9 ms·

Funny to call it reporting when it's more of an editorial by the renowned security researcher Bruce Schneier. However, I'll defend his point: take the Monty Ha

by wrsh07 11y ago

Funny to call it reporting when it's more of an editorial by the renowned security researcher Bruce Schneier. However, I'll defend his point: take the Monty Hall problem [https://en.wikipedia.org/wiki/Monty_Hall_problem https://en.wikipedia.org/wiki/Monty_Hall_problem]. The probabilities change, even when a door you didn't pick [and doesn't hold the prize] is opened. I think this is a fair analogy. We've now gained knowledge about the existence of a vulnerability, and that knowledge makes everyone's device less secure [for a variety of reasons -- eg others know to look for the vulnerability, others know it can be bought, etc]. It doesn't matter that the vulnerability "has always been there" if nobody knew about it.

DickingAround 11y ago
That was an excellent analogy.
- cptvideo2 11y ago
  > The FBI just revealed ... It would be a better analogy if they had actually revealed anything, instead of just saying that they had. This was more like telling us which door had a car behind it and trusting us to believe them.
  - wrsh07 11y ago
    It's true, I wish they had shown us a zero-knowledge proof (https://en.wikipedia.org/wiki/Zero-knowledge_proof https://en.wikipedia.org/wiki/Zero-knowledge_proof) that they had cracked it. At least then we would know that this isn't just to escape an unfavorable court ruling.
exelius 11y ago
> Funny to call it reporting when it's more of an editorial by the renowned security researcher Bruce Schneier. I respect Bruce and he's done a ton of great work, but I obviously disagree with him on this point. I do not believe governments (especially ones engaged in clandestine surveillance operations) have an obligation to share security vulnerabilities with companies. But neither do those companies have an obligation to create vulnerabilities for the governments to exploit (on the contrary; the companies have an obligation to find and fix the holes in their products). > It doesn't matter that the vulnerability "has always been there" if nobody knew about it. There's no guarantee that nobody knew about it, and that's the problem. Information asymmetry is a bitch, but the safest assumption is that someone else did indeed know about it, and then told the FBI. If someone was willing to tell the FBI, it's a safe bet the security community knows about this exploit. Also, if I was the FBI I would intentionally try to obfuscate my capabilities as much as I can. I would want people to think I can hack every iPhone at any time, even if I can't.
- coherentpony 11y ago
  > I respect Bruce and he's done a ton of great work, but I obviously disagree with him on this point. I do not believe governments (especially ones engaged in clandestine surveillance operations) have an obligation to share security vulnerabilities with companies. But neither do those companies have an obligation to create vulnerabilities for the governments to exploit (on the contrary; the companies have an obligation to find and fix the holes in their products). How do you determine if a vulnerability was there because it was overlooked in development, or if it was there because the government demanded it from the company but used the law to impose a gag order on the company preventing the public from finding out about it?
  - exelius 11y ago
    > How do you determine if a vulnerability was there because it was overlooked in development, or if it was there because the government demanded it from the company but used the law to impose a gag order on the company preventing the public from finding out about it? You don't; but that's possible today with the way the gag orders and FISA courts work. That's a real problem around transparency in our legal system; which IMO is a different issue from transparency around security issues relating to privately-developed products.
    - coherentpony 11y ago
      That's a really interesting viewpoint. Thanks for sharing it. In my opinion the government should be obliged to share the vulnerability for the purposes of the keeping the rest of the users safe from the same exploit, whether executed by the government or executed by somebody else. In summary, I disagree with you but I'm glad I took the time to ask you about your view since I learned something new.
- npsimons 11y ago
  > I do not believe governments (especially ones engaged in clandestine surveillance operations) have an obligation to share security vulnerabilities with companies. So I take it then you don't believe in a government "for the people"? Like it or not, Apple is legally a person, and even tossing that aside, we know that many of Apple's customers are American citizens, and this whole idea of "keeping knowledge from you for your own good" just reeks of the patronizing oligarchy that the US government has become known for. Lest you jump to the argument that this would endanger operations, I would still point out two very salient facts: this information is not intelligence data, and as Schneier pointed out, this attack can be used against many in the US government, including FBI agents in the field. Getting it fixed is the right thing to do.
deleted 11y ago
[deleted]
iuguy 11y ago
