4 ms·

"back doors" that require approval from the user on the phone..??

criley2 12y ago
Backdoors that require the user to unlock their device and have paired with a PC in the past. If a paired PC is compromised (a trivial task for a sophisticated hacker or the NSA, if the millions of windows pc bot nets are evidence), and wifi sync is enabled, and the device is unlocked and in use, then the compromised PC could theoretically harvest personal information from the device without any warning or notification to the user. IMO it seems like the only requirements to compromise someone's iDevice is A) they use their iDevice with a compromised PC, and wifi sync seems to make it all much easier.
- comex 12y ago
  Well, true, but copying personal data to the PC is exactly what sync is supposed to do - a good chunk of that data is actually synced with the computer, and the rest needs to be included in backups (which need to be able to be restored on other devices, so they can't be encrypted with a device-specific key). If Wi-Fi sync is enabled, all that needs to happen over Wi-Fi. So I'm not sure what Apple could do about it, other than make it harder to compromise Macs. The part of this story I think deserves more attention is security against a sophisticated adversary who does not have the passcode or access to a paired computer. In this case, data protection should be effective (the data is encrypted with a key that requires going through the hardware AES engine to derive from the passcode, i.e. slow), but for some reason most data is apparently not protected. This doesn't seem hard to improve to me, and I'd like Apple to do so.
- Spooky23 12y ago
  In other words, News flash: physical access allows an attacker in the know to compromise computer security. You laid it out, a minimum of 4 circumstances need to happen to allow these exploits to work. If we're going to have "lawful intercept" legal requirement, I'd rather have the mechanisms require this type of intrusive action that require a warrant in most cases. I was really hooked by this talk until he characterized supervision/enterprise enrollment as a "backdoor", and the more I read about it, the more bullshitty it really is.
- mynameisvlad 12y ago
  I get a notification asking if I want to trust the computer I've just connected to every time I connect, regardless if I've trusted it in the past or not.
- alain94040 12y ago
  If a paired PC is compromised Guess what. If you hacked into my Mac, then yes, you can see my pictures in iPhoto. As my iPhone keeps syncing to the Mac, yes, you'll be able to see the pictures from my phone. But you'll also be able to view my emails (from Mail on the Mac), all my documents, and install a key logger on my Mac and steal my bank credentials.

Backdoors that require the user to unlock their device and have paired with a PC in the past. If a paired PC is compromised (a trivial task for a sophisticated hacker or the NSA, if the millions of windows pc bot nets are evidence), and wifi sync is enabled, and the device is unlocked and in use, then the compromised PC could theoretically harvest personal information from the device without any warning or notification to the user. IMO it seems like the only requirements to compromise someone's iDevice is A) they use their iDevice with a compromised PC, and wifi sync seems to make it all much easier.

comex 12y ago
Well, true, but copying personal data to the PC is exactly what sync is supposed to do - a good chunk of that data is actually synced with the computer, and the rest needs to be included in backups (which need to be able to be restored on other devices, so they can't be encrypted with a device-specific key). If Wi-Fi sync is enabled, all that needs to happen over Wi-Fi. So I'm not sure what Apple could do about it, other than make it harder to compromise Macs. The part of this story I think deserves more attention is security against a sophisticated adversary who does not have the passcode or access to a paired computer. In this case, data protection should be effective (the data is encrypted with a key that requires going through the hardware AES engine to derive from the passcode, i.e. slow), but for some reason most data is apparently not protected. This doesn't seem hard to improve to me, and I'd like Apple to do so.
Spooky23 12y ago
In other words, News flash: physical access allows an attacker in the know to compromise computer security. You laid it out, a minimum of 4 circumstances need to happen to allow these exploits to work. If we're going to have "lawful intercept" legal requirement, I'd rather have the mechanisms require this type of intrusive action that require a warrant in most cases. I was really hooked by this talk until he characterized supervision/enterprise enrollment as a "backdoor", and the more I read about it, the more bullshitty it really is.
mynameisvlad 12y ago
I get a notification asking if I want to trust the computer I've just connected to every time I connect, regardless if I've trusted it in the past or not.
alain94040 12y ago
If a paired PC is compromised Guess what. If you hacked into my Mac, then yes, you can see my pictures in iPhoto. As my iPhone keeps syncing to the Mac, yes, you'll be able to see the pictures from my phone. But you'll also be able to view my emails (from Mail on the Mac), all my documents, and install a key logger on my Mac and steal my bank credentials.