5 ms·

IPhone Attack Reveals Passwords in Six Minutes

20 points by ukdm 16y ago

RiderOfGiraffes 16y ago
Dup: http://news.ycombinator.com/item?id=2201213 http://news.ycombinator.com/item?id=2201213 No votes, no comments, no attention, no traction.
- stcredzero 16y ago
  Newsflash: You can do what you want on a jail broken iPhone. This includes running Keychain tools. The same goes for laptops, and has been true forever. Physical possession = no security applies. Not news, exactly.
  - deleted 16y ago
    [deleted]
  - travisp 16y ago
    This isn't really accurate. For example, if I have good whole disk encryption on my laptop, and it's stolen, I am reasonably well protected assuming I used a good password. Yes, the hardware could be tinkered with, the laptop could be given back to me, I could enter my password and then the laptop could be stolen again, but that's not quite the same thing. It's significant because some other smart phones have fairly strong encryption options that would prevent an attack like this, AFAIK.
  - DougBTX 16y ago
    The keychain is encrypted with the user's login password on OSX, you need the login password to decrypt the passwords stored in the keychain. The point being made in the article is that changing your iPhone pin/password does not re-encrypt the saved passwords since they are encrypted with a fixed key.
program 16y ago
This is not actually a "news". Every piece of tecnology can be cracked/hacked if you have physical possession. The "Fraunhofer Institute Secure Information Technology" used an iPhone only cause the device attract more attentions than others. The PDF remote exploit that forced Apple to release iOS 4.0.2 was a news.
- jvdongen 16y ago
  Except that storing the passwords in encrypted form in a keychain is explicitly meant to shield them from prying eyes even in the event the hardware falls in the wrong hands. You may get at the file, you just can't get at the data. At least - that is what I as a user would want and expect. And from a technical point of view, that situation can be achieved with modern crypto. Clearly, the way Apple implemented it is not sufficient in this regard. That is the news.
  - program 16y ago
    It's not true cause Apple encrypt the keychain entries with Triple-DES (which isn't modern crypto but it's better than nothing.) If you get the file you can't read it unless you have the password. The "attackers" do load the code in the phone and then they got the entries using the system API which is very (very) different from having only the file and/or only a not jailbroken phone. I repeat, !news.

20 points by ukdm 16y ago

Dup: http://news.ycombinator.com/item?id=2201213 http://news.ycombinator.com/item?id=2201213 No votes, no comments, no attention, no traction.

stcredzero 16y ago
Newsflash: You can do what you want on a jail broken iPhone. This includes running Keychain tools. The same goes for laptops, and has been true forever. Physical possession = no security applies. Not news, exactly.
- deleted 16y ago
  [deleted]
- travisp 16y ago
  This isn't really accurate. For example, if I have good whole disk encryption on my laptop, and it's stolen, I am reasonably well protected assuming I used a good password. Yes, the hardware could be tinkered with, the laptop could be given back to me, I could enter my password and then the laptop could be stolen again, but that's not quite the same thing. It's significant because some other smart phones have fairly strong encryption options that would prevent an attack like this, AFAIK.
- DougBTX 16y ago
  The keychain is encrypted with the user's login password on OSX, you need the login password to decrypt the passwords stored in the keychain. The point being made in the article is that changing your iPhone pin/password does not re-encrypt the saved passwords since they are encrypted with a fixed key.

program 16y ago

This is not actually a "news". Every piece of tecnology can be cracked/hacked if you have physical possession. The "Fraunhofer Institute Secure Information Technology" used an iPhone only cause the device attract more attentions than others. The PDF remote exploit that forced Apple to release iOS 4.0.2 was a news.

jvdongen 16y ago
Except that storing the passwords in encrypted form in a keychain is explicitly meant to shield them from prying eyes even in the event the hardware falls in the wrong hands. You may get at the file, you just can't get at the data. At least - that is what I as a user would want and expect. And from a technical point of view, that situation can be achieved with modern crypto. Clearly, the way Apple implemented it is not sufficient in this regard. That is the news.
- program 16y ago
  It's not true cause Apple encrypt the keychain entries with Triple-DES (which isn't modern crypto but it's better than nothing.) If you get the file you can't read it unless you have the password. The "attackers" do load the code in the phone and then they got the entries using the system API which is very (very) different from having only the file and/or only a not jailbroken phone. I repeat, !news.