11 ms·

Google and Apple Won’t Unlock Your Phone, but a Court Can Make You

19 points by ademarre 12y ago

joshfraser 12y ago
Keep in mind a 4 digit passcode can by cracked in a matter of minutes by a normal powered laptop.
- r00fus 12y ago
  Apple's implementation makes this incredibly difficult given the 10-attempt failsafe (wipes device) and increasing timeouts for failed login ("try again in 1 hr" - after 7th failed attempt). Also even given a trivial passcode, if you use "complex passcode" and the same 4-character passcode, you've vastly increase the key search space with a minor change to usability (esp. if you have touchID).
  - qwerta 12y ago
    You assume that memory and flash content of phone can not be go cloned.
    - mahyarm 12y ago
      You can encrypt the flash content, which puts you down to memory, something that is pretty hard to do when it's embedded inside the CPU SoC. If the baseband & other co-processors are not trusted with full DMA access to the CPU ram, then it's practically impossible.
  - deleted 12y ago
    [deleted]
  - slinkyavenger 12y ago
    The failsafe/wipe and timeouts are all implemented in software, and are still in Apple's control. They would be able to easily remove those restrictions without you needing to give up anything.
    - r00fus 12y ago
      You're assuming Apple's complicity in assisting the police. Is this assumption reasonable? If you suspect Apple, why use an iOS device?
    - un3n 12y ago
      "The failsafe/wipe and timeouts are all implemented in software" So is unlocking your phone, changing your password, decrypting your phone, etc. How is it easy for them to disable the failsafe wipe if they can't decrypt your phone (and presumable the settings file where that option is stored)?
  - gatehouse 12y ago
    I don't like the 10-attempt-auto-wipe because it also gives someone an easy way to erase your device -- which I think is just as likely as a scenario. For example if you recorded the police and they didn't like it... Having the password (in your mind and on your fingers) and the "sensitive information" ;- having them together in the same place at the same time is just asking for it really. Look at this list of Soviet interrogation tactics and imagine how many of them could easily be used against you in your country's justice system: http://www.informationclearinghouse.info/article9236.htm http://www.informationclearinghouse.info/article9236.htm edit: link is to a low-quality site but the text is copied directly from http://en.wikipedia.org/wiki/The_Gulag_Archipelago http://en.wikipedia.org/wiki/The_Gulag_Archipelago
    - spacehome 12y ago
      Fair enough, but if the phone with the recorded video is in the police's hands anyways, your odds don't look so hot.
  - joshfraser 12y ago
    As we saw with the celebrity nude leaks, backups are often easier to acquire and trivial to crack using software like EPPB. Just take a look though Elcomsoft's product list if you're questioning whether you should upgrade to a stronger passcode.
  - alasdair_ 12y ago
    Isn't it standard to do all decryption attempts on a clone of the phone rather than the phone itself? After ten attempts, just reset the copy and try again.
    - dllthomas 12y ago
      Or after 3 attempts, or whenever the delay exceeds the time it takes to re-image the phone.
    - r00fus 12y ago
      This might have changed with iOS8 - apparently some of the vulnerabilities have been closed: http://9to5mac.com/2014/09/10/security-researcher-says-many-of-his-ios-backdoor-vulnerabilities-are-fixed-in-ios-8-gm-but-not-all/ http://9to5mac.com/2014/09/10/security-researcher-says-many-... The researcher does recommend never surrendering your phone unlocked however - that guarantees someone can just hook it up to a USB connection, and tap "trust", and then proceed to pull all your personal info and credentials out.
