5 ms·

I'm a little conflicted about this. On one hand it's good to learn about the security of your device, on the other hand he's far too partial and sensationalist

I'm a little conflicted about this. On one hand it's good to learn about the security of your device, on the other hand he's far too partial and sensationalist about these iOS features. Yes, features. • It's good to know packet capture can be remotely enabled on your device from data collected on a computer the device has trusted. • It's good to know Apple has the power to look through your encrypted files given physical access (file relay). • It's good to know one can extract files from his phone using a trusted computer (house arrest). However, that's it. There's no "back door". There's no (implied or otherwise) NSA conspiracy. There's a reason why the media "misunderstood" his talk: it was full of hyperbole.

ihsw 12y ago
Can these "features" be turned off by the user, and not enabled remotely? Are these "features" off by default? No? It's maliciously removing control from the user.
- gr3yh47 12y ago
  welcome to the apple experience?
aktau 12y ago
> It's good to know Apple has the power to look through your encrypted files given physical access (file relay). So the requisites are: "be Apple" and "have physical access"? That's awfully little for what's supposed to be encrypted files. It (seems to be) no secret that law enforcement sends devices to Apple when they can't handle them themselves. So if I'm understanding it right: you can't protect yourself with an iDevice, consider all your data compromised? Sensationalist or not, it bothers me a little.
- jglidden 12y ago
  Are we concerned about Apple here or just commercial phones in general? To me that's a pretty good security model, if true. I can choose not to give Apple my phone and I can supervise them. I don't know of another commercial phone that protects us better at the moment.
- fredsted 12y ago
  I think this is relevant; Apple says "diagnostic info" while others say that it's the users' personal encrypted files. I haven't found confirmation on whether the list Zdziarsky has in his presentation is exaggerated, completely true, or false.
  - thetinguy 12y ago
    What's the difference? Are personal files never ever diagnostically relevant?
- josho 12y ago
  What is the threat model that concerns you? If you don't trust Apple then don't use iOS full stop. I trust Apple engineers, but not Apple Store employees. So, for me the question to ask is what effort is required to circumvent the system. If any employee at an Apple Store can circumvent your encryption then that is an issue. If circumventing requires your passcode, then that's far less concerning.
  - Karunamon 12y ago
    Use your imagination. Apple could be compelled to dump a device you're sending in for repairs, for example. A great deal of these (backdoors/vulnerabilities/developer tools) have no reason to exist in a non-developer-mode consumer device.
Istof 12y ago
They don't need a backdoor when they have admin rights on your (their) device...
nitrogen 12y ago
No conspiracy is required for an intelligence agency to turn features into "features".
ForHackernews 12y ago
> Apple has the power to look through your encrypted files given physical access > However, that's it. There's no "back door". What? How is that not a backdoor? Edit: Also, from the article, "Apple apparently has admitted to the mechanics behind file relay, which skip around backup encryption, to get to much the same data. In addition to this, it can be dumped wirelessly, without the user’s knowledge." So not even physical access, just proximity/same wireless network?
- milkshakes 12y ago
  you need access to a computer that your target device has paired with in order to recover the pairing keys in order to pull this off.
scott_karana 12y ago
Are you joking? Remote access for a specific party will virtually always become remote access for malicious actors, whether that was the original intent or not. > It's good to know packet capture can be remotely enabled on your device from data collected on a computer the device has trusted or been tricked into trusting > It's good to know Apple or anyone who can spoof Apple has the power to look through your encrypted files given physical access (file relay). > It's good to know one can extract files from his phone using a trusted or seemingly trusted computer (house arrest).

ihsw 12y ago

Can these "features" be turned off by the user, and not enabled remotely? Are these "features" off by default? No? It's maliciously removing control from the user.

gr3yh47 12y ago
welcome to the apple experience?

aktau 12y ago

> It's good to know Apple has the power to look through your encrypted files given physical access (file relay). So the requisites are: "be Apple" and "have physical access"? That's awfully little for what's supposed to be encrypted files. It (seems to be) no secret that law enforcement sends devices to Apple when they can't handle them themselves. So if I'm understanding it right: you can't protect yourself with an iDevice, consider all your data compromised? Sensationalist or not, it bothers me a little.

jglidden 12y ago
Are we concerned about Apple here or just commercial phones in general? To me that's a pretty good security model, if true. I can choose not to give Apple my phone and I can supervise them. I don't know of another commercial phone that protects us better at the moment.
fredsted 12y ago
I think this is relevant; Apple says "diagnostic info" while others say that it's the users' personal encrypted files. I haven't found confirmation on whether the list Zdziarsky has in his presentation is exaggerated, completely true, or false.
- thetinguy 12y ago
  What's the difference? Are personal files never ever diagnostically relevant?
josho 12y ago
What is the threat model that concerns you? If you don't trust Apple then don't use iOS full stop. I trust Apple engineers, but not Apple Store employees. So, for me the question to ask is what effort is required to circumvent the system. If any employee at an Apple Store can circumvent your encryption then that is an issue. If circumventing requires your passcode, then that's far less concerning.
- Karunamon 12y ago
  Use your imagination. Apple could be compelled to dump a device you're sending in for repairs, for example. A great deal of these (backdoors/vulnerabilities/developer tools) have no reason to exist in a non-developer-mode consumer device.

Istof 12y ago

They don't need a backdoor when they have admin rights on your (their) device...

nitrogen 12y ago

No conspiracy is required for an intelligence agency to turn features into "features".

ForHackernews 12y ago

> Apple has the power to look through your encrypted files given physical access > However, that's it. There's no "back door". What? How is that not a backdoor? Edit: Also, from the article, "Apple apparently has admitted to the mechanics behind file relay, which skip around backup encryption, to get to much the same data. In addition to this, it can be dumped wirelessly, without the user’s knowledge." So not even physical access, just proximity/same wireless network?

milkshakes 12y ago
you need access to a computer that your target device has paired with in order to recover the pairing keys in order to pull this off.

scott_karana 12y ago

Are you joking? Remote access for a specific party will virtually always become remote access for malicious actors, whether that was the original intent or not. > It's good to know packet capture can be remotely enabled on your device from data collected on a computer the device has trusted or been tricked into trusting > It's good to know Apple or anyone who can spoof Apple has the power to look through your encrypted files given physical access (file relay). > It's good to know one can extract files from his phone using a trusted or seemingly trusted computer (house arrest).