6 ms·

I guess they want to prevent someone from intercepting and tampering with a phone while it's being shipped to the customer, you know the supply chain attacks NS

• leereeves 5y ago
  But there is a way to replace the screen without disabling FaceID (how Apple does it), and the NSA likely knows how to do that as well. Or if they don't, they could force Apple to do so secretly.
  • craftinator 5y ago
    Oh no, there is no way a three letter agency found out Apples secret sauce. Obscurity is the only form of security that they'll never be able to crack!
  • marcan_42 5y ago
    The NSA doesn't have Apple's private keys. They aren't a magical organization that can crack all modern crypto either.
    • leereeves 5y ago
      Are you certain they don't have Apple's private keys? They have many ways to compel or persuade someone who does have access to those keys to give the keys to the NSA, or to infiltrate Apple with their own agents.
      • threeseed 5y ago
        Apple is going to be far more concerned about countries like China, Saudi Arabia etc than the US. The rule of law is significantly weaker and they have already shown that they will go after even mild dissidents e.g. journalists not just mass-terrorists or other more serious threats. So sure US may have the keys. But unlikely every country does.
      • simonh 5y ago
        It seems unlikely that Apple and the US government would litigate so aggressively against each other, over hacking or forcing back doors into Apple systems, if Apple had already been forced to hand over the keys to the government.
        • leereeves 5y ago
          We're talking about two different systems: the criminal justice system and the national security apparatus. The first system rarely gets help from the second, and the second may even be happy to see such litigation misleading adversaries about the government's real capabilities.
    • rndgermandude 5y ago
      >The NSA doesn't have Apple's private keys. Are you sure? Last I heard the NSA is in the intelligence gathering business... I absolutely would not put it past them that they acquired those keys somehow. Even if they do not have the keys, bribing an employee and/or installing your own NSA person as an employee in an Apple-authorized repair shop seems like a rather easy thing to do. Or just backdoor the computer that is used to communicate with apple to perform the re-signing stuff. There are thousands of authorized repair shops around the world and you only need to compromise one (or compromise a few so that any "abnormal patterns of repairs" cannot be easily detected by Apple, if it even audits repair logs for suspicious activity at all). I am sure the NSA has something figured out by now. And not just them.
      • simonh 5y ago
        So is your position on security that Apple should just give up? I'm not really clear what you're advocating.
        • makeitdouble 5y ago
          As for everything related to security granted by US companies, there is the elephant in the room that apparently needs to be restated regularity, and further discussions can come with that in mind. I don't think the parent was advocating for anything related to the NSA, just reminding us of the current state.
      • marcan_42 5y ago
        > Are you sure? Last I heard the NSA is in the intelligence gathering business... Are you sure there isn't a teapot in orbit around Mars? The NSA can't magically break into people's HSMs and steal the keys. We have a pretty good idea of what the NSA's capabilities are. If Apple's system is correctly designed, it will only allow components with certificates installed at manufacturing time to be paired together, and the pairing server will use a HSM to hold the private key to do so. Can the NSA still backdoor your phone? Sure, that's possible by physical definition. They could extract a specific camera unit's private key via FIB analysis, then manufacture a backdoored replacement, insert that key into it, then bribe or otherwise backdoor themselves into some Apple authorized repair shop and run through a re-pairing with it when they swap it into your phone. But that's a lot harder and less likely to happen (i.e. only in extremely high-value cases, if at all) than the silly "oh it's the NSA, they definitely have the keys" nonsense that people throw around here without any supporting evidence.
    • captainmuon 5y ago
      Have you heard about FISA courts? They can issue warrants for surveillance and the affected company is not allowed to disclose this. As a HN reader, it is likely you know about it but most people probably don't. Still, if a federal agent comes along with a warrant, they'll have to comply. My point is, I personally can't be sure there is no mechanism, legal or illegal, via which the NSA can just compel them to hand over the keys. Who knows, maybe there exists a FOOBAR law that compells them to build backdoors into their products. Maybe they're doing it voluntarily outside of the law. I would assume everything can be trivially hacked nowadays, and a large portion of intelligence analysts spend their time on parallel construction (i.e. creating alternative stories about how they gatheried their evidence, without giving away their abilities).
      • gmueckl 5y ago
        Hypothetical: what good is a court order if the only copy of the key is in a HSM with tamper protection? I'm not saying that Apple does this. I simply don't know.
  • numpad0 5y ago
    You’d run the pairing process, which can only be ran by trusted Apple repairmen with special internal tools, or any of the guys in Shenzhen back alleys with the device called JC Programmer.
    • fy20 5y ago
      Right and that's the issue... why is this needed in the first place? There's no additional security, it just prevents DIY types from repairing their own phone, as they don't want to buy a $500 tool.
• zihotki 5y ago
  I wonder how does that prevent NSA and CIA level intercepting and tampering? NSA and CIA can't work with Apple to get their hardware to be signed as well? I don't believe it.