teacup50

25 ms·

211.
by teacup50 11y ago
There's a much bigger elephant in the room, though: Updates to the OS and applications are encrypted, completely opaque, signed by Apple instead of the original developer, can be granted additional entitlements for arbitrary permission
212.
by teacup50 11y ago
That's not an argument against legal search and seizure. If Apple doesn't want to be in that position, they shouldn't have put themselves in that position by retaining and requiring full control over devices via platform-le
213.
by teacup50 11y ago
The dangerous narrative is Apple's reframing of this debate to shift attention away from the simple truth: Apple already has a backdoor. This is DRM, not crypto. They control these devices, top-to-bottom, regardless of the owner&#x27
214.
by teacup50 11y ago
Apple can push software updates to a locked phone without the owner's permission. Nobody else can. That's a big difference.
215.
by teacup50 11y ago
You're conflating very different scopes of "capability" and responsibility. I'll quote the DoJ's legal brief on how Apple is not "far removed" from this phone owned by a 3rd party: "... the government
216.
by teacup50 11y ago
> If the manufacturer's ability to sign code is a backdoor, then so is absence of code signing. In that universe, you can run any encryption software of you're choosing, and verify the software written by others. Nobody has
217.
by teacup50 11y ago
This is straightforward: Apple already has a backdoor into the key derivation firmware (technically, the OS). If they didn't have it, they couldn't be required to use it.
218.
by teacup50 11y ago
Apple intentionally created a platform where they hold almost absolute control over devices. They can install new software, inject code into auto-updated applications, MITM SSL by hooking local device APIs, MITM iMessage by using their CA t
219.
by teacup50 11y ago
A vulnerability is a backdoor if it's placed there intentionally. That's what Apple has done.
220.
by teacup50 11y ago
Yes, if you use that private key to serve as an unauditable 3rd-party trust authority in what should be a single-party or two-party transaction.
221.
by teacup50 11y ago
Edited accordingly, thanks!
222.
by teacup50 11y ago
There are very few limits to the power of the All Writs Act -- the act, passed the same week as the fourth amendment, grants the courts (not the FBI) the authority to "issue all writs necessary or appropriate in aid of their respect
223.
by teacup50 11y ago
In cryptography and computer security, a vulnerability (a backdoor) exists whether or not an exploit exists.
224.
by teacup50 11y ago
> How would relaxing the tamper-resistent key protection help here? One needs the PIN to reimage the device. Chicken & egg. Creating a one-off OS image can't help without first having the PIN. The weak link is that a PIN can b
225.
by teacup50 11y ago
In this case, the corporation is the threat, and corporate statism is probably the worst possible end game. The state isn't really the problem, though -- centralization of authority is. The DoJ issue is basically moot; this is a la
226.
by teacup50 11y ago
If you want to talk about "enablers of authoritarians", consider that Apple has built a system in which they are the sole authority, that is opaque to all introspection by third parties, and against which Apple -- and only Apple -
227.
by teacup50 11y ago
That's a blanket, incorrect generalization. I'm strongly opposed to government crypto backdoors. Cryptography is protected expression under the first amendment. However, there's no participation award for weak crypto syst
228.
by teacup50 11y ago
Proven feasible? We already know it's feasible. It's dead simple to binary patch the code -- but you need Apple's signing key to make it work. If you're worried about Apple's signing key being released into the wild
229.
by teacup50 11y ago
This is not a dramatic expansion of the AWA's power. This is exactly what the AWA is meant to do. The few carve-outs of the authority of the AWA go much farther -- that's exactly what CALEA is, for example, and it has been held up
230.
by teacup50 11y ago
Your argument is no different than the arguments that claim crypto backdoors can be kept secure. The problem is the existence of the backdoor, not the processes or politics that ostensibly will prevent its abuse. Apple could ship encrypted
231.
by teacup50 11y ago
The FBI or any other government agency has always been able to demand companies do exactly this. It was the height of naivety to think otherwise; it's not like we lack historical examples of what happens when a small number of companie
232.
by teacup50 11y ago
It's shocking to me that people who ostensibly know something about software development take Apple at their word in this case. Apple already has the backdoor. Are you willing to guarantee that Apple will never lose control over thei
233.
by teacup50 11y ago
Correct; more specifically, leaving the KDF retry enforcement behavior writable on locked devices, and in the case of secure enclave, possibly exposing fingerprint-protected keys themselves to Apple-signed updated firmware.
234.
by teacup50 11y ago
The backdoor already exists, in cryptographic terms. All they're being asked to do is to use it, entirely under their own control, for this one phone. Tim Cook is trying to pretend that commenting out a few if statements in the key der
235.
by teacup50 11y ago
Or, China could acquire Apple's signing keys and/or source code through espionage, and then unlock any device -- now, or at any point in the future. We already know this occurs: http://www.nytimes.com/2010/04&
236.
by teacup50 11y ago
It's not as hard as you're implying; A locked device could support re-imaging by expunging all existing key material. In general, Apple's guarantees about anonymity and security all assume that there is no risk to Apple sit
237.
by teacup50 11y ago
Not when it comes to transparent, limited scope, reasonable writs. This isn't some NSA mass surveillance program, or clipper chip reloaded(TM). This is an active murder (and terrorism) investigation in which Apple's privileged pos
238.
by teacup50 11y ago
The weight of evidence is that they can update the secure enclave firmware in place, too, without losing keying material.
239.
by teacup50 11y ago
If the contents are none of Apple's business, why did Apple give themselves (via their signing keys) a backdoor that allows them to replace the firmware out from under the owner of an ostensibly locked device? If Apple couldn't do
240.
by teacup50 11y ago
There's nothing stopping you from attaching a debugger to a VM -- this is mighty handy for debugging boot loaders. There's also nothing stopping you from including a runtime debugger interface in your unikernel, just like any othe

More ›