5 ms·

You could say they dropped it because they accessed the phone. You might also say they dropped it because going to court and losing would greatly narrow the sc

You could say they dropped it because they accessed the phone. You might also say they dropped it because going to court and losing would greatly narrow the scope of the All Writs act. Then the "maybe illegal" spying coersion becomes "actually illegal"

sremani 11y ago
You can also say, your IPhone is not as secure as Apple claims and state actors can break it.
- adevine 11y ago
  It was always known that the 5c, which is the device the FBI accessed, was less secure because it does not contain a Secure Enclave like later iPhones.
- mtgx 11y ago
  Is there anything state actors can't break into? There will always be vulnerabilities to fix. Apple's and other companies' hope is not to fall too many steps behind the state actors.
  - lallysingh 11y ago
    PGP worked well enough for Snowden, right?
    - cookiecaper 11y ago
      Snowden had the element of surprise. They weren't actively trying to monitor his comms because they didn't know he was a risk until after the leaks. If the state wants to decrypt your messages badly enough, they have resources that they can devote to that (as well as multiple side channels that are probably easier than forcibly decrypting, including the infamous "beat with a wrench" trick). It's not trivial to defeat strong encryption, but it is doable given sufficient interest.
      - marvin 11y ago
        Is there any evidence that any actor in the world is (in general) capable of figuring out the contents of e.g. an AES-encrypted message with the key unknown, assuming good opsec and a good implementation? I agree with your statement that state-level actors have strong capabilities, but this seems like a blanket statement which is likely untrue.
        koenigdavidmj 11y ago
        No, and I doubt that this capability would be revealed for something at the level of San Bernardino, or anything short of "ISIS is going to do a WMD attack against Manhattan".
        Absentinsomniac 11y ago
        Almost certainly not. Most likely no one in the world has that capability, at least as far as I can tell. It would be extremely surprising if any government somehow broke AES without researchers around the world figuring it out within the same general time-frame given some new advancement.
        cookiecaper 11y ago
        I know it's not worth anything, but I used to work with an ex-NSA cryptographer (whom I personally knew in meatspace and yes, actually had worked at the NSA) who claimed that they could create purpose-built machines to factor out keys and read the contents of encrypted messages. The target would have to be high-value as this was a costly exercise. He may have been yanking our chain, but for what it's worth, that's what he would claim. He didn't specify which individual ciphers this applied to. However, there are so many ways to circumvent encryption that it seems that there aren't a lot of cases where a hard decryption of a previously-coded message would really be required (the target can often be compelled or tricked into giving up his keys, a plaintext version may be intercepted at some point, etc.).
        eugenekolo2 11y ago
        The issue is getting perfect implementation and perfect opsec. With enough time, and willingness an opportunity will find itself.
mtgx 11y ago
I would hope the media follows up with "so what did you find out from it?" and don't just leave it to "trust us, we unlocked it".
- fooey 11y ago
  They'll just say "can't comment on an active investigation" if they don't find anything to make the whole thing seem worthwhile.
  - zmmmmm 11y ago
    To which it would be reasonable to ask, "so why did you hold this whole case in public, against Apple's wishes, if it is now so secret you can't even comment on it?"
    - imron 11y ago
      To which they will reply, "we would not have commented on what we found on the device if Apple had been compelled to help us break in to it, and we will not be commenting on what found on the device now" Holding the case in public, and publishing the contents of the phone in public are very different things
      - zmmmmm 11y ago
        > Holding the case in public, and publishing the contents of the phone in public are very different things And saying they "can't comment" as the GP suggested is different to publishing contents of the phone. They could easily comment on whether they found anything or not, whether it had any importance to the case, the nature of what they might have found without revealing specifics. If they do simply say they "can't comment" then we will know they are lying, because because they already did comment, quite voluntarily: they just held a whole court case in public about it which revealed all kinds of gory details. A court case which Apple asked to seal and the FBI said "no, we want this to be public".
  - anigbrowl 11y ago
anigbrowl 11y ago
It'll be easy enough to infer which it is later because if they have actually got data out of the phone then they'll amend the complaint against the co-conspirator(s) with the newly available information.
- bunderbunder 11y ago
  Only if the data is useful. Which is far from guaranteed, as many have pointed out previously.

