2 ms·

> What makes you think that internal access control at Apple is any better There are multiple verified stories on the lengths Apple goes internally to keep thi

> What makes you think that internal access control at Apple is any better There are multiple verified stories on the lengths Apple goes internally to keep things secret. I saw a talk years ago about (I think) booting up some bits of the iCloud infrastructure, which needed two different USB keys with different keys to boot up. Then both keys were destroyed so that nobody knows the encryption keys and can't decrypt the contents.

padolsey 2y ago
What's funny is that, in all these orgs, it ends up being the low-tech vulns that compromise you in the end. Physical access, social engineering, etc. However, I'm really impressed by the technical lengths Apples goes to though. The key-burning thing reminds me of ICANN' Root KSK Ceremonies.
p_l 2y ago
The stories about Apple keeping things secret usually go about protecting their business secrets from normal people, up to doing probably illegal actions. Using deniable, one-time keys etc. are... not that unusual. In fact I'd say I'm more worried about the use of random USB keys there instead of proper KMS system. (There are similar stories with how doing a cold start can be difficult when you end up with a loop in your access controls, from Google, where a fortunately simulated cold-start showed that they couldn't access necessary KMS physically to bootstrap the system... because access controls depended, after many layers, on the system to be cold-started).
- milkshakes 2y ago
  they used smartcards, not usb keys
  - p_l 2y ago
    Which probably were just key transport devices from offline secured KMSes
treprinum 2y ago
Destroyed? Where? In all places where they were stored? Or just in some of them? How can you tell? You still need to trust them they didn't copy them somewhere.
- theshrike79 2y ago
  It's impossible to use any technology if you don't trust anyone. Any piece of technology MAY have a backdoor or secondary function you don't know of and can't find out without breaking said device.
  - treprinum 2y ago
    That was the point of my response. Somewhere in the chain one must trust something without any proof.

padolsey 2y ago

What's funny is that, in all these orgs, it ends up being the low-tech vulns that compromise you in the end. Physical access, social engineering, etc. However, I'm really impressed by the technical lengths Apples goes to though. The key-burning thing reminds me of ICANN' Root KSK Ceremonies.

p_l 2y ago

The stories about Apple keeping things secret usually go about protecting their business secrets from normal people, up to doing probably illegal actions. Using deniable, one-time keys etc. are... not that unusual. In fact I'd say I'm more worried about the use of random USB keys there instead of proper KMS system. (There are similar stories with how doing a cold start can be difficult when you end up with a loop in your access controls, from Google, where a fortunately simulated cold-start showed that they couldn't access necessary KMS physically to bootstrap the system... because access controls depended, after many layers, on the system to be cold-started).

milkshakes 2y ago
they used smartcards, not usb keys
- p_l 2y ago
  Which probably were just key transport devices from offline secured KMSes

treprinum 2y ago

Destroyed? Where? In all places where they were stored? Or just in some of them? How can you tell? You still need to trust them they didn't copy them somewhere.

theshrike79 2y ago
It's impossible to use any technology if you don't trust anyone. Any piece of technology MAY have a backdoor or secondary function you don't know of and can't find out without breaking said device.
- treprinum 2y ago
  That was the point of my response. Somewhere in the chain one must trust something without any proof.