5 ms·

> I do not believe governments (especially ones engaged in clandestine surveillance operations) have an obligation to share security vulnerabilities with compan

> I do not believe governments (especially ones engaged in clandestine surveillance operations) have an obligation to share security vulnerabilities with companies. So I take it then you don't believe in a government "for the people"? Like it or not, Apple is legally a person, and even tossing that aside, we know that many of Apple's customers are American citizens, and this whole idea of "keeping knowledge from you for your own good" just reeks of the patronizing oligarchy that the US government has become known for. Lest you jump to the argument that this would endanger operations, I would still point out two very salient facts: this information is not intelligence data, and as Schneier pointed out, this attack can be used against many in the US government, including FBI agents in the field. Getting it fixed is the right thing to do.

exelius 11y ago
> Lest you jump to the argument that this would endanger operations, I would still point out two very salient facts: this information is not intelligence data, and as Schneier pointed out, this attack can be used against many in the US government, including FBI agents in the field. Getting it fixed is the right thing to do. I agree with you that given the facts we know today, notifying Apple is the right thing to do. But I also think the FBI should have some latitude in deciding what is in its best interest; and if they're making their own agents vulnerable to an exploit they know exists -- well, that's dumb and I hope it bites them in the ass.
- ryao 11y ago
  We do not even know if the FBI knows the vulnerability. The phone could have been attacked by a contractor working for the FBI without the contractor sharing the tools.
  - camillomiller 11y ago
    This is a great point. Cellebrite's known for their black box approach. Law enforcements and Courts can send their locked iPhone and get it back unlocked. They'll just get the job done without knowing what was actually performed on the phone. This might as well be the case here.
    - c22 11y ago
      Doesn't this approach cast doubt on the legitimacy of any evidence obtained from the device?
      - camillomiller 11y ago
        Don't think so, it's basically like lock picking a suspect's apartment with a warrant. What is found should be valid evidence, no? Law enforcement can break the door or call a locksmith and pay him for his service. In this case Cellebrite's the locksmith.
        c22 11y ago
        That seems reasonable, but usually investigators would be on the scene while the locksmith works. If the process is a black box that happens while the device is in Cellebrite's possession isn't it more like calling up the locksmith from the precinct and saying "hey, could you open up the apartment at this address and call us when you're done? Don't go inside or touch anything though, thanks!" What prevents Cellebrite employees from planting or deleting evidence after the device is unlocked and before returning it? What guarantees are there that Cellebrite's unlocking process doesn't intentionally or unintentionally modify some other aspect of the device? Scouts honor? What if their process is to just flash a new rom filled with child porn and no passcode then skip merrily to the bank to cash their checks?
        camillomiller 11y ago
        Yep, I understand that. I don't think that was posed as a problem in the Italian case I know of, although I think that in the U.S. rules on the chain of custody are stricter, indeed. That's a good point.
    - deleted 11y ago
      [deleted]
    - deleted 11y ago
      [deleted]
mc32 11y ago
Agents who handle secret or otherwise restricted data should not be handling it on a mobile device. Those devices should be sanitized. Presuming security is what gets people compromised (and in some cases in political trouble as one US presidential candidate is coming to realize).
- npsimons 11y ago
  Presuming security is when someone says "restricted data should not be [handled] on a mobile device". Spills happen, intentionally or otherwise. This security hole should be fixed before a field agent gets his iPhone hacked by the Chinese.
talaketu 11y ago
> Apple is legally a person it's not government "for the persons"

exelius 11y ago

> Lest you jump to the argument that this would endanger operations, I would still point out two very salient facts: this information is not intelligence data, and as Schneier pointed out, this attack can be used against many in the US government, including FBI agents in the field. Getting it fixed is the right thing to do. I agree with you that given the facts we know today, notifying Apple is the right thing to do. But I also think the FBI should have some latitude in deciding what is in its best interest; and if they're making their own agents vulnerable to an exploit they know exists -- well, that's dumb and I hope it bites them in the ass.

ryao 11y ago
We do not even know if the FBI knows the vulnerability. The phone could have been attacked by a contractor working for the FBI without the contractor sharing the tools.
- camillomiller 11y ago
  This is a great point. Cellebrite's known for their black box approach. Law enforcements and Courts can send their locked iPhone and get it back unlocked. They'll just get the job done without knowing what was actually performed on the phone. This might as well be the case here.
  - c22 11y ago
    Doesn't this approach cast doubt on the legitimacy of any evidence obtained from the device?
    - camillomiller 11y ago
      Don't think so, it's basically like lock picking a suspect's apartment with a warrant. What is found should be valid evidence, no? Law enforcement can break the door or call a locksmith and pay him for his service. In this case Cellebrite's the locksmith.
      - c22 11y ago
        That seems reasonable, but usually investigators would be on the scene while the locksmith works. If the process is a black box that happens while the device is in Cellebrite's possession isn't it more like calling up the locksmith from the precinct and saying "hey, could you open up the apartment at this address and call us when you're done? Don't go inside or touch anything though, thanks!" What prevents Cellebrite employees from planting or deleting evidence after the device is unlocked and before returning it? What guarantees are there that Cellebrite's unlocking process doesn't intentionally or unintentionally modify some other aspect of the device? Scouts honor? What if their process is to just flash a new rom filled with child porn and no passcode then skip merrily to the bank to cash their checks?
        camillomiller 11y ago
        Yep, I understand that. I don't think that was posed as a problem in the Italian case I know of, although I think that in the U.S. rules on the chain of custody are stricter, indeed. That's a good point.
  - deleted 11y ago
    [deleted]
  - deleted 11y ago
    [deleted]

mc32 11y ago

Agents who handle secret or otherwise restricted data should not be handling it on a mobile device. Those devices should be sanitized. Presuming security is what gets people compromised (and in some cases in political trouble as one US presidential candidate is coming to realize).

npsimons 11y ago
Presuming security is when someone says "restricted data should not be [handled] on a mobile device". Spills happen, intentionally or otherwise. This security hole should be fixed before a field agent gets his iPhone hacked by the Chinese.

talaketu 11y ago

> Apple is legally a person it's not government "for the persons"