5 ms·

The real lynchpin here is not hardware, but iCloud. Apple can pull data out of an iCloud backup, and the only reason the San Bernadino case even got off the gr

The real lynchpin here is not hardware, but iCloud. Apple can pull data out of an iCloud backup, and the only reason the San Bernadino case even got off the ground is because somebody at the county screwed up and effectively prevented the backup from occurring. iCloud backups can be secured so not even Apple can get in them, but it is fundamentally much harder to secure (can't be hareware-entangled and still restore to a new device), and it would significantly complicate iCloud password changes. I'm sure they are working on it, but it is nontrivial. That (software) problem is the real reason 99% of users are still exposed, as you say the hardware and secure enclave holes are basically closed.

Bud 11y ago
It's not 99%; adoption of iCloud backups is not nearly that high.
- iLoch 11y ago
  Uhh, well it's probably pretty high. Considering their adoption rate for new software is sitting somewhere around 95%. iCloud backups default to on - just like automatic updates - when the user sets up their phone. Not to mention most Geniuses would ask to turn on iCloud backup when upgrading the device for convenience.
  - jonknee 11y ago
    Well the specific phone that started this controversy didn't have any iCloud backups, so regardless of the percentage it doesn't pertain here.
    - karlshea 11y ago
      It did have iCloud backups, but the latest was six weeks prior. The FBI requested the iCloud password be reset, which prevented a new iCloud backup they could have subpoenaed.
frankacter 11y ago
> Farook disabled the iCloud backup six weeks prior to the attack http://6abc.com/news/senior-official-stresses-feds-need-to-unlock-shooters-iphone/1217610/ http://6abc.com/news/senior-official-stresses-feds-need-to-u...
- cheepin 11y ago
  They did not even attempt to get it to send a fresh backup to iCloud before they reset it making it impossible. [0] http://daringfireball.net/2016/02/san_bernardino_password_reset http://daringfireball.net/2016/02/san_bernardino_password_re...
  - zyx321 11y ago
    On the other hand, "turn it on and let it do its thing" is a terrible idea from a forensics standpoint. You want to lock the account down ASAP to prevent potential accomplices from remote wiping your evidence.
    - Crito 11y ago
      In an alternate universe it may have been a plausible deliberate measure, but in this universe, it was a fuckup.
mystikal 11y ago
Does Apple owning the iCloud data center have an impact?
skeptic123123 11y ago
call me a cynic, but I'm not buying "somebody at the county screwed up"
- amatix 11y ago
  Indeed, "The County was working cooperatively with the FBI when it reset the iCloud password at the FBI's request." https://twitter.com/CountyWire/status/700887823482630144 https://twitter.com/CountyWire/status/700887823482630144
  - lmm 11y ago
    The "screwup" grandparent is suggesting is that the county didn't think to disable the setting that would let employees turn off iCloud backups for their devices, however many months or years ago, not that they've messed up during the investigation now.
    - ethbro 11y ago
      No, they're probably referring to this, from the second letter, "One of the strongest suggestions we [Apple] offered was that they pair the phone to a previously joined network, which would allow them to back up the phone and get the data they are now asking for. Unfortunately, we learned that while the attacker’s iPhone was in FBI custody the Apple ID password associated with the phone was changed. Changing this password meant the phone could no longer access iCloud services." http://www.apple.com/customer-letter/answers/ http://www.apple.com/customer-letter/answers/
cmarschner 11y ago
Naive quedtion perhaps, bit why wouldn't they be able to employ the same hardware on icloud than on the phone?
- dignati 11y ago
  It can be the same hardware but I believe that not usually meant with "hardware based encryption". The point is that the private keys never leave the hardware of the phone, thus making it secure. So they could employ the same hardware but the hardware does not have the necessary keys.
- hollander 11y ago
  Uploading the encrypted content has no value as backup, if you don't have keys that can decrypt it. If the keys are backed up as well, all security is gone.
  - ethbro 11y ago
    Is it that hard to have the phone display an encryption key and have the user copy it to dead tree? As above, not a good idea for a default, but don't see why it wouldn't be technically viable for opt-in protection.
    - philipov 11y ago
      The hardware key is designed to be impossible to extract from the device. That's part of the security, so you can't simply transfer the data to a phone where protections against brute-forcing the user key have been removed.
      - ethbro 11y ago
        > An encryption key To spell it out (1) request new encryption key from device (let's call it key4cloud); (2) encryption key generated, displayed for physical logging by the user, & stored in the secure enclave; (3) all normal backups to iCloud are now encrypted via key4cloud; (4) user loses phone; (5) user purchases new phone; (6) new phone downloads data; (7) user enters key4cloud from physical notes & decrypts backup Yes, it requires paper and a pencil and user education (hence the opt-in). But it's also incredibly resistant to "Give us all iCloud data on User Y."
katbyte 11y ago
The exact reason i simply just don't use the iCloud backup.
abalone 11y ago
> iCloud backups can be secured so not even Apple can get in... I'm sure they are working on it, but it is nontrivial. There is no way they are working on this. It is an intentional design decision that Apple offers an alternative way to recover your data if you lose your password. Or if you die without telling your next-of-kin your password. Most people do not actually want all of their family photos to self-destruct when they die because they didn't plan for their death "correctly". That would be a further tragedy for the family. (Most people don't even write wills and a court has to figure things out.) Making data self-destruct upon forgetting a password (or dying) is not a good default. It's definitely something people should be able to opt-in to in particular situations, but only when they understand the consequences. So it's great news that in iOS 9.3 the Notes app will let you encrypt specific notes with a key that only you know. But it's opt-in, not the default.
- ohitsdom 11y ago
  Has Apple even given access of someone's iCloud account to next-of-kin after they died? I've never heard of this, and I don't expect Apple to be responsible to preserve photos. You already can have shared photo streams, and there are many solutions for other data that could be potentially lost that don't involve Apple getting directly involved in these cases.
  - fluxquanta 11y ago
    The idea of Apple (or some other big corporation) providing my protected personal data to my next-of-kin is more frightening than the idea that the government has the ability to spy on me while I'm alive. It's the most morbid kind of subliminal marketing that could possibly exist. "Hey, we're really sorry about fluxquanta's passing. Here is his private data which he may or may not have wanted you to see (but we'll just assume that he did). Aren't we such a caring company? Since we can no longer count on him to give us more money when our next product comes out, keep us and our incredibly kind gesture of digging through the skeleton closets of the dead in mind when shopping for your next device."
    - 11y ago