sremani 11y ago

You can also say, your IPhone is not as secure as Apple claims and state actors can break it.

adevine 11y ago
It was always known that the 5c, which is the device the FBI accessed, was less secure because it does not contain a Secure Enclave like later iPhones.
mtgx 11y ago
Is there anything state actors can't break into? There will always be vulnerabilities to fix. Apple's and other companies' hope is not to fall too many steps behind the state actors.
- lallysingh 11y ago
  PGP worked well enough for Snowden, right?
  - cookiecaper 11y ago
    Snowden had the element of surprise. They weren't actively trying to monitor his comms because they didn't know he was a risk until after the leaks. If the state wants to decrypt your messages badly enough, they have resources that they can devote to that (as well as multiple side channels that are probably easier than forcibly decrypting, including the infamous "beat with a wrench" trick). It's not trivial to defeat strong encryption, but it is doable given sufficient interest.
    - marvin 11y ago
      Is there any evidence that any actor in the world is (in general) capable of figuring out the contents of e.g. an AES-encrypted message with the key unknown, assuming good opsec and a good implementation? I agree with your statement that state-level actors have strong capabilities, but this seems like a blanket statement which is likely untrue.
      - koenigdavidmj 11y ago
        No, and I doubt that this capability would be revealed for something at the level of San Bernardino, or anything short of "ISIS is going to do a WMD attack against Manhattan".
      - Absentinsomniac 11y ago
        Almost certainly not. Most likely no one in the world has that capability, at least as far as I can tell. It would be extremely surprising if any government somehow broke AES without researchers around the world figuring it out within the same general time-frame given some new advancement.
      - cookiecaper 11y ago
        I know it's not worth anything, but I used to work with an ex-NSA cryptographer (whom I personally knew in meatspace and yes, actually had worked at the NSA) who claimed that they could create purpose-built machines to factor out keys and read the contents of encrypted messages. The target would have to be high-value as this was a costly exercise. He may have been yanking our chain, but for what it's worth, that's what he would claim. He didn't specify which individual ciphers this applied to. However, there are so many ways to circumvent encryption that it seems that there aren't a lot of cases where a hard decryption of a previously-coded message would really be required (the target can often be compelled or tricked into giving up his keys, a plaintext version may be intercepted at some point, etc.).
      - eugenekolo2 11y ago
        The issue is getting perfect implementation and perfect opsec. With enough time, and willingness an opportunity will find itself.

mtgx 11y ago

I would hope the media follows up with "so what did you find out from it?" and don't just leave it to "trust us, we unlocked it".

fooey 11y ago
They'll just say "can't comment on an active investigation" if they don't find anything to make the whole thing seem worthwhile.
- zmmmmm 11y ago
  To which it would be reasonable to ask, "so why did you hold this whole case in public, against Apple's wishes, if it is now so secret you can't even comment on it?"
  - imron 11y ago
    To which they will reply, "we would not have commented on what we found on the device if Apple had been compelled to help us break in to it, and we will not be commenting on what found on the device now" Holding the case in public, and publishing the contents of the phone in public are very different things
    - zmmmmm 11y ago
      > Holding the case in public, and publishing the contents of the phone in public are very different things And saying they "can't comment" as the GP suggested is different to publishing contents of the phone. They could easily comment on whether they found anything or not, whether it had any importance to the case, the nature of what they might have found without revealing specifics. If they do simply say they "can't comment" then we will know they are lying, because because they already did comment, quite voluntarily: they just held a whole court case in public about it which revealed all kinds of gory details. A court case which Apple asked to seal and the FBI said "no, we want this to be public".
- anigbrowl 11y ago

anigbrowl 11y ago

It'll be easy enough to infer which it is later because if they have actually got data out of the phone then they'll amend the complaint against the co-conspirator(s) with the newly available information.

bunderbunder 11y ago
Only if the data is useful. Which is far from guaranteed, as many have pointed out previously.