5 ms·

> Grayshift has been shopping its iPhone cracking technology to police forces. The firm, which includes an ex-Apple security engineer on its staff, provided dem

by rwbt 9y ago

> Grayshift has been shopping its iPhone cracking technology to police forces. The firm, which includes an ex-Apple security engineer on its staff, provided demonstrations to potential customers, according to one email. Wow. That's very sleazy.

hardwaresofton 9y ago
Is it? Maybe I'm morally bankrupt, but if you think that's sleazy the world is a literal (figurative) ball of mud. A thing that can be cracked will be cracked. If someone's good at something, they will probably look to sell their skills. If it is within the law for police to perform this kind of thing (it probably definitely shouldn't be), they're gonna use whatever contractor can do it best (if they can't do it themselves). It just seems like the natural progression -- outside of the oddity of police being allowed to "break into" (in a sense) private property. I think this argument devolves into the does-tech-hurt-people (guns, security research) argument, and maybe I'm just way off base, but I don't knock the iphone cracking people in this instance... I mean I wouldn't necessarily do it but this isn't bad enough to pass muster in my book as sleaze.
- paulsutter 9y ago
  If they need to break the law to collect the data (the far over-reaching CFAA), what should they need? a search warrant? (honest question about civil liberties, I really am curious)
  - hardwaresofton 9y ago
    I'm definitely not the person to ask -- I don't particularly live in this space, and I'm fairly sure other people here do and could answer more completely, but: If you see modern society in a democratic environment with the (somewhat naive) outlook that a large enough group of people have consented to be governed by the laws of the land, then it's really up to the law on when this is allowed/disallowed. It's more of a reflection of the people (or.. who's making the laws), and what they've decided -- if people decide that personal privacy is protected under law then so be it. If people decide police are allowed to break the law (at all) then so be it. If people decide that police are somehow above what would normally be a law when they have certain piece of paper (search warrant) signed by the local wiseman (judge) who is likely looking out for the best interests of the community and country at large, so be it. Things get blurry really quickly, and this is a gross oversimplification of how any of these systems work, but it's how I tend to think about it. I sometimes think that it can't be any other way -- once a bunch of humans attempt to work together, there are some fundamental problems that just end up best solved this way (in terms of efficiency and other factors).
- yzmtf2008 9y ago
  You know, yes, this is morally bankrupt. This “if I don’t do it, someone else will do it” attitude really just highlights how much more ethics training do we need to have in part of becoming a software engineer. Try that attitude in the medical community, or civil engineering, or aviation engineering, or physics or chemistry, and see where that will get you. Computer Science as a field hasn’t encountered consequences: https://twitter.com/yonatanzunger/status/975545527973462016?s=21 https://twitter.com/yonatanzunger/status/975545527973462016?...
  - hardwaresofton 9y ago
    Yeah but that wasn't my argument... I didn't say that "someone else would do it so they should be that person", I'm saying that if you're good at taking apart washing machines, and someone's personal washing machine happens to have names and addresses of people who are considered government dissenters on it, the question of should you sell that knowledge to the government is up to you. It varies by case, but if you try to delineate where it's OK and where it's not, it will be endlessly subjective -- in the face of that, I lean in the "do what you want" direction. I don't think there is a single discipline that's unscathed in this discussion, it's just the level to which the morals are shared in each. In the medical community, "do whatever you can to save a life" is a pretty strong propellant, but also the medical system in the US (for one) is really fucked, and if the medical community is as ethically pure as you propose them to be, I get the feeling that wouldn't have happened. [EDIT] - Also, correct me if I'm wrong, but when I think of "ethics" I just think of agreed-upon shared moral values. That is inherently up to someone or some group to decide, at some point, is it not?
    - yzmtf2008 9y ago