- wyager 12y ago
  Correct. Even with hardware-entangled key stretching, Apple can jack into your phone, disable the 10-entry erase, and then brute-force your passkey. With Android, they don't even need to use the phone. They can just dump the flash storage and attack it on arbitrarily powerful hardware. You can thankfully enable arbitrarily long numeric or alphanumeric PINs on Android and iOS.
ctdonath 12y ago
I'll offer my "rag doll testimony" IANAL axiom: re the 5th Amendment (right against compelled self-incrimination) the court can only "compel" your "testimony" insofar as they can manipulate your limp uncooperative body for fingerprints, hair samples, and other non-invasive observations. Anything inside your body, including blood & ideas, is yours to retain as you see fit. Not perfect, but seems generally sensible. Have at it.
- Terr_ 12y ago
  Caveat: The rag-doll should be considered mindless. No fair trying to project EM radiation into it in order to make it susceptible to verbal suggestion either.
  - Crito 12y ago
    I would also be wary of putting the limp rag-doll into an MRI, then talking to it and seeing how the brain lights up.
- baddox 12y ago
  Depends on your definition of "compel." If the government offers you a choice between you giving testimony or them making your life a living hell, I would consider that compulsion.
  - ctdonath 12y ago
    Hence my putting 'compel' in quotes, and proceeding to define it. The whole "testify or we'll make your life a living hell" thing should be prosecuted via "violation of rights under color of law", which can carry some pretty severe penalties.
evo_9 12y ago
Hey Apple/Google - add a new feature that allows me to set a second 'wipe phone code'.
- DannyBee 12y ago
  If you did this, a court would usually sanction you. In cases like this, the sanction is often "whatever they thought they could prove with the phone, is assumed to be proved".
  - ufmace 12y ago
    If only the same rule applied for Government agencies conveniently losing evidence. See IRS emails, dashcam videos, etc.
- mdm_ 12y ago
  Add a feature where you can select what to wipe, e.g. you could choose to have it wipe only your SMS messages, so the phone still looks lived-in and not factory-fresh and make it impossible to tell whether the normal unlock code or wipe code was used.
- wyager 12y ago
  A better alternative is to have a second decryption code that allows you to unlock the phone, but to a completely unrelated set of files. This would be along the lines of a Truecrypt hidden volume. That way, the court can't get pissed at you for deleting evidence.
  - Bud 12y ago
    Except this would be easily detected as false data, via timestamps.
    - aetherson 12y ago
      And, you know, they can tell that there remains an encrypted volume on your storage device.
grecy 12y ago
> Politely asking that you unlock it yourself, and letting you rot in a cell until you do. Does anyone know the details of the second part of that sentence? Surely you wouldn't be in jail indefinitely until you give the password...
- slinkyavenger 12y ago
  You'll continually be found in contempt of court until you comply, until they break through some other way, or until they get tired of dealing with you.
  - llamataboot 12y ago
    Interestingly and strangely enough, jail can only be used for contempt of court when they believe that keeping you there has a chance of making you comply. If you make a principled enough stand that you are never going to comply, they legally have to let you out. In practice, this usually takes a long time.
    - ChuckMcM 12y ago
      An excellent example of that was Greg Anderson [1], Barry Bonds alleged source for Steroids. [1] http://en.wikipedia.org/wiki/Greg_Anderson_%28trainer%29 http://en.wikipedia.org/wiki/Greg_Anderson_%28trainer%29