I have to respectfully disagree here. There are bugs in iOS, iPhones and pretty much everything. It would be naive and foolish to think that any electronic device you use doesn't have bugs. It would also be remiss to think that people aren't looking for the vulnerabilities, people like Stefan Esser have plenty of research documenting the security mechanisms and flaws in iOS, and in the hardware. People have crawled over the hardware and software documenting everything, looking for bugs. People have bugs we haven't heard about because they put the time in to go down the avenues that lead nowhere in order to find them. The people that would find these bugs have a deep knowledge and understanding of the internals of the devices in question, and some suspicion of how they would be applied in this situation. They are not people who would go from zero knowledge to chasing 0day without at least a decent lead as to what the FBI's third party did. The thing is, the FBI are not obligated to hand over their bugs, nor are the third party. It's the third party's trick, they found it, if they want to keep it it's their right to do so. Asserting that somehow because someone has specific 0day (designed to bypass unlocks when the phone is in their physical possession for an extended period of time) and doesn't want to share makes us all less secure is incredibly ingenuous and a logical fallacy at best.
adekok 11y ago
> The probabilities change, even when a door you didn't pick [and doesn't hold the prize] is opened. That's the common misunderstanding of the problem. Most people think that the probabilities go fro 1/3, 1/3, 1/3 to 1/2, 1/2, after choosing a door and having Monty Hall open one of the others. The probabilities don't change. The probabilities are 1/3, 1/3, 1/3 at the start. After you choose a door, they're still 1/3, 1/3, 1/3. Or a put a different way: 1/3 (your choice) 2/3 (what you didn't choose). When Monty Hall opens one of the other doors, the probabilities don't change. It's still 1/3 (your choice) 2/3 (what you didn't choose). However, because he's removed one of the doors from the problem, the 2/3 probability is now applied to the remaining door. That can be viewed as "probabilities changing" for the remaining door, but it's better described as the probabilities being shared between the doors you didn't choose.
- Retric 11y ago
  This assumes you always open a door, that door never holds the prize, and there is exactly 1 prize. You could run (ed:a similar game with different rules) such that the odds go 1/3,1/3,1/3 to 1/2, 1/2 if you flipped a coin to chose the second door and sometimes show the prize. Alternatively, if you chose when to open the second door, you could make swapping a very good (100%) or very poor choice (0%). Worse, you could swap what's behind the doors after they chose. Which IMO is why people find this so confusing. In the real world the odds presented may or may not line up with the actual odds. aka unknown unknowns.
  - ghshephard 11y ago
    This is incorrect. Flipping a coin to "to chose the second door and sometimes show the prize." has no impact on the probabilities. The parent is correct - there is a 2/3 chance the prize exists under one of the other two doors, and if one of them is shown not to have the prize (through random flipping, deliberate selection, whatever) - then the final door now has a 2/3 chance to have the prize.
    - function_seven 11y ago
      If one of the doors is shown to not have the prize, the odds are now 1/2 when the choice of reveal door is made randomly. That's because 1/3 of the time, you're not even offered the chance to switch, since it's pointless. I'll run the trials here. Assume the first two doors have the goat, and the third door has the car. Pick Reveal Switch? Outcome ---- ------ ------- ------- 1 2 Y 3 Car 2 1 Y 3 Car 3 1 N 3 Car 3 2 N 3 Car 1 2 N 1 Goat 2 1 N 2 Goat 3 1 Y 2 Goat 3 2 Y 1 Goat 1 3 - No chance to switch 1 3 - No chance to switch 2 3 - No chance to switch 2 3 - No chance to switch Meaning, given that you've made it to the point that an offer to switch doors is presented, there is no advantage to do so (or not do so).
cptvideo2 11y ago
>take the Monty Hall problem It amazing how many people still don’t get the Monty Hall problem. Its lesson is that the probabilities do NOT change – until we make a choice!. That’s why it’s better to switch once we see the goat behind door 1. The probability of our having made a good choice, initially (1 in 3), has NOT changed even though there are now only two ‘choices’. But they are not REALLY choices because we’ve ALREADY chosen. The probability can only change if we make a NEW choice, because the ‘probability’ that we’re discussing is the probability that our choice, at the time it was made, would produce a result that we wanted. The iPhone 5 is clearly no less secure now than it was then. But we can switch.
- fixermark 11y ago
  It's much easier to understand when you realize that Monty never reveals that one of the closed doors contained the car. That asymmetry of action leads to the asymmetry of probabilities; your initial choice constrained his choices when he takes action.
  - cptvideo2 11y ago
    Well, Monty doesn't know (or care about) your choice. He's 'constrained' by the fact that his 'probability' is 100%: he knows where the goats and car are.
    - jjnoakes 11y ago
      What? Of course his action is based on your choice. If a has the car and b and c have goats, and you pick b, he opens c. And if you pick c, he opens b...
      - cptvideo2 11y ago
        You’re right. I forgot that you had to tell him which door you wanted to open (instead of just saying that you've decided on a door - like the FBI as just SAID that they've cracked the iPhone5). But it doesn’t matter because Monty was always going to open one of the two goat doors, and the one that he opens doesn’t matter to the 1/3 probability that you picked the car door. Your probability of getting the car ALWAYS doubles when you switch (even though you still may not get it).
hollander 11y ago
I really don't see how this relates to the Monty Hall problem. The FBI just revealed how to unlock an encrypted phone. That's like opening the door with the car behind it.
mikeash 11y ago
According to the article, the vulnerability was known. All that changed is the FBI got somebody to use it. I would agree with the "less secure" bit if the FBI had uncovered the vulnerability, or asked some third party to do it. But since they just used something that was already known, the "less secure" statement makes no sense to me.
mikecb 11y ago
a "renowned security researcher" or a "renowned academic cryptographer"?