      >... the question of should you sell that knowledge to the government is up to you. True. But that doesn't really free you from moral judgement. > It varies by case, but if you try to delineate where it's OK and where it's not, it will be endlessly subjective -- in the face of that, I lean in the "do what you want" direction. This really depends on your value system. Of course, you can do what you want (perhaps as long as it's legal), but again, moral judgement is a separate issue. It's totally okay to be immoral, and ethics itself doesn't really have any limitations on what you would do. From a utilitarian perspective, yes, perhaps everything is endlessly subjective, but I think for most people their ethics system lies somewhere in between deontological and utilitarian, that is, there are certain moral guidelines that are more applicable even in subjective situations. Again, I'm not saying you shouldn't do anything immoral. There are many other factors for one to consider: life, liberty, the pursuit of happiness, etc. Most of this have nothing to do with ethics at all, but none of it gives anyone a free pass for moral judgement. > the medical system in the US (for one) is really fucked That may be true, but we're not really talking about the system here. We're talking about the individual physicians. > "ethics" I just think of agreed-upon shared moral values Ethics is a system, sort of the "theory of morals". Ethics training is more about the logical study of these theories, and how one would apply a certain ethics system to evaluate a certain situation, rather than the "agreed-upon shared moral values". Endless engineering fields before us have faced these problem before, and the principles apply just fine in Computer Science.
onetimemanytime 9y ago
>>Wow. That's very sleazy. He got paid by Apple to secure them. Now he gets paid to do the opposite. After a couple of beers he will you the truth $$, but now he probably reasons it as "helping cops to catch bad guys."
- icantdrive55 9y ago
  And we can out him here? First, and last name? Maybe his addresses? And after a few beers--it's all cool anyways? (Might prevent another company from trusting him?)
setr 9y ago
It kind of just enforces the idea that security by obscurity isn't sufficient; ideally even despite deep knowledge of the internals, it should still be secure. What would be sleazy though is if he deliberately discovered a bug and didn't report it to apple while working there, and then took it with him to this job. But if he simply made use of his general knowledge of the system for more effective pentesting, I think its pretty much fair, and expected
- etatoby 9y ago
  No, what would be really sleazy is if he deliberately planted a bug in a hard to find place in order to quit and start his own business.
  - votepaunchy 9y ago
    Not just sleazy but also illegal. And subject to discovery in an Apple lawsuit.
    - FLUX-YOU 9y ago
      And likely very easy to figure out unless he misled another engineer to make the actual commit.
      - xvf22 9y ago
        Or he saw a bug go in and said nothing.
jjeaff 9y ago
It seems crazy that apple wouldn't have some kind of iron clad confidentiality agreement for any developers that work in security. Obviously, you can't prohibit ex employees from getting a job elsewhere, you surely can stop them from peddling company secrets to the highest bidder. That being said, the only way I can imagine that apple isn't already prepping a massive lawsuit is that the method they are using did not necessarily require insider knowledge.
- krageon 9y ago
  Worst case you have to pay (a lot of) fines (at least in the jurisdiction where I am jail time is not an option for stuff like this). That just makes the price go up by however much the fines are and doesn't solve anything. In the end, people are free to do what they want.
userbinator 9y ago
If it was marketed to repair shops and such, would you think it's "sleazy"? What if he released it as a way to jailbreak? Data recovery is the other use which comes to mind. Quite frankly, I think it's a relief to see a few "cracks in the wall" --- that not everyone working for Apple agrees completely with their authoritarian view of security.
- cbrozefsky 9y ago
  So encrypting my private data effectively is authoritarian now?
- wool_gather 9y ago
  Sure, "I forgot my password and want to recover my own data" is a legitimate use of a security flaw, and you might be happy in the short term if you need to use it like that. That doesn't make it a good thing overall that the flaw exists.
josefresco 9y ago
Hacker News: Hack everything! Hacking Company: We've hacked the iPhone and are selling the tech to law enforcement. Hacker News: Evil! Sleazy!
- sametmax 9y ago
  Yeah it's a bit like FOSS people not liking for profit companies using open source to make money or like people saying you have freedom of speech but what you say offense them. Having your cake and all that.
- wool_gather 9y ago
  You keep using that word. I do not think it means what you think it means. Hacker News: Hack everything! Cracking company: We've cracked the iPhone and are selling the tech to law enforcement. Ref: http://www.catb.org/jargon/html/meaning-of-hack.html http://www.catb.org/jargon/html/meaning-of-hack.html http://www.catb.org/jargon/html/C/cracker.html http://www.catb.org/jargon/html/C/cracker.html
  - da_chicken 9y ago
    I'm sorry, but it's no longer the 1980s. In plain English, hacking now means "gain unauthorized access to a computer." You may not like it, but English is defined by usage, not whatever culture the one-time jargon was inherited from.
    - wool_gather 9y ago
      Regardless, the point is that the parent's satirical accusation of hypocrisy is invalid because it's using the same word "hack" for two very different meanings.
      - da_chicken 9y ago
        I mean, yes, that was the joke.