  - deleted 12y ago
    [deleted]
- DanBC 12y ago
  In England RIPA can be used to put you in prison for five years if you don't disclose the key. RIPA is a bad law.
  - melville_X 12y ago
    Same with Canada... 5 years for contempt of court if you refuse to reveal password.
a_c_s 12y ago
Drawing a legal distinction between a password to unlock and a fingerprint to unlock is absurd. Legally, the method of restricting access (physical key, combination safe, fingerprint, password) should have no bearing on whether somebody can be compelled to provide access. A smartphone filled with documents should be legally equivalent to a locked filing cabinet. Either both should be compellable or neither.
- rayiner 12y ago
  > Drawing a legal distinction between a password to unlock and a fingerprint to unlock is absurd. Yes, but the distinction is drawn because privacy advocates don't have much else to hang their hat on here. A court can compel you to open a locked filing cabinet. That's open and shut. Saying that giving up a password is testimonial leaves open an angle to distinguish cell phones from locked filing cabinets. The purpose of the 5th amendment was to keep people from having to testify as a witness against themselves, which has a very prejudicial effect on juries. It was not intended to be a blanket protection against investigation of your personal assets by court order.
  - DannyBee 12y ago
    I agree that privacy advocated don't have a lot to hang their hat on here. However, just a few notes: " Saying that giving up a password is testimonial leaves open an angle to distinguish cell phones from locked filing cabinets." Well, it is testimonial in some cases, as i'm sure you know. If the government can essentially prove that they don't need your password to prove your access/control to that device, they can often get your password. But there are cases where it is testimonial. A laptop in a shared house for example, that has encrypted child pornography. Part of their case will be proving it is your laptop. If you dispute that fact, they aren't going to be able to prove it by requesting you enter the password, even if they can prove you have the password. IE you are only generally protected from revealing it if revealing it would establish something about access/control to the device the government can't prove otherwise. With the caveat that if they offer immunity for using your production in the prosecution, they can often get access. Additionally, the government will almost never request the password itself, because that is often considered specific testimony concerning a fact. They will request you produce a document that is on the encrypted device, because they are allowed to ask for that. They will then offer immunity for the act of production. See, for example, this order: http://federalevidence.com/pdf/Comput/Fricosu.Ord.1-23-12.pdf http://federalevidence.com/pdf/Comput/Fricosu.Ord.1-23-12.pd... which says "That the government SHALL BE precluded from using Ms. Fricosu’s act of production of the unencrypted contents of the computer’s hard drive against her in any prosecution".
anthonye 12y ago
Wow, having a hard time realizing that the fifth amendment doesn't apply as much as I think it should...
snake_plissken 12y ago
Not related to smart phones, but with some something like GDBE where you can set it up so that two keys are needed (one of which is stored locally, the other provided by the user) to encrypt/decrypt, and the local key was deleted, what could the court do? The evidence isn't necessarily destroyed, it just cannot be decrypted.
- dllthomas 12y ago
  "The evidence isn't necessarily destroyed, it just cannot be decrypted." I don't think there is a meaningful distinction between "manipulated such that it cannot be recovered" and "destroyed".

