11 ms·
Some technical detail would be nice. At the moment, this is just an advertisement for their iPhone backup cracking software.
by tetrep 10y ago
Some technical detail would be nice. At the moment, this is just an advertisement for their iPhone backup cracking software.
- mkagenius 10y agoyup, literally anyone could claim that.. bad article
- huhtenberg 10y agoElcomsoft is hardly "anyone" when it comes to this particular subject matter. You may want to look them up.
- jjnoakes 10y agoThat sounds close to an appeal to authority.
- spdustin 10y agoIt's not the logical fallacy you think it is when there's an actual authority involved.
- jjnoakes 10y agoAppeal to authority requires an actual authority to be involved.
- spdustin 10y agoAnd it's not a fallacy > An argument from authority (Latin: argumentum ad verecundiam), also called an appeal to authority, is a common type of argument which can be fallacious, such as when an authority is cited on a topic outside their area of expertise or when the authority cited is not a true expert. https://en.m.wikipedia.org/wiki/Argument_from_authority https://en.m.wikipedia.org/wiki/Argument_from_authority Calling it a fallacy when there's an actual authority is the part that's incorrect. It's no longer a fallacy when the appeal to authority (argument from authority) involves an actual authority.
- mkagenius 10y ago> It's no longer a fallacy when the appeal to authority (argument from authority) involves an actual authority. If I have to go google who has written that article to blindly believe in it - that certainly reflects poorly on the article itself.
- spdustin 10y agoWhy would you do that? The citations are there for a reason. Several reasons. One of which would be to avoid using the article author's background as part of an argument against the content of the article. Because that would be an ad hominem.
- jjnoakes 10y agoNo, that's not true. Appeal to authority means accepting what an authority says on the merit of the entity being an authority, and not on the validity of the statement itself. Re-read your wikipedia article...
- spdustin 10y agoYes, it is true. I said the instance wasn't a fallacy. Read my comment again. To be clear: an appeal to authority isn't always fallacious.
- jjnoakes 10y agoThis part of what you said: "It's no longer a fallacy when the appeal to authority (argument from authority) involves an actual authority." is not true. The right thing to say would have been "It is no longer a fallacy when the authority making the claim provides enough convincing evidence to make the claim valid, with or without an authority", if that's indeed what you meant to say. But that's not what you said, and so I stand by my assertion that what you said is not true. We have the original post in this thread of interest saying (paraphrasing): "The article has no substance, so the claim is it making could be made by anyone. The article is not useful and the claim is not substantiated". Then we have a reply: "Elcomsoft is an authority on the topic so their claim should be stronger than if anyone else made it". This is where I said it looks close to an appeal to authority. But you then came in and said "when there's an actual authority there is no longer an appeal to authority". Which is not true. I mean, how can there be an appeal to authority with no authority? That's like saying there's a car accident with no car.
- mrb 10y agoThey did not just write an article, they also provide the brute forcing tool to prove their claims.
- dchest 10y agoPer Thorsheim says: "Apple have moved from pbkdf2(sha1) with 10K iterations to a plain sha256 hash with a single iteration only. Bruteforce with CPU!" https://twitter.com/thorsheim/status/779207177416351744 https://twitter.com/thorsheim/status/779207177416351744
- willvarfar 10y agoWhaooo wtf? It is password 101 to use a password hash function to hash a password. This seems a very serious bug, by developers who ought know what they are doing :(
- madeofpalk 10y agoThe cynical pessimist would say they did this on purpose to help government agencies extract data.
- madeofpalk 10y agoThe other cynical person would say that doesn't make sense because out of the very small amount of people that backup via iTunes, an extremely small percent of them would actually bother encrypting.
- 0x0 10y agoIf you don't encrypt the backup, then iTunes does not backup your stored passwords (wifi WPA2, web, mail, etc), health data, and other items considered "sensitive", which makes for a poor backup/restore experience. So there's a big benefit in enabling encryption in iTunes. It's a bit annoying considering macOS can also use FileVault for full-disk encryption, which helps if the machine is locked/off. I guess it doesn't help against your macOS user account being compromised via a browser or anything. Makes me wonder if anyone has taken a fresh new look at the FDE passphrase algorithms in macOS 10.12...
- acqq 10y agoOr, also pessimistically, that they know more about Intel's https://en.wikipedia.org/wiki/Intel_Active_Management_Technology https://en.wikipedia.org/wiki/Intel_Active_Management_Techno... and its potential.
- xnyhps 10y agoFor me, Manifest.db inside the backup is a sqlite3 database containing a table Properties with two rows, salt and passwordHash, satisfying: passwordHash == SHA256(password || salt)