Bud 11y ago

It's not 99%; adoption of iCloud backups is not nearly that high.

iLoch 11y ago
Uhh, well it's probably pretty high. Considering their adoption rate for new software is sitting somewhere around 95%. iCloud backups default to on - just like automatic updates - when the user sets up their phone. Not to mention most Geniuses would ask to turn on iCloud backup when upgrading the device for convenience.
- jonknee 11y ago
  Well the specific phone that started this controversy didn't have any iCloud backups, so regardless of the percentage it doesn't pertain here.
  - karlshea 11y ago
    It did have iCloud backups, but the latest was six weeks prior. The FBI requested the iCloud password be reset, which prevented a new iCloud backup they could have subpoenaed.

frankacter 11y ago

> Farook disabled the iCloud backup six weeks prior to the attack http://6abc.com/news/senior-official-stresses-feds-need-to-unlock-shooters-iphone/1217610/ http://6abc.com/news/senior-official-stresses-feds-need-to-u...

cheepin 11y ago
They did not even attempt to get it to send a fresh backup to iCloud before they reset it making it impossible. [0] http://daringfireball.net/2016/02/san_bernardino_password_reset http://daringfireball.net/2016/02/san_bernardino_password_re...
- zyx321 11y ago
  On the other hand, "turn it on and let it do its thing" is a terrible idea from a forensics standpoint. You want to lock the account down ASAP to prevent potential accomplices from remote wiping your evidence.
  - Crito 11y ago
    In an alternate universe it may have been a plausible deliberate measure, but in this universe, it was a fuckup.

mystikal 11y ago

Does Apple owning the iCloud data center have an impact?