19 points by ademarre 12y ago

joshfraser 12y ago

Keep in mind a 4 digit passcode can by cracked in a matter of minutes by a normal powered laptop.

r00fus 12y ago
Apple's implementation makes this incredibly difficult given the 10-attempt failsafe (wipes device) and increasing timeouts for failed login ("try again in 1 hr" - after 7th failed attempt). Also even given a trivial passcode, if you use "complex passcode" and the same 4-character passcode, you've vastly increase the key search space with a minor change to usability (esp. if you have touchID).
- qwerta 12y ago
  You assume that memory and flash content of phone can not be go cloned.
  - mahyarm 12y ago
    You can encrypt the flash content, which puts you down to memory, something that is pretty hard to do when it's embedded inside the CPU SoC. If the baseband & other co-processors are not trusted with full DMA access to the CPU ram, then it's practically impossible.
- deleted 12y ago
  [deleted]
- slinkyavenger 12y ago
  The failsafe/wipe and timeouts are all implemented in software, and are still in Apple's control. They would be able to easily remove those restrictions without you needing to give up anything.
  - r00fus 12y ago
    You're assuming Apple's complicity in assisting the police. Is this assumption reasonable? If you suspect Apple, why use an iOS device?
  - un3n 12y ago
    "The failsafe/wipe and timeouts are all implemented in software" So is unlocking your phone, changing your password, decrypting your phone, etc. How is it easy for them to disable the failsafe wipe if they can't decrypt your phone (and presumable the settings file where that option is stored)?
- gatehouse 12y ago
  I don't like the 10-attempt-auto-wipe because it also gives someone an easy way to erase your device -- which I think is just as likely as a scenario. For example if you recorded the police and they didn't like it... Having the password (in your mind and on your fingers) and the "sensitive information" ;- having them together in the same place at the same time is just asking for it really. Look at this list of Soviet interrogation tactics and imagine how many of them could easily be used against you in your country's justice system: http://www.informationclearinghouse.info/article9236.htm http://www.informationclearinghouse.info/article9236.htm edit: link is to a low-quality site but the text is copied directly from http://en.wikipedia.org/wiki/The_Gulag_Archipelago http://en.wikipedia.org/wiki/The_Gulag_Archipelago
  - spacehome 12y ago
    Fair enough, but if the phone with the recorded video is in the police's hands anyways, your odds don't look so hot.
- joshfraser 12y ago
  As we saw with the celebrity nude leaks, backups are often easier to acquire and trivial to crack using software like EPPB. Just take a look though Elcomsoft's product list if you're questioning whether you should upgrade to a stronger passcode.
- alasdair_ 12y ago
  Isn't it standard to do all decryption attempts on a clone of the phone rather than the phone itself? After ten attempts, just reset the copy and try again.
  - dllthomas 12y ago
    Or after 3 attempts, or whenever the delay exceeds the time it takes to re-image the phone.
  - r00fus 12y ago
    This might have changed with iOS8 - apparently some of the vulnerabilities have been closed: http://9to5mac.com/2014/09/10/security-researcher-says-many-of-his-ios-backdoor-vulnerabilities-are-fixed-in-ios-8-gm-but-not-all/ http://9to5mac.com/2014/09/10/security-researcher-says-many-... The researcher does recommend never surrendering your phone unlocked however - that guarantees someone can just hook it up to a USB connection, and tap "trust", and then proceed to pull all your personal info and credentials out.
wyager 12y ago
Correct. Even with hardware-entangled key stretching, Apple can jack into your phone, disable the 10-entry erase, and then brute-force your passkey. With Android, they don't even need to use the phone. They can just dump the flash storage and attack it on arbitrarily powerful hardware. You can thankfully enable arbitrarily long numeric or alphanumeric PINs on Android and iOS.

ctdonath 12y ago

I'll offer my "rag doll testimony" IANAL axiom: re the 5th Amendment (right against compelled self-incrimination) the court can only "compel" your "testimony" insofar as they can manipulate your limp uncooperative body for fingerprints, hair samples, and other non-invasive observations. Anything inside your body, including blood & ideas, is yours to retain as you see fit. Not perfect, but seems generally sensible. Have at it.

Terr_ 12y ago
Caveat: The rag-doll should be considered mindless. No fair trying to project EM radiation into it in order to make it susceptible to verbal suggestion either.
- Crito 12y ago
  I would also be wary of putting the limp rag-doll into an MRI, then talking to it and seeing how the brain lights up.
baddox 12y ago
Depends on your definition of "compel." If the government offers you a choice between you giving testimony or them making your life a living hell, I would consider that compulsion.
- ctdonath 12y ago
  Hence my putting 'compel' in quotes, and proceeding to define it. The whole "testify or we'll make your life a living hell" thing should be prosecuted via "violation of rights under color of law", which can carry some pretty severe penalties.

evo_9 12y ago

Hey Apple/Google - add a new feature that allows me to set a second 'wipe phone code'.

DannyBee 12y ago
If you did this, a court would usually sanction you. In cases like this, the sanction is often "whatever they thought they could prove with the phone, is assumed to be proved".
- ufmace 12y ago
  If only the same rule applied for Government agencies conveniently losing evidence. See IRS emails, dashcam videos, etc.
mdm_ 12y ago
Add a feature where you can select what to wipe, e.g. you could choose to have it wipe only your SMS messages, so the phone still looks lived-in and not factory-fresh and make it impossible to tell whether the normal unlock code or wipe code was used.
wyager 12y ago
A better alternative is to have a second decryption code that allows you to unlock the phone, but to a completely unrelated set of files. This would be along the lines of a Truecrypt hidden volume. That way, the court can't get pissed at you for deleting evidence.
- Bud 12y ago
  Except this would be easily detected as false data, via timestamps.
  - aetherson 12y ago
    And, you know, they can tell that there remains an encrypted volume on your storage device.

