3 ms·

>If that is the sole, correct framing of the issue, then society faces a simple question of how to interpret existing statutes in light of constitutional constr

>If that is the sole, correct framing of the issue, then society faces a simple question of how to interpret existing statutes in light of constitutional constraints. It is not the sole framing, nor is it correct. The order is not to weaken the encryption scheme, but to override the kill switch, on a specific phone, that will disable the device if too many incorrect login attempts are made.

zaroth 11y ago
The core security of any password based encryption is the means to slow or prevent brute force attacks on the password. Weakening the PBKDF to make brute forcing possible is exactly the definition of weakening the scheme. There are at least 9 phones they want this on today, and other sources have "hundreds" more. So you can say they want to do this on "any specific" phone, but I hope we're well past debating this as if we're talking about a single phone ever. I couldn't be happier with yesterday's ruling denying the government motion to compel using AWA in a similar case. I think we can see the forest for the trees in these case and should have an honest debate about how much police should be able to control the software on our devices, without trying to skirt the issue by tying it to a particularly haneous crime. I'm convinced and I believe it's well understood and settled that if AWA works the way the Fed wants in a specific case, it works in every single investigation, regardless of the brand of device or type of software. Magistrate Judge Orenstein certainly saw it that way.
- jsprogrammer 11y ago
  An encryption scheme should not be weakenable after the physical medium has been compromised. An encryption scheme is purely a feature of the data, not of the device. An encryption scheme should only be susceptible to brute force attacks and Apple is not being asked to perform a brute force attack, but rather, to deactivate their kill switch. If you read the order, the software to deactivate the kill switch is only supposed to work with one particular iPhone and Apple is under no obligation to deliver that software to anyone; they are only required to provide access to the device without fear of the kill switch.

zaroth 11y ago

The core security of any password based encryption is the means to slow or prevent brute force attacks on the password. Weakening the PBKDF to make brute forcing possible is exactly the definition of weakening the scheme. There are at least 9 phones they want this on today, and other sources have "hundreds" more. So you can say they want to do this on "any specific" phone, but I hope we're well past debating this as if we're talking about a single phone ever. I couldn't be happier with yesterday's ruling denying the government motion to compel using AWA in a similar case. I think we can see the forest for the trees in these case and should have an honest debate about how much police should be able to control the software on our devices, without trying to skirt the issue by tying it to a particularly haneous crime. I'm convinced and I believe it's well understood and settled that if AWA works the way the Fed wants in a specific case, it works in every single investigation, regardless of the brand of device or type of software. Magistrate Judge Orenstein certainly saw it that way.

jsprogrammer 11y ago
An encryption scheme should not be weakenable after the physical medium has been compromised. An encryption scheme is purely a feature of the data, not of the device. An encryption scheme should only be susceptible to brute force attacks and Apple is not being asked to perform a brute force attack, but rather, to deactivate their kill switch. If you read the order, the software to deactivate the kill switch is only supposed to work with one particular iPhone and Apple is under no obligation to deliver that software to anyone; they are only required to provide access to the device without fear of the kill switch.