by rwbt 9y ago

hardwaresofton 9y ago

Is it? Maybe I'm morally bankrupt, but if you think that's sleazy the world is a literal (figurative) ball of mud. A thing that can be cracked will be cracked. If someone's good at something, they will probably look to sell their skills. If it is within the law for police to perform this kind of thing (it probably definitely shouldn't be), they're gonna use whatever contractor can do it best (if they can't do it themselves). It just seems like the natural progression -- outside of the oddity of police being allowed to "break into" (in a sense) private property. I think this argument devolves into the does-tech-hurt-people (guns, security research) argument, and maybe I'm just way off base, but I don't knock the iphone cracking people in this instance... I mean I wouldn't necessarily do it but this isn't bad enough to pass muster in my book as sleaze.

paulsutter 9y ago
If they need to break the law to collect the data (the far over-reaching CFAA), what should they need? a search warrant? (honest question about civil liberties, I really am curious)
- hardwaresofton 9y ago
  I'm definitely not the person to ask -- I don't particularly live in this space, and I'm fairly sure other people here do and could answer more completely, but: If you see modern society in a democratic environment with the (somewhat naive) outlook that a large enough group of people have consented to be governed by the laws of the land, then it's really up to the law on when this is allowed/disallowed. It's more of a reflection of the people (or.. who's making the laws), and what they've decided -- if people decide that personal privacy is protected under law then so be it. If people decide police are allowed to break the law (at all) then so be it. If people decide that police are somehow above what would normally be a law when they have certain piece of paper (search warrant) signed by the local wiseman (judge) who is likely looking out for the best interests of the community and country at large, so be it. Things get blurry really quickly, and this is a gross oversimplification of how any of these systems work, but it's how I tend to think about it. I sometimes think that it can't be any other way -- once a bunch of humans attempt to work together, there are some fundamental problems that just end up best solved this way (in terms of efficiency and other factors).
yzmtf2008 9y ago
You know, yes, this is morally bankrupt. This “if I don’t do it, someone else will do it” attitude really just highlights how much more ethics training do we need to have in part of becoming a software engineer. Try that attitude in the medical community, or civil engineering, or aviation engineering, or physics or chemistry, and see where that will get you. Computer Science as a field hasn’t encountered consequences: https://twitter.com/yonatanzunger/status/975545527973462016?s=21 https://twitter.com/yonatanzunger/status/975545527973462016?...
- hardwaresofton 9y ago
  Yeah but that wasn't my argument... I didn't say that "someone else would do it so they should be that person", I'm saying that if you're good at taking apart washing machines, and someone's personal washing machine happens to have names and addresses of people who are considered government dissenters on it, the question of should you sell that knowledge to the government is up to you. It varies by case, but if you try to delineate where it's OK and where it's not, it will be endlessly subjective -- in the face of that, I lean in the "do what you want" direction. I don't think there is a single discipline that's unscathed in this discussion, it's just the level to which the morals are shared in each. In the medical community, "do whatever you can to save a life" is a pretty strong propellant, but also the medical system in the US (for one) is really fucked, and if the medical community is as ethically pure as you propose them to be, I get the feeling that wouldn't have happened. [EDIT] - Also, correct me if I'm wrong, but when I think of "ethics" I just think of agreed-upon shared moral values. That is inherently up to someone or some group to decide, at some point, is it not?
  - yzmtf2008 9y ago
    >... the question of should you sell that knowledge to the government is up to you. True. But that doesn't really free you from moral judgement. > It varies by case, but if you try to delineate where it's OK and where it's not, it will be endlessly subjective -- in the face of that, I lean in the "do what you want" direction. This really depends on your value system. Of course, you can do what you want (perhaps as long as it's legal), but again, moral judgement is a separate issue. It's totally okay to be immoral, and ethics itself doesn't really have any limitations on what you would do. From a utilitarian perspective, yes, perhaps everything is endlessly subjective, but I think for most people their ethics system lies somewhere in between deontological and utilitarian, that is, there are certain moral guidelines that are more applicable even in subjective situations. Again, I'm not saying you shouldn't do anything immoral. There are many other factors for one to consider: life, liberty, the pursuit of happiness, etc. Most of this have nothing to do with ethics at all, but none of it gives anyone a free pass for moral judgement. > the medical system in the US (for one) is really fucked That may be true, but we're not really talking about the system here. We're talking about the individual physicians. > "ethics" I just think of agreed-upon shared moral values Ethics is a system, sort of the "theory of morals". Ethics training is more about the logical study of these theories, and how one would apply a certain ethics system to evaluate a certain situation, rather than the "agreed-upon shared moral values". Endless engineering fields before us have faced these problem before, and the principles apply just fine in Computer Science.