grecy 12y ago

> Politely asking that you unlock it yourself, and letting you rot in a cell until you do. Does anyone know the details of the second part of that sentence? Surely you wouldn't be in jail indefinitely until you give the password...

slinkyavenger 12y ago
You'll continually be found in contempt of court until you comply, until they break through some other way, or until they get tired of dealing with you.
- llamataboot 12y ago
  Interestingly and strangely enough, jail can only be used for contempt of court when they believe that keeping you there has a chance of making you comply. If you make a principled enough stand that you are never going to comply, they legally have to let you out. In practice, this usually takes a long time.
  - ChuckMcM 12y ago
    An excellent example of that was Greg Anderson [1], Barry Bonds alleged source for Steroids. [1] http://en.wikipedia.org/wiki/Greg_Anderson_%28trainer%29 http://en.wikipedia.org/wiki/Greg_Anderson_%28trainer%29
- deleted 12y ago
  [deleted]
DanBC 12y ago
In England RIPA can be used to put you in prison for five years if you don't disclose the key. RIPA is a bad law.
- melville_X 12y ago
  Same with Canada... 5 years for contempt of court if you refuse to reveal password.

a_c_s 12y ago

Drawing a legal distinction between a password to unlock and a fingerprint to unlock is absurd. Legally, the method of restricting access (physical key, combination safe, fingerprint, password) should have no bearing on whether somebody can be compelled to provide access. A smartphone filled with documents should be legally equivalent to a locked filing cabinet. Either both should be compellable or neither.

rayiner 12y ago
> Drawing a legal distinction between a password to unlock and a fingerprint to unlock is absurd. Yes, but the distinction is drawn because privacy advocates don't have much else to hang their hat on here. A court can compel you to open a locked filing cabinet. That's open and shut. Saying that giving up a password is testimonial leaves open an angle to distinguish cell phones from locked filing cabinets. The purpose of the 5th amendment was to keep people from having to testify as a witness against themselves, which has a very prejudicial effect on juries. It was not intended to be a blanket protection against investigation of your personal assets by court order.
- DannyBee 12y ago
  I agree that privacy advocated don't have a lot to hang their hat on here. However, just a few notes: " Saying that giving up a password is testimonial leaves open an angle to distinguish cell phones from locked filing cabinets." Well, it is testimonial in some cases, as i'm sure you know. If the government can essentially prove that they don't need your password to prove your access/control to that device, they can often get your password. But there are cases where it is testimonial. A laptop in a shared house for example, that has encrypted child pornography. Part of their case will be proving it is your laptop. If you dispute that fact, they aren't going to be able to prove it by requesting you enter the password, even if they can prove you have the password. IE you are only generally protected from revealing it if revealing it would establish something about access/control to the device the government can't prove otherwise. With the caveat that if they offer immunity for using your production in the prosecution, they can often get access. Additionally, the government will almost never request the password itself, because that is often considered specific testimony concerning a fact. They will request you produce a document that is on the encrypted device, because they are allowed to ask for that. They will then offer immunity for the act of production. See, for example, this order: http://federalevidence.com/pdf/Comput/Fricosu.Ord.1-23-12.pdf http://federalevidence.com/pdf/Comput/Fricosu.Ord.1-23-12.pd... which says "That the government SHALL BE precluded from using Ms. Fricosu’s act of production of the unencrypted contents of the computer’s hard drive against her in any prosecution".

anthonye 12y ago

Wow, having a hard time realizing that the fifth amendment doesn't apply as much as I think it should...

snake_plissken 12y ago

Not related to smart phones, but with some something like GDBE where you can set it up so that two keys are needed (one of which is stored locally, the other provided by the user) to encrypt/decrypt, and the local key was deleted, what could the court do? The evidence isn't necessarily destroyed, it just cannot be decrypted.

dllthomas 12y ago
"The evidence isn't necessarily destroyed, it just cannot be decrypted." I don't think there is a meaningful distinction between "manipulated such that it cannot be recovered" and "destroyed".