5 ms·

> No. WhatsApp uses iOS Data Protection to encrypt user data files (including ChatStorage.sqlite) using the device-specific and unrecoverable hardware UID key a

> No. WhatsApp uses iOS Data Protection to encrypt user data files (including ChatStorage.sqlite) using the device-specific and unrecoverable hardware UID key as well as a key derived from the user's passcode. It may not be decrypted without physical access to the specific iOS device that created the file as well as knowledge of the user's passcode. Didn't we learn that not to be the case since presumably the device can still flash a new apple-signed firmware that would override this ?

heavenlyblue 6y ago
If that were the case, one would not be able to decrypt their iPhone backup on another iPhone
- seemslegit 6y ago
  No. You would still need a signed modified firmware that would make use of the passcode-derived key from the original device, but the point is that an iPhone can accept a new firmware while locked which shouldn't be the case if Apple was serious about non-compromised security.
  - snazz 6y ago
    Are you talking about DFU mode? I think it would be very difficult for Apple to remove that without causing a lot of issues for people. Being able to completely reset the device if you forget the password is useful, especially since you still need the user's iCloud credentials to activate it (so as to discourage theft).
    - seemslegit 6y ago
      I'm talking about the time Apple was asked to provide an alternative firmware to unlock the iPhone of the San Bernardino shooter, which suggests that at least Apple itself can put a new firmware on a locked device without having it wiped.
      - snazz 6y ago
        Okay. In fact, anyone can do that by restoring a device in Recovery mode.
        seemslegit 6y ago
        Well if only FBI knew about recovery mode... I'm talking about having device data preserved and made accessible, while the device is screen-locked, without having any credentials or the passcode - pick all three.
        snazz 6y ago
        Yes. If the FBI had a signed system image that disabled disk encryption, they would have applied it through Recovery mode and the data would not have been lost. They couldn’t get Apple to make or sign the software, however.
        seemslegit 6y ago
        Not the point, If installing such a software on a locked device is technically feasible that's a pretty glaring hole in the entire security approach, essentially making Apple a trusted party to your phone data with the ability to create other such parties.
        snazz 6y ago
        You already trust them not to make compromised software updates anyway. While I agree that this is definitely a potential issue, I don’t think it changes the threat model.
      - TazeTSchnitzel 6y ago
        It may be the case you can put a new OS on the device without it being wiped, because the OS partition is separate from the user data partition, and probably unencrypted. Anyway, a hypothetical alternative firmware couldn't just magically bypass the encryption. What it could have done, and I think this may only apply to older iPhone models as it's now handled by the Secure Enclave(?), is make it easier to brute-force the pincode (no lockout, less delay).
  - heavenlyblue 6y ago
    Wait, so I can’t restore my iPhone backup without the other phone?
    - Spooky23 6y ago
      When you enter your passcode while enabling backup, you’re letting iOS decrypt your data and reencrypt with the key used for the backup. Local backup key strength depends on the key. iCloud depends on the law.
    - seemslegit 6y ago
      You can because (presumably) the backup is encrypted with a key that is derived from your iThing credentials not with the phone hardware encryption key which is derived among other things from the screen lock passcode. But if you lose the passcode to your screen-locked or unpowered device any way of getting data (that has not been backed up) out of it, while it's locked or turned off implies a security flaw even if done via a firmware signed by Apple.
- tinus_hn 6y ago
  As stored on the device the files are encrypted that way. For backing up they are decrypted and then (optionally) reencrypted with the backup key.

heavenlyblue 6y ago

If that were the case, one would not be able to decrypt their iPhone backup on another iPhone

seemslegit 6y ago
No. You would still need a signed modified firmware that would make use of the passcode-derived key from the original device, but the point is that an iPhone can accept a new firmware while locked which shouldn't be the case if Apple was serious about non-compromised security.
- snazz 6y ago
  Are you talking about DFU mode? I think it would be very difficult for Apple to remove that without causing a lot of issues for people. Being able to completely reset the device if you forget the password is useful, especially since you still need the user's iCloud credentials to activate it (so as to discourage theft).
  - seemslegit 6y ago
    I'm talking about the time Apple was asked to provide an alternative firmware to unlock the iPhone of the San Bernardino shooter, which suggests that at least Apple itself can put a new firmware on a locked device without having it wiped.
    - snazz 6y ago
      Okay. In fact, anyone can do that by restoring a device in Recovery mode.
      - seemslegit 6y ago
        Well if only FBI knew about recovery mode... I'm talking about having device data preserved and made accessible, while the device is screen-locked, without having any credentials or the passcode - pick all three.
        snazz 6y ago
        Yes. If the FBI had a signed system image that disabled disk encryption, they would have applied it through Recovery mode and the data would not have been lost. They couldn’t get Apple to make or sign the software, however.
        seemslegit 6y ago
        Not the point, If installing such a software on a locked device is technically feasible that's a pretty glaring hole in the entire security approach, essentially making Apple a trusted party to your phone data with the ability to create other such parties.
        snazz 6y ago
        You already trust them not to make compromised software updates anyway. While I agree that this is definitely a potential issue, I don’t think it changes the threat model.
    - TazeTSchnitzel 6y ago
      It may be the case you can put a new OS on the device without it being wiped, because the OS partition is separate from the user data partition, and probably unencrypted. Anyway, a hypothetical alternative firmware couldn't just magically bypass the encryption. What it could have done, and I think this may only apply to older iPhone models as it's now handled by the Secure Enclave(?), is make it easier to brute-force the pincode (no lockout, less delay).
- heavenlyblue 6y ago
  Wait, so I can’t restore my iPhone backup without the other phone?
  - Spooky23 6y ago
    When you enter your passcode while enabling backup, you’re letting iOS decrypt your data and reencrypt with the key used for the backup. Local backup key strength depends on the key. iCloud depends on the law.
  - seemslegit 6y ago
    You can because (presumably) the backup is encrypted with a key that is derived from your iThing credentials not with the phone hardware encryption key which is derived among other things from the screen lock passcode. But if you lose the passcode to your screen-locked or unpowered device any way of getting data (that has not been backed up) out of it, while it's locked or turned off implies a security flaw even if done via a firmware signed by Apple.
tinus_hn 6y ago
As stored on the device the files are encrypted that way. For backing up they are decrypted and then (optionally) reencrypted with the backup key.