3 ms·
While the situation described here has measures that can be taken to prevent, the entire system is trivially compromised by the fact that the consumer controls
by chacham15 8y ago
While the situation described here has measures that can be taken to prevent, the entire system is trivially compromised by the fact that the consumer controls the software. All a bad actor needs to foil this entire schema is to unlock the phone and program it so that whenever it is asked for a device unlock request, it will simply factory reset the hard drive (or even more covertly, reimage it to a different drive). With this approach, the criminal reveals nothing and law-abiding citizens are open to multiple undiscovered attack vectors.
- abcd_f 8y agoThis is covered in the article: Another problem is that CLEAR phones must resist "jailbreaking", i.e., must not let phone owners modify the operating system or firmware on their own phones. This is because CLEAR critically relies on users not being able to tamper with their phones' unlocking functionality, and this functionality would surely be implemented in software, as part of the operating system or firmware, due to its sheer complexity (e.g., it includes the "device unlock request" screen, QR code recognition, crytographic verification of unlock codes, and transmission of data dumps). In practice, it is well-nigh impossible to prevent jailbreaking in complex consumer devices, and even for state-of-the-art locked-down platforms such as Apple's iOS, jailbreak methods are typically discovered and widely circulated soon after every operating system update.