that this backdoor software would remain safe. If the FBI brought the phone to Apple to update the custom OS, the software would then exist, which is inherently a dangerous situation. Furthermore, suddenly a precedent is set wherein Apple is obliged to continue unlocking phones for the government with custom created software. I sincerely doubt any organizations involved would tolerate the continual creation and destruction(can data be truly destroyed?) of customized OS's each time the government needed access to a phone. That means, the incentive is to create and maintain this backdoored version of the OS, setting up the exact vulnerability Apple is trying to fend off. Basically, this project, from whatever angle it is approached, has a non-zero chance of backfiring dramatically thus risking the security and privacy of millions of iPhone users throughout the world.
- spin 11y ago
  I'm under the impression that this "backdoor" is the fact that these phones can download updates to the OS. The phone checks that the update is signed by Apple. If Apple can be trusted to keep their code-signing keys secret, then surely they can be trusted to keep a special version of the OS secret. I'm still opposed to this, though... The FBI wants to be able to dictate to a private company what features to build (because of the All Writs Act).
danieldk 11y ago
Don't you see the slippery slope here? Next, the German or French police will knock on Apple's door. When they get access, China, Russia, and others will line up next. Moreover, who says that the FBI or some other agency will stop after this iPhone, or the next 12 iPhones. Why not push to get their own signing key after they succeed in this case? They will try to get as far as possible. We live in 2016. many of our devices with our private data are directly addressable from anywhere in the world. Intentionally weakening encryption and security in any way is a dangerous proposition. It's good that Apple fights this tooth and nail. Sure, it may align up with their PR. I don't care, it benefits every citizen of the net who wants privacy and security.
- amatix 11y ago
  worse. If this becomes "normal", then rather than the CTO or CSO or VP iOS Engineering having to unlock the code-signing keys to sign releases (presumably via N of M), it'll have to be automated so that "oh, the FBI needs another custom build for the 4th time this week, just do the build and click here to sign it". At that point the security of the master code-signing keys has evaporated to nothing and we're all sunk.
  - rhizome 11y ago
    I think the precedent that emerges could be that law enforcement can force companies to sign specific functionality. This access-to-data power would be in line with their access to telephone and telegraph copper in centuries past.
- plorg 11y ago
  People keep suggesting that on the slippery slope of Apple complying with cases of limited scope the next logical step is compelling the production of a signing key. This is the very essence of why a slippery slope is often a logical fallacy, because one does not necessarily follow from the other, and no supporting evidence is given that it would. There are plenty of things that would keep this step from occurring, primary among them that there would be no legal justification - in the context of the All Writs Act, there would already be a solution available to law enforcement that was less burdensome to Apple than providing the keys to the kingdom. I, too, think it is laudable that Apple would fight for privacy, but I also think that a lot of the argumentation around this case is soft and ideological.
deleted 11y ago
[deleted]
Tempest1981 11y ago
What if there were a limit of 3 unlocks a year? Like in NFL football, where the coach is only allowed to challenge 3 plays a game, even if each challenge is successful. (I know, still too slippery a slope) Or if each unlock cost the requester a $10 billion fee (donated to charity)? To make them think harder about when to use an unlock.
- blisterpeanuts 11y ago
  How about forcing the prosecutor and Director Comey and the judge to place the entire contents of their own phones on a public server? Every call, every email, every GPS coordinate. Let them feel our p.
  - blisterpeanuts 11y ago
    pain.
- jonesb6 11y ago
  Then there would be another terrorist attack and emergency legislation would be passed giving the coaches 6 challenges.

Only if you think Apple should be an unhackable "trusted actor". Let's face it, the fact that Apple can be compeled to create this bypass is a civil rights issue, but the fact that it can create it at all is already a security bug. One that, in their defense, they seem to be trying to patch a step at a time in newer versions of their devices.

nefitty 11y ago

The main point here is that neither the government nor Apple could guarantee that this backdoor software would remain safe. If the FBI brought the phone to Apple to update the custom OS, the software would then exist, which is inherently a dangerous situation. Furthermore, suddenly a precedent is set wherein Apple is obliged to continue unlocking phones for the government with custom created software. I sincerely doubt any organizations involved would tolerate the continual creation and destruction(can data be truly destroyed?) of customized OS's each time the government needed access to a phone. That means, the incentive is to create and maintain this backdoored version of the OS, setting up the exact vulnerability Apple is trying to fend off. Basically, this project, from whatever angle it is approached, has a non-zero chance of backfiring dramatically thus risking the security and privacy of millions of iPhone users throughout the world.

spin 11y ago
I'm under the impression that this "backdoor" is the fact that these phones can download updates to the OS. The phone checks that the update is signed by Apple. If Apple can be trusted to keep their code-signing keys secret, then surely they can be trusted to keep a special version of the OS secret. I'm still opposed to this, though... The FBI wants to be able to dictate to a private company what features to build (because of the All Writs Act).

danieldk 11y ago

Don't you see the slippery slope here? Next, the German or French police will knock on Apple's door. When they get access, China, Russia, and others will line up next. Moreover, who says that the FBI or some other agency will stop after this iPhone, or the next 12 iPhones. Why not push to get their own signing key after they succeed in this case? They will try to get as far as possible. We live in 2016. many of our devices with our private data are directly addressable from anywhere in the world. Intentionally weakening encryption and security in any way is a dangerous proposition. It's good that Apple fights this tooth and nail. Sure, it may align up with their PR. I don't care, it benefits every citizen of the net who wants privacy and security.

amatix 11y ago
worse. If this becomes "normal", then rather than the CTO or CSO or VP iOS Engineering having to unlock the code-signing keys to sign releases (presumably via N of M), it'll have to be automated so that "oh, the FBI needs another custom build for the 4th time this week, just do the build and click here to sign it". At that point the security of the master code-signing keys has evaporated to nothing and we're all sunk.
- rhizome 11y ago
  I think the precedent that emerges could be that law enforcement can force companies to sign specific functionality. This access-to-data power would be in line with their access to telephone and telegraph copper in centuries past.
plorg 11y ago
People keep suggesting that on the slippery slope of Apple complying with cases of limited scope the next logical step is compelling the production of a signing key. This is the very essence of why a slippery slope is often a logical fallacy, because one does not necessarily follow from the other, and no supporting evidence is given that it would. There are plenty of things that would keep this step from occurring, primary among them that there would be no legal justification - in the context of the All Writs Act, there would already be a solution available to law enforcement that was less burdensome to Apple than providing the keys to the kingdom. I, too, think it is laudable that Apple would fight for privacy, but I also think that a lot of the argumentation around this case is soft and ideological.

deleted 11y ago

[deleted]

Tempest1981 11y ago

What if there were a limit of 3 unlocks a year? Like in NFL football, where the coach is only allowed to challenge 3 plays a game, even if each challenge is successful. (I know, still too slippery a slope) Or if each unlock cost the requester a $10 billion fee (donated to charity)? To make them think harder about when to use an unlock.

blisterpeanuts 11y ago
How about forcing the prosecutor and Director Comey and the judge to place the entire contents of their own phones on a public server? Every call, every email, every GPS coordinate. Let them feel our p.
- blisterpeanuts 11y ago
  pain.
jonesb6 11y ago
Then there would be another terrorist attack and emergency legislation would be passed giving the coaches 6 challenges.