3 ms·
Forgive my ignorance on the matter, but is this being handled by iTunes or by the Phone for encrypting the backups? Which element is actually at fault for the p
by csydas 10y ago
Forgive my ignorance on the matter, but is this being handled by iTunes or by the Phone for encrypting the backups? Which element is actually at fault for the poorly protected backups?
If it's just iTunes being crappy with iOS 10 backups, then reasonably this is an easy patch, correct? And the change is perhaps a bit more understandable (trying to improve performance of actions from the already bloated iTunes); it's not a good reason at all to weaken the encryption method, but it at least provides a plausible explanation that doesn't have government interests as an impetus.
- heisenbit 10y agoI also suspect this is on the iTunes side. Maybe it is time to take a step back and question to what extent it is wise to trust iTunes. Could the encryption not be handled on the device? Then when the PC/Mac is compromised the backup would be still safe.
- TazeTSchnitzel 10y agoWell, it could be done on the device, but doesn't iTunes need unencrypted access to the device to function normally? (Though perhaps it ought not to.)
- raverbashing 10y agoIt's a good question If it's only related to iTunes then why does it only apply to iOS10?
- ikeboy 10y agoIt can't be iTunes' fault only. You're able to extract the data from the devices by sending the right commands, therefore the device is vulnerable.
- pfg 10y agoNot necessarily. The article mentions phones being paired with iTunes - I assume this involves entering the passcode on the phone (haven't used iTunes for my phone in years, so I'm not entirely sure, but by my understanding of the iOS security architecture, it wouldn't be possible otherwise). This probably results in some sort of authentication token that iTunes stores and uses to get the device to perform backups. So yes, there's a command to extract data, but it's not unauthenticated or anything like that.
- ikeboy 10y agoIf iTunes has a token to get complete access to the device, and this attack requires access to that token, then again it's not an iTunes issue. The way the article is worded makes me think that you wouldn't normally be able to use the token to get the data without this bug, which means that it can't be an iTunes issue. Also, the fact that it's only iOS 10 implies the same.
- pfg 10y agoGood point, that makes more sense.