5 ms·

If you can access using this so can others when you cross borders, are stopped by police, have spying spouse, etc. Those are real and sometimes fatal threat mod

by mentat 7y ago

If you can access using this so can others when you cross borders, are stopped by police, have spying spouse, etc. Those are real and sometimes fatal threat models.

deleted 7y ago
[deleted]
fullonrager 7y ago
If law enforcement did take your device, it would be useless if you have a passcode. Your data will still be encrypted.
- deleted 7y ago
  [deleted]
- gruez 7y ago
  depends on whether exploiting the bootrom allows you bypass the anti-hammering mechanism, or the "wipe data after 10 failed attempts" mechanism. A 6 digit passcode by itself is very easy to crack.
  - StavrosK 7y ago
    It doesn't. Just reboot the phone and it's secure.
    - gruez 7y ago
      I think you misunderstood the threat model. The concern is that they seized your phone, used the exploit to bypass the "normal" passcode protections, allowing them to bruteforce your 6 digit passcode in hours/days rather than years/decades/never (if you had the wipe after 10 failed attempts enabled).
      - StavrosK 7y ago
        That is not possible, the key is inside a hardware chip which enforces the number of tries for the PIN.
        fragmede 7y ago
        Now they do. That wasn't always the case though, for those on older devices (Anything older than the 5s, I believe), or older iOS versions.
  - morpheuskafka 7y ago
    IIRC from the San Bernardino case, that was the case on the shooter's phone (a 5S I think), but since then it has been built in to the "Secure Enclave" chip which is not affected by the vulnerability. But you could flash a fake iOS that logged the user's code and/or directly exfiltrated the data--the user would have no idea that it was not the stock iOS they were giving their code to. It would leave them which a bricked device the next time they rebooted, which could raise suspicions.
    - earenndil 7y ago
      It was a 5c; 5s and later had the SEP. You don't 'flash' a fake ios; you can use the bootrom exploit to put your modified version of ios into memory, and once you reboot you would get back straight stock ios. They could even make it reboot as soon as the password was harvested, leaving behind no trace. This is scary stuff. You can keep yourself safe by rebooting as soon as you get your phone back from border patrol, but many people would not know to do that.
  - ibigb 7y ago
    You can use a numeric sequence passphrase as your passcode; there is no 6 digit limitation; I have a > 6 numeric passcode/passphrase.
    - glhaynes 7y ago
      You can also use an alphanumeric sequence.
  - tptacek 7y ago
    Don't use a 6-digit passcode.

by mentat 7y ago

If you can access using this so can others when you cross borders, are stopped by police, have spying spouse, etc. Those are real and sometimes fatal threat models.

deleted 7y ago

[deleted]

fullonrager 7y ago

If law enforcement did take your device, it would be useless if you have a passcode. Your data will still be encrypted.

deleted 7y ago
[deleted]
gruez 7y ago
depends on whether exploiting the bootrom allows you bypass the anti-hammering mechanism, or the "wipe data after 10 failed attempts" mechanism. A 6 digit passcode by itself is very easy to crack.
- StavrosK 7y ago
  It doesn't. Just reboot the phone and it's secure.
  - gruez 7y ago
    I think you misunderstood the threat model. The concern is that they seized your phone, used the exploit to bypass the "normal" passcode protections, allowing them to bruteforce your 6 digit passcode in hours/days rather than years/decades/never (if you had the wipe after 10 failed attempts enabled).
    - StavrosK 7y ago
      That is not possible, the key is inside a hardware chip which enforces the number of tries for the PIN.
      - fragmede 7y ago
        Now they do. That wasn't always the case though, for those on older devices (Anything older than the 5s, I believe), or older iOS versions.
- morpheuskafka 7y ago
  IIRC from the San Bernardino case, that was the case on the shooter's phone (a 5S I think), but since then it has been built in to the "Secure Enclave" chip which is not affected by the vulnerability. But you could flash a fake iOS that logged the user's code and/or directly exfiltrated the data--the user would have no idea that it was not the stock iOS they were giving their code to. It would leave them which a bricked device the next time they rebooted, which could raise suspicions.
  - earenndil 7y ago
    It was a 5c; 5s and later had the SEP. You don't 'flash' a fake ios; you can use the bootrom exploit to put your modified version of ios into memory, and once you reboot you would get back straight stock ios. They could even make it reboot as soon as the password was harvested, leaving behind no trace. This is scary stuff. You can keep yourself safe by rebooting as soon as you get your phone back from border patrol, but many people would not know to do that.
- ibigb 7y ago
  You can use a numeric sequence passphrase as your passcode; there is no 6 digit limitation; I have a > 6 numeric passcode/passphrase.
  - glhaynes 7y ago
    You can also use an alphanumeric sequence.
- tptacek 7y ago
  Don't use a 6-digit passcode.