5 ms·

It's fud until you or someone else posts evidence that the fingerprint is sent over the wire, or that Apple intends to do the same (for example, code that sends

It's fud until you or someone else posts evidence that the fingerprint is sent over the wire, or that Apple intends to do the same (for example, code that sends the fingerprint that awaits activation by a third party). You're not going to be able to do that. It's shameful that you can't even recognize the fudishness of what you posted, especially if Linux actually is your operating system of choice and you have been through the fud wars of the late nineties and early two thousands (that was only a guess on my part).

ris 13y ago
"It's fud until you or someone else posts evidence that the fingerprint is sent over the wire" It absolutely isn't. Even if just the hash were sent over the wire (or if it were possible for the authorities to extract it over the wire), it would be perfectly possible for the authorities to run the same hash algorithm on their candidate print and see if the hashes match. Such evidence would likely not be admissible in court but 1) it would be enough to give the authorities a tipoff, 2) for matters deemed important enough, secret trials seem to be all the rage these days. I would be _very_ surprised if there were no backdoor in iPhones for the authorities. Even their "secure" area. The U.S. authorities simply do not take no for an answer when having a "talk" with a vendor producing a widespread "security" related product.
- jamesaguilar 13y ago
  > I would be _very_ surprised if there were no backdoor I'm not sure if you understand what FUD means. Your surprise or lack thereof does not count as evidence, and is irrelevant to whether something is FUD or not. > MS Exec: "I'd be very surprised if Linux had a lower TCO than Windows Server." Canonical example of FUD. EXACT same thing as you're saying, just in a different context.
  - ris 13y ago
    "EXACT same thing as you're saying" You've got to be careful when you say things like that, because they're trivial to refute. The whole point of a backdoor is to be obfuscated and hard to find. So it would be very likely that you would not find one even if one were present. Your example is simply a Microsoft not bothering to do something that's perfectly researchable. We don't have any _proof_ that Dual EC DRBG is defeatable to the NSA. By your logic we should still be using it happily until we have that proof and until then any caution is simply "FUD". So if that's "FUD", then I've got news for you: the security world is very sensibly built upon FUD.

ris 13y ago

"It's fud until you or someone else posts evidence that the fingerprint is sent over the wire" It absolutely isn't. Even if just the hash were sent over the wire (or if it were possible for the authorities to extract it over the wire), it would be perfectly possible for the authorities to run the same hash algorithm on their candidate print and see if the hashes match. Such evidence would likely not be admissible in court but 1) it would be enough to give the authorities a tipoff, 2) for matters deemed important enough, secret trials seem to be all the rage these days. I would be _very_ surprised if there were no backdoor in iPhones for the authorities. Even their "secure" area. The U.S. authorities simply do not take no for an answer when having a "talk" with a vendor producing a widespread "security" related product.

jamesaguilar 13y ago
> I would be _very_ surprised if there were no backdoor I'm not sure if you understand what FUD means. Your surprise or lack thereof does not count as evidence, and is irrelevant to whether something is FUD or not. > MS Exec: "I'd be very surprised if Linux had a lower TCO than Windows Server." Canonical example of FUD. EXACT same thing as you're saying, just in a different context.
- ris 13y ago
  "EXACT same thing as you're saying" You've got to be careful when you say things like that, because they're trivial to refute. The whole point of a backdoor is to be obfuscated and hard to find. So it would be very likely that you would not find one even if one were present. Your example is simply a Microsoft not bothering to do something that's perfectly researchable. We don't have any _proof_ that Dual EC DRBG is defeatable to the NSA. By your logic we should still be using it happily until we have that proof and until then any caution is simply "FUD". So if that's "FUD", then I've got news for you: the security world is very sensibly built upon FUD.