onetimemanytime 9y ago

>>Wow. That's very sleazy. He got paid by Apple to secure them. Now he gets paid to do the opposite. After a couple of beers he will you the truth $$, but now he probably reasons it as "helping cops to catch bad guys."

icantdrive55 9y ago
And we can out him here? First, and last name? Maybe his addresses? And after a few beers--it's all cool anyways? (Might prevent another company from trusting him?)

setr 9y ago

It kind of just enforces the idea that security by obscurity isn't sufficient; ideally even despite deep knowledge of the internals, it should still be secure. What would be sleazy though is if he deliberately discovered a bug and didn't report it to apple while working there, and then took it with him to this job. But if he simply made use of his general knowledge of the system for more effective pentesting, I think its pretty much fair, and expected

etatoby 9y ago
No, what would be really sleazy is if he deliberately planted a bug in a hard to find place in order to quit and start his own business.
- votepaunchy 9y ago
  Not just sleazy but also illegal. And subject to discovery in an Apple lawsuit.
  - FLUX-YOU 9y ago
    And likely very easy to figure out unless he misled another engineer to make the actual commit.
    - xvf22 9y ago
      Or he saw a bug go in and said nothing.

jjeaff 9y ago

It seems crazy that apple wouldn't have some kind of iron clad confidentiality agreement for any developers that work in security. Obviously, you can't prohibit ex employees from getting a job elsewhere, you surely can stop them from peddling company secrets to the highest bidder. That being said, the only way I can imagine that apple isn't already prepping a massive lawsuit is that the method they are using did not necessarily require insider knowledge.

krageon 9y ago
Worst case you have to pay (a lot of) fines (at least in the jurisdiction where I am jail time is not an option for stuff like this). That just makes the price go up by however much the fines are and doesn't solve anything. In the end, people are free to do what they want.

userbinator 9y ago

If it was marketed to repair shops and such, would you think it's "sleazy"? What if he released it as a way to jailbreak? Data recovery is the other use which comes to mind. Quite frankly, I think it's a relief to see a few "cracks in the wall" --- that not everyone working for Apple agrees completely with their authoritarian view of security.

cbrozefsky 9y ago
So encrypting my private data effectively is authoritarian now?
wool_gather 9y ago
Sure, "I forgot my password and want to recover my own data" is a legitimate use of a security flaw, and you might be happy in the short term if you need to use it like that. That doesn't make it a good thing overall that the flaw exists.

josefresco 9y ago

Hacker News: Hack everything! Hacking Company: We've hacked the iPhone and are selling the tech to law enforcement. Hacker News: Evil! Sleazy!

sametmax 9y ago
Yeah it's a bit like FOSS people not liking for profit companies using open source to make money or like people saying you have freedom of speech but what you say offense them. Having your cake and all that.
wool_gather 9y ago
You keep using that word. I do not think it means what you think it means. Hacker News: Hack everything! Cracking company: We've cracked the iPhone and are selling the tech to law enforcement. Ref: http://www.catb.org/jargon/html/meaning-of-hack.html http://www.catb.org/jargon/html/meaning-of-hack.html http://www.catb.org/jargon/html/C/cracker.html http://www.catb.org/jargon/html/C/cracker.html
- da_chicken 9y ago
  I'm sorry, but it's no longer the 1980s. In plain English, hacking now means "gain unauthorized access to a computer." You may not like it, but English is defined by usage, not whatever culture the one-time jargon was inherited from.
  - wool_gather 9y ago
    Regardless, the point is that the parent's satirical accusation of hypocrisy is invalid because it's using the same word "hack" for two very different meanings.
    - da_chicken 9y ago
      I mean, yes, that was the joke.