skeptic123123 11y ago

call me a cynic, but I'm not buying "somebody at the county screwed up"

amatix 11y ago
Indeed, "The County was working cooperatively with the FBI when it reset the iCloud password at the FBI's request." https://twitter.com/CountyWire/status/700887823482630144 https://twitter.com/CountyWire/status/700887823482630144
- lmm 11y ago
  The "screwup" grandparent is suggesting is that the county didn't think to disable the setting that would let employees turn off iCloud backups for their devices, however many months or years ago, not that they've messed up during the investigation now.
  - ethbro 11y ago
    No, they're probably referring to this, from the second letter, "One of the strongest suggestions we [Apple] offered was that they pair the phone to a previously joined network, which would allow them to back up the phone and get the data they are now asking for. Unfortunately, we learned that while the attacker’s iPhone was in FBI custody the Apple ID password associated with the phone was changed. Changing this password meant the phone could no longer access iCloud services." http://www.apple.com/customer-letter/answers/ http://www.apple.com/customer-letter/answers/

cmarschner 11y ago

Naive quedtion perhaps, bit why wouldn't they be able to employ the same hardware on icloud than on the phone?

dignati 11y ago
It can be the same hardware but I believe that not usually meant with "hardware based encryption". The point is that the private keys never leave the hardware of the phone, thus making it secure. So they could employ the same hardware but the hardware does not have the necessary keys.
hollander 11y ago
Uploading the encrypted content has no value as backup, if you don't have keys that can decrypt it. If the keys are backed up as well, all security is gone.
- ethbro 11y ago
  Is it that hard to have the phone display an encryption key and have the user copy it to dead tree? As above, not a good idea for a default, but don't see why it wouldn't be technically viable for opt-in protection.
  - philipov 11y ago
    The hardware key is designed to be impossible to extract from the device. That's part of the security, so you can't simply transfer the data to a phone where protections against brute-forcing the user key have been removed.
    - ethbro 11y ago
      > An encryption key To spell it out (1) request new encryption key from device (let's call it key4cloud); (2) encryption key generated, displayed for physical logging by the user, & stored in the secure enclave; (3) all normal backups to iCloud are now encrypted via key4cloud; (4) user loses phone; (5) user purchases new phone; (6) new phone downloads data; (7) user enters key4cloud from physical notes & decrypts backup Yes, it requires paper and a pencil and user education (hence the opt-in). But it's also incredibly resistant to "Give us all iCloud data on User Y."

katbyte 11y ago

The exact reason i simply just don't use the iCloud backup.

abalone 11y ago

> iCloud backups can be secured so not even Apple can get in... I'm sure they are working on it, but it is nontrivial. There is no way they are working on this. It is an intentional design decision that Apple offers an alternative way to recover your data if you lose your password. Or if you die without telling your next-of-kin your password. Most people do not actually want all of their family photos to self-destruct when they die because they didn't plan for their death "correctly". That would be a further tragedy for the family. (Most people don't even write wills and a court has to figure things out.) Making data self-destruct upon forgetting a password (or dying) is not a good default. It's definitely something people should be able to opt-in to in particular situations, but only when they understand the consequences. So it's great news that in iOS 9.3 the Notes app will let you encrypt specific notes with a key that only you know. But it's opt-in, not the default.

ohitsdom 11y ago
Has Apple even given access of someone's iCloud account to next-of-kin after they died? I've never heard of this, and I don't expect Apple to be responsible to preserve photos. You already can have shared photo streams, and there are many solutions for other data that could be potentially lost that don't involve Apple getting directly involved in these cases.
- fluxquanta 11y ago
  The idea of Apple (or some other big corporation) providing my protected personal data to my next-of-kin is more frightening than the idea that the government has the ability to spy on me while I'm alive. It's the most morbid kind of subliminal marketing that could possibly exist. "Hey, we're really sorry about fluxquanta's passing. Here is his private data which he may or may not have wanted you to see (but we'll just assume that he did). Aren't we such a caring company? Since we can no longer count on him to give us more money when our next product comes out, keep us and our incredibly kind gesture of digging through the skeleton closets of the dead in mind when shopping for your next device."
  - 11y ago