by wrsh07 11y ago

DickingAround 11y ago

That was an excellent analogy.

cptvideo2 11y ago
> The FBI just revealed ... It would be a better analogy if they had actually revealed anything, instead of just saying that they had. This was more like telling us which door had a car behind it and trusting us to believe them.
- wrsh07 11y ago
  It's true, I wish they had shown us a zero-knowledge proof (https://en.wikipedia.org/wiki/Zero-knowledge_proof https://en.wikipedia.org/wiki/Zero-knowledge_proof) that they had cracked it. At least then we would know that this isn't just to escape an unfavorable court ruling.

exelius 11y ago

> Funny to call it reporting when it's more of an editorial by the renowned security researcher Bruce Schneier. I respect Bruce and he's done a ton of great work, but I obviously disagree with him on this point. I do not believe governments (especially ones engaged in clandestine surveillance operations) have an obligation to share security vulnerabilities with companies. But neither do those companies have an obligation to create vulnerabilities for the governments to exploit (on the contrary; the companies have an obligation to find and fix the holes in their products). > It doesn't matter that the vulnerability "has always been there" if nobody knew about it. There's no guarantee that nobody knew about it, and that's the problem. Information asymmetry is a bitch, but the safest assumption is that someone else did indeed know about it, and then told the FBI. If someone was willing to tell the FBI, it's a safe bet the security community knows about this exploit. Also, if I was the FBI I would intentionally try to obfuscate my capabilities as much as I can. I would want people to think I can hack every iPhone at any time, even if I can't.

