4 ms·
The obvious flaw in a time-based lockout is that it needs a trusted measurement of the current time. If law enforcement wants to bypass this, the obvious appro
by csense 8y ago
The obvious flaw in a time-based lockout is that it needs a trusted measurement of the current time.
If law enforcement wants to bypass this, the obvious approach would be to just remove the battery (to remove power from any internal RTC chip) and put the device in a Faraday cage (to block external time signals like GPS and the cell network). Then the shutdown clock would literally stop ticking until they turn it on again.
- mvid 8y agoThat drastically increases the difficulty in forcing access to a phone. Regional police departments likely don't have a faraday cage and phone disassembly resources on hand, while they may have been sold on grey lock or some other automagic tool. Sure, this might not stop the NSA of FBI, but if it limits the threat vector to 3 letter agencies, it is still a win.
- DavideNL 8y agoi was wondering about this as well... so perhaps the only point of this "band-aid fix" is that if the user hasn't connected his iPhone to his computer for 7 days (i'm guessing most non-tech people rarely connect their phones to their computer), the chances are greatly increased that the lightning port is already disabled once it's captured by law enforcement/whoever.
- amhokies 8y agoIt's not 7 days from when you last connect it to a computer. It's 7 days since the phone was last unlocked.
- DavideNL 8y agoHmmz, i'm not convinced. The quote in the article says: “To improve security, for a locked iOS device to communicate with USB accessories you must connect an accessory via lightning connector to the device while unlocked – or enter your device passcode while connected – at least once a week.”
- tobylane 8y agoWithin seven days of the last time you entered your pin, the USB port will function without requiring you to enter your pin.
- DavideNL 8y agoWhere did you get that info? Because the quote says "enter your device passcode while connected" = the device has to be connected while entering the pin.
- tobylane 8y agoIf it's been seven days since you unlocked the phone you will need to enter the device passcode while connected to the device, the prompt coming up because you connected it.
- OskarS 8y agoSecurity isn't all or nothing. If something isn't "perfect", that doesn't mean it's useless. What you just described is a shit-ton of work, which most attackers will not be willing to do (how many police departments have Faraday cages lying around?).
- DINKDINK 8y ago>how many police departments have Faraday cages lying around? Police departments use Faraday bags to isolate the communications of a device once they take it into custody. I assume they do this to prevent RemoteWipe() commands from running from external entities to preserve evidence.
- DINKDINK 8y ago>the obvious approach would be to just remove the battery Might this constitute 'tampering with evidence'?
- ska 8y agothat it needs a trusted measurement of the current time. That's easily generated by doing it internally. Sure, you can't easily have a precise, trusted measurement that doesn't suffer from drift - but in this case it doesn't practically matter. So you test ~7days runtime or external clock says you've gone > 7days. Lock on either condition. You can mess with the latter as you say, but not the former. Well I suppose you can de-power the device but that doesn't really help you either. Am I missing something?
- fulafel 8y agoHopefully they considered this and the condition is actually "7 days passed or total loss of battery power occurred"
- tinus_hn 8y agoIf you shutdown or cut power to the phone the file system key is gone and you can’t unlock the file system without the pin. That would gain you nothing.