6 ms·

Consider however that Apple is being asked to digitally sign the modified FBiOS in order to load it onto the phone. The implications underlying the act of sign

Consider however that Apple is being asked to digitally sign the modified FBiOS in order to load it onto the phone. The implications underlying the act of signing are the sort of speech that deserves the highest protection.

marcoperaza 11y ago
The fact that we take a digital signature to mean something about other human beings' intentions is just our own wishful thinking. Our security models rise and fall according to the constraints of reality, not our desires. Apple thought it could be its customers' confidant against the government. Apple is not your lawyer, doctor, priest, or spouse, so it is not entitled to be your confidant in the face of a court order. If they want to protect their customers from government court orders, then they need to re-think their threat model and include Apple as an adversary. According to recent news, that's what they're planning to do. It's also what they've been saying about iPhones for the last few years, even though it's now been shown to be untrue.
- jacobparker 11y ago
  > It's also what they've been saying about iPhones for the last few years, even though it's now been shown to be untrue. Well, the model of phone in that case (5C) is 2.5 years old using a 3.5 year old version of their CPUs lacking some of the modern hardware necessary (Secure Enclave.) High-level details here: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
  - marcoperaza 11y ago
    That's what I figured at first too, but this line from Apple's open letter says otherwise: >In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession. This line has been quoted a lot and Apple has not redacted or clarified it. If newer iPhones were not vulnerable to these types of attacks, Apple wouldn't say that they are. Especially since they've openly said that one of their big concerns is damage to Apple's reputation for security and privacy.
- tclmeelmo 11y ago
  The whole point of a signature, handwritten or digital, is to act as proof of identity and intent. If the government can compel Apple to sign FBiOS (against Apple's stated intent of signing their OS), where do you propose the government's ability to coerce a signature stop?
  - marcoperaza 11y ago
    If your handwritten signature, to be interpreted by a machine, is all that stood between the government and their ability to carry out a legal search, I have no doubt that you could and should be compelled to produce it.
    - tclmeelmo 11y ago
      In my mind, that leads to scenarios where the government "asks" someone to sign a confession. That's been done before, and it doesn't end well.
      - marcoperaza 11y ago
        No court would ever issue an order forcing you to sign a confession. You could make the same fallacious slippery-slope argument against any government power at all. "If they began to use this in a different way, it would be terrible". Of course, which is why we have a court system that decides what is and isn't an appropriate use of the government's authority. The 5th amendment guarantees that you can't be forced to incriminate yourself. As an example that courts are perfectly capable of drawing lines, you can be compelled to hand over encryption keys for a third-party's data, but not for your own.
        tclmeelmo 11y ago
        > The 5th amendment guarantees that you can't be forced to incriminate yourself. It does, and my example was hyperbolic to my detriment by bringing in the 5th. The point I was trying to make was that the act you described (a manual signature to enable a search) was equally transgressive in my eyes. The 1st Amendment does prohibit government-compelled speech, of which the act of digitally signing is (by analogy to signing) expressive conduct that merits protection. That alone should be sufficient to stop this case. Your example doesn't apply here. For one, as far as I can tell, being forced to reveal one's own encryption key remains an unsettled matter (I would argue 5th Amendment protections apply, were I before the court). Apple is not being asked to supply something that they possess, they are being asked to use something that they possess, to create something that doesn't exist, to give to the government in order to enable a search. The government hasn't established if they have exhausted their own resources, they haven't (to my knowledge) proposed payment for Apple's services (which would as I see it constitute taking), and they haven't established the probative value of what might be on the phone (probably zip). And, if the product of this search were to come up in court, Apple would have to testify to their methods and be subject to cross-examination. This whole situation is a tire fire.

marcoperaza 11y ago

The fact that we take a digital signature to mean something about other human beings' intentions is just our own wishful thinking. Our security models rise and fall according to the constraints of reality, not our desires. Apple thought it could be its customers' confidant against the government. Apple is not your lawyer, doctor, priest, or spouse, so it is not entitled to be your confidant in the face of a court order. If they want to protect their customers from government court orders, then they need to re-think their threat model and include Apple as an adversary. According to recent news, that's what they're planning to do. It's also what they've been saying about iPhones for the last few years, even though it's now been shown to be untrue.

jacobparker 11y ago
> It's also what they've been saying about iPhones for the last few years, even though it's now been shown to be untrue. Well, the model of phone in that case (5C) is 2.5 years old using a 3.5 year old version of their CPUs lacking some of the modern hardware necessary (Secure Enclave.) High-level details here: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
- marcoperaza 11y ago
  That's what I figured at first too, but this line from Apple's open letter says otherwise: >In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession. This line has been quoted a lot and Apple has not redacted or clarified it. If newer iPhones were not vulnerable to these types of attacks, Apple wouldn't say that they are. Especially since they've openly said that one of their big concerns is damage to Apple's reputation for security and privacy.
tclmeelmo 11y ago
The whole point of a signature, handwritten or digital, is to act as proof of identity and intent. If the government can compel Apple to sign FBiOS (against Apple's stated intent of signing their OS), where do you propose the government's ability to coerce a signature stop?
- marcoperaza 11y ago
  If your handwritten signature, to be interpreted by a machine, is all that stood between the government and their ability to carry out a legal search, I have no doubt that you could and should be compelled to produce it.
  - tclmeelmo 11y ago
    In my mind, that leads to scenarios where the government "asks" someone to sign a confession. That's been done before, and it doesn't end well.
    - marcoperaza 11y ago
      No court would ever issue an order forcing you to sign a confession. You could make the same fallacious slippery-slope argument against any government power at all. "If they began to use this in a different way, it would be terrible". Of course, which is why we have a court system that decides what is and isn't an appropriate use of the government's authority. The 5th amendment guarantees that you can't be forced to incriminate yourself. As an example that courts are perfectly capable of drawing lines, you can be compelled to hand over encryption keys for a third-party's data, but not for your own.
      - tclmeelmo 11y ago
        > The 5th amendment guarantees that you can't be forced to incriminate yourself. It does, and my example was hyperbolic to my detriment by bringing in the 5th. The point I was trying to make was that the act you described (a manual signature to enable a search) was equally transgressive in my eyes. The 1st Amendment does prohibit government-compelled speech, of which the act of digitally signing is (by analogy to signing) expressive conduct that merits protection. That alone should be sufficient to stop this case. Your example doesn't apply here. For one, as far as I can tell, being forced to reveal one's own encryption key remains an unsettled matter (I would argue 5th Amendment protections apply, were I before the court). Apple is not being asked to supply something that they possess, they are being asked to use something that they possess, to create something that doesn't exist, to give to the government in order to enable a search. The government hasn't established if they have exhausted their own resources, they haven't (to my knowledge) proposed payment for Apple's services (which would as I see it constitute taking), and they haven't established the probative value of what might be on the phone (probably zip). And, if the product of this search were to come up in court, Apple would have to testify to their methods and be subject to cross-examination. This whole situation is a tire fire.