It's not vapourware: It may be a lie, but it's not a promise of greatness in some future version. They're saying "we have carried out an attack", not "we will a

It's not vapourware: It may be a lie, but it's not a promise of greatness in some future version. They're saying "we have carried out an attack", not "we will attack oh-so-well". Regarding the four-hour limit, the attacker have to either cheat and start making the mask in advance, or practise making masks quickly. Neither seems impossible. But of course, Apple could (and IMO would) improve the defense. I'm sure Apple would think of ways to counter any publicly known attack.