coherentpony 11y ago
> I respect Bruce and he's done a ton of great work, but I obviously disagree with him on this point. I do not believe governments (especially ones engaged in clandestine surveillance operations) have an obligation to share security vulnerabilities with companies. But neither do those companies have an obligation to create vulnerabilities for the governments to exploit (on the contrary; the companies have an obligation to find and fix the holes in their products). How do you determine if a vulnerability was there because it was overlooked in development, or if it was there because the government demanded it from the company but used the law to impose a gag order on the company preventing the public from finding out about it?
- exelius 11y ago
  > How do you determine if a vulnerability was there because it was overlooked in development, or if it was there because the government demanded it from the company but used the law to impose a gag order on the company preventing the public from finding out about it? You don't; but that's possible today with the way the gag orders and FISA courts work. That's a real problem around transparency in our legal system; which IMO is a different issue from transparency around security issues relating to privately-developed products.
  - coherentpony 11y ago
    That's a really interesting viewpoint. Thanks for sharing it. In my opinion the government should be obliged to share the vulnerability for the purposes of the keeping the rest of the users safe from the same exploit, whether executed by the government or executed by somebody else. In summary, I disagree with you but I'm glad I took the time to ask you about your view since I learned something new.
npsimons 11y ago
> I do not believe governments (especially ones engaged in clandestine surveillance operations) have an obligation to share security vulnerabilities with companies. So I take it then you don't believe in a government "for the people"? Like it or not, Apple is legally a person, and even tossing that aside, we know that many of Apple's customers are American citizens, and this whole idea of "keeping knowledge from you for your own good" just reeks of the patronizing oligarchy that the US government has become known for. Lest you jump to the argument that this would endanger operations, I would still point out two very salient facts: this information is not intelligence data, and as Schneier pointed out, this attack can be used against many in the US government, including FBI agents in the field. Getting it fixed is the right thing to do.

deleted 11y ago

[deleted]

iuguy 11y ago

I have to respectfully disagree here. There are bugs in iOS, iPhones and pretty much everything. It would be naive and foolish to think that any electronic device you use doesn't have bugs. It would also be remiss to think that people aren't looking for the vulnerabilities, people like Stefan Esser have plenty of research documenting the security mechanisms and flaws in iOS, and in the hardware. People have crawled over the hardware and software documenting everything, looking for bugs. People have bugs we haven't heard about because they put the time in to go down the avenues that lead nowhere in order to find them. The people that would find these bugs have a deep knowledge and understanding of the internals of the devices in question, and some suspicion of how they would be applied in this situation. They are not people who would go from zero knowledge to chasing 0day without at least a decent lead as to what the FBI's third party did. The thing is, the FBI are not obligated to hand over their bugs, nor are the third party. It's the third party's trick, they found it, if they want to keep it it's their right to do so. Asserting that somehow because someone has specific 0day (designed to bypass unlocks when the phone is in their physical possession for an extended period of time) and doesn't want to share makes us all less secure is incredibly ingenuous and a logical fallacy at best.

adekok 11y ago

> The probabilities change, even when a door you didn't pick [and doesn't hold the prize] is opened. That's the common misunderstanding of the problem. Most people think that the probabilities go fro 1/3, 1/3, 1/3 to 1/2, 1/2, after choosing a door and having Monty Hall open one of the others. The probabilities don't change. The probabilities are 1/3, 1/3, 1/3 at the start. After you choose a door, they're still 1/3, 1/3, 1/3. Or a put a different way: 1/3 (your choice) 2/3 (what you didn't choose). When Monty Hall opens one of the other doors, the probabilities don't change. It's still 1/3 (your choice) 2/3 (what you didn't choose). However, because he's removed one of the doors from the problem, the 2/3 probability is now applied to the remaining door. That can be viewed as "probabilities changing" for the remaining door, but it's better described as the probabilities being shared between the doors you didn't choose.

