4 ms·

Why do you say that the first scenario requires a large-scale software engineering effort? They don't want new features, or major changes to the crypto systems

Why do you say that the first scenario requires a large-scale software engineering effort? They don't want new features, or major changes to the crypto systems - just disable the function that causes the phone to lock for longer and longer times when wrong PIN codes are entered. Comment out the function call. Change the number of allowed guesses to MAX_INT. Change the time increment to zero. Click build. This is not a hard task!

GTP 11y ago
It depends on the source code you find: if you find a source code without comments or even worse an obfuscated code it would be a really really difficult task to modify it the right way.
kiallmacinnes 11y ago
> Click Build I'm willing to bet iOS has a huge build infrastructure, many different components, and about a snowball's chance in hell of having a single nice clean Makefile for you to type one command to get a build without access to that infrastructure.
- LeifCarrotson 11y ago
  But the point is that Apple has that infrastructure. If the FBI asked the right person or people, I would bet they could get this done on their lunch break. People are making it out like the FBI is asking Apple to rewrite a big part of iOS. That's not the part of the request that's the problem.
  - yo-code-sucks 11y ago
    You sir are a twat and believe this is simple. Fact is you apparently dont know squat about hardware/firmware, have you considered the fact that said update is not even related to ios? Have you considered that the firmware itself may be burned into the chip providing key access?
- deleted 11y ago
  [deleted]
tfinniga 11y ago
That's a good point that I was assuming it would be difficult. I've since done a little bit of reading up on what we know about how difficult it would be. This is the best writeup I found: http://blog.trailofbits.com/2016/02/17/apple-can-comply-with-the-fbi-court-order/ http://blog.trailofbits.com/2016/02/17/apple-can-comply-with... So, you'd need an update to iOS/the phone firmware, and for newer devices you'd also need an update to the secure enclave firmware. You can't do anything about the 80ms delay, because that's baked into the hashing function (and changing the hashing function would generate invalid results). The FBI is also asking for the ability to enter passcodes electronically rather than via the touchscreen, which would be new code. If iOS and the SE firmware are really nicely factored to disable security, and it's not hard to add the new functionality, then this might not be too much work. However I doubt that that is going to be the case. The whole point of the security system is to make it difficult to crack, so there might be other countermeasures involved, tricky dependencies, and low-level hardware hackery. If it were simple to do, why wouldn't it have already been done by others reverse-engineering the compiled code? There is certainly financial motivation to do so.

GTP 11y ago

It depends on the source code you find: if you find a source code without comments or even worse an obfuscated code it would be a really really difficult task to modify it the right way.

kiallmacinnes 11y ago

> Click Build I'm willing to bet iOS has a huge build infrastructure, many different components, and about a snowball's chance in hell of having a single nice clean Makefile for you to type one command to get a build without access to that infrastructure.

LeifCarrotson 11y ago
But the point is that Apple has that infrastructure. If the FBI asked the right person or people, I would bet they could get this done on their lunch break. People are making it out like the FBI is asking Apple to rewrite a big part of iOS. That's not the part of the request that's the problem.
- yo-code-sucks 11y ago
  You sir are a twat and believe this is simple. Fact is you apparently dont know squat about hardware/firmware, have you considered the fact that said update is not even related to ios? Have you considered that the firmware itself may be burned into the chip providing key access?
deleted 11y ago
[deleted]

tfinniga 11y ago

That's a good point that I was assuming it would be difficult. I've since done a little bit of reading up on what we know about how difficult it would be. This is the best writeup I found: http://blog.trailofbits.com/2016/02/17/apple-can-comply-with-the-fbi-court-order/ http://blog.trailofbits.com/2016/02/17/apple-can-comply-with... So, you'd need an update to iOS/the phone firmware, and for newer devices you'd also need an update to the secure enclave firmware. You can't do anything about the 80ms delay, because that's baked into the hashing function (and changing the hashing function would generate invalid results). The FBI is also asking for the ability to enter passcodes electronically rather than via the touchscreen, which would be new code. If iOS and the SE firmware are really nicely factored to disable security, and it's not hard to add the new functionality, then this might not be too much work. However I doubt that that is going to be the case. The whole point of the security system is to make it difficult to crack, so there might be other countermeasures involved, tricky dependencies, and low-level hardware hackery. If it were simple to do, why wouldn't it have already been done by others reverse-engineering the compiled code? There is certainly financial motivation to do so.