4 ms·
Why is that? I've long been against Apple's stance of not allowing me access to the hardware I own, and this exploit seems the best of both worlds: If you want
by StavrosK 7y ago
Why is that? I've long been against Apple's stance of not allowing me access to the hardware I own, and this exploit seems the best of both worlds: If you want to make sure you're secure, just reboot the phone.
- mentat 7y agoIf you can access using this so can others when you cross borders, are stopped by police, have spying spouse, etc. Those are real and sometimes fatal threat models.
- deleted 7y ago[deleted]
- fullonrager 7y agoIf law enforcement did take your device, it would be useless if you have a passcode. Your data will still be encrypted.
- deleted 7y ago[deleted]
- gruez 7y agodepends on whether exploiting the bootrom allows you bypass the anti-hammering mechanism, or the "wipe data after 10 failed attempts" mechanism. A 6 digit passcode by itself is very easy to crack.
- StavrosK 7y agoIt doesn't. Just reboot the phone and it's secure.
- gruez 7y agoI think you misunderstood the threat model. The concern is that they seized your phone, used the exploit to bypass the "normal" passcode protections, allowing them to bruteforce your 6 digit passcode in hours/days rather than years/decades/never (if you had the wipe after 10 failed attempts enabled).
- morpheuskafka 7y agoIIRC from the San Bernardino case, that was the case on the shooter's phone (a 5S I think), but since then it has been built in to the "Secure Enclave" chip which is not affected by the vulnerability. But you could flash a fake iOS that logged the user's code and/or directly exfiltrated the data--the user would have no idea that it was not the stock iOS they were giving their code to. It would leave them which a bricked device the next time they rebooted, which could raise suspicions.
- earenndil 7y agoIt was a 5c; 5s and later had the SEP. You don't 'flash' a fake ios; you can use the bootrom exploit to put your modified version of ios into memory, and once you reboot you would get back straight stock ios. They could even make it reboot as soon as the password was harvested, leaving behind no trace. This is scary stuff. You can keep yourself safe by rebooting as soon as you get your phone back from border patrol, but many people would not know to do that.
- ibigb 7y agoYou can use a numeric sequence passphrase as your passcode; there is no 6 digit limitation; I have a > 6 numeric passcode/passphrase.
- glhaynes 7y agoYou can also use an alphanumeric sequence.
- tptacek 7y agoDon't use a 6-digit passcode.
- paulcole 7y agoMy take is that you’re misinterpreting what you (theoretically) have purchased. You bought an iPhone, not a pile of hardware. Nowhere in the transaction did Apple misrepresent what they offered. Your wish for iPhone shaped hardware that is yours to do whatever you want with doesn’t change the fact that this isn’t what’s for sale.
- StavrosK 7y agoHow do you reconcile the fact that I've bought it with the fact that it's not "mine to do whatever I want with"? Ownership is the state of exclusive rights and control over property, which I don't have when I buy an Apple device. Either they shouldn't say they're selling it (they can say they're leasing it to me) or they should give me all rights.
- lotsofpulp 7y agoWorld isn’t so black and white. There are restrictions on many things you “own”. Land, certain chemicals, technologies, etc. I like to think of “owning” in the developed world simply as a right to collect rent from someone else.
- StavrosK 7y ago> There are restrictions on many things you “own”. Are any of these restrictions there so a private third party can decide what you do with your property?
- ralfd 7y agoIf you lost your iPhone or it was stolen it was just a worthless brick for the finder/thief. Think about what a big peace of mind that is! This changed now for older hardware.
- blattimwind 7y agoIt didn't, because the encryption keys are in the secure coprocessor.
- oarsinsync 7y agoYour data is protected, but the iCloud activation lock can be bypassed. Hence it no longer being a brick.
- tptacek 7y agoWhat's the market value of a phone that has to be put into firmware upgrade mode every time it restarts?
- oarsinsync 7y agoTBD. Check out eBay in the coming months, I’m sure a value will be determined soon. It’s definitely higher than what it is now (sold as scrap for parts)