Retric 11y ago
This assumes you always open a door, that door never holds the prize, and there is exactly 1 prize. You could run (ed:a similar game with different rules) such that the odds go 1/3,1/3,1/3 to 1/2, 1/2 if you flipped a coin to chose the second door and sometimes show the prize. Alternatively, if you chose when to open the second door, you could make swapping a very good (100%) or very poor choice (0%). Worse, you could swap what's behind the doors after they chose. Which IMO is why people find this so confusing. In the real world the odds presented may or may not line up with the actual odds. aka unknown unknowns.
- ghshephard 11y ago
  This is incorrect. Flipping a coin to "to chose the second door and sometimes show the prize." has no impact on the probabilities. The parent is correct - there is a 2/3 chance the prize exists under one of the other two doors, and if one of them is shown not to have the prize (through random flipping, deliberate selection, whatever) - then the final door now has a 2/3 chance to have the prize.
  - function_seven 11y ago
    If one of the doors is shown to not have the prize, the odds are now 1/2 when the choice of reveal door is made randomly. That's because 1/3 of the time, you're not even offered the chance to switch, since it's pointless. I'll run the trials here. Assume the first two doors have the goat, and the third door has the car. Pick Reveal Switch? Outcome ---- ------ ------- ------- 1 2 Y 3 Car 2 1 Y 3 Car 3 1 N 3 Car 3 2 N 3 Car 1 2 N 1 Goat 2 1 N 2 Goat 3 1 Y 2 Goat 3 2 Y 1 Goat 1 3 - No chance to switch 1 3 - No chance to switch 2 3 - No chance to switch 2 3 - No chance to switch Meaning, given that you've made it to the point that an offer to switch doors is presented, there is no advantage to do so (or not do so).

cptvideo2 11y ago

>take the Monty Hall problem It amazing how many people still don’t get the Monty Hall problem. Its lesson is that the probabilities do NOT change – until we make a choice!. That’s why it’s better to switch once we see the goat behind door 1. The probability of our having made a good choice, initially (1 in 3), has NOT changed even though there are now only two ‘choices’. But they are not REALLY choices because we’ve ALREADY chosen. The probability can only change if we make a NEW choice, because the ‘probability’ that we’re discussing is the probability that our choice, at the time it was made, would produce a result that we wanted. The iPhone 5 is clearly no less secure now than it was then. But we can switch.

fixermark 11y ago
It's much easier to understand when you realize that Monty never reveals that one of the closed doors contained the car. That asymmetry of action leads to the asymmetry of probabilities; your initial choice constrained his choices when he takes action.
- cptvideo2 11y ago
  Well, Monty doesn't know (or care about) your choice. He's 'constrained' by the fact that his 'probability' is 100%: he knows where the goats and car are.
  - jjnoakes 11y ago
    What? Of course his action is based on your choice. If a has the car and b and c have goats, and you pick b, he opens c. And if you pick c, he opens b...
    - cptvideo2 11y ago
      You’re right. I forgot that you had to tell him which door you wanted to open (instead of just saying that you've decided on a door - like the FBI as just SAID that they've cracked the iPhone5). But it doesn’t matter because Monty was always going to open one of the two goat doors, and the one that he opens doesn’t matter to the 1/3 probability that you picked the car door. Your probability of getting the car ALWAYS doubles when you switch (even though you still may not get it).

hollander 11y ago

I really don't see how this relates to the Monty Hall problem. The FBI just revealed how to unlock an encrypted phone. That's like opening the door with the car behind it.

mikeash 11y ago

According to the article, the vulnerability was known. All that changed is the FBI got somebody to use it. I would agree with the "less secure" bit if the FBI had uncovered the vulnerability, or asked some third party to do it. But since they just used something that was already known, the "less secure" statement makes no sense to me.

mikecb 11y ago

a "renowned security researcher" or a "renowned academic cryptographer"?