Hacker News Reader

Comment by shalmanese | Hacker News Reader

For those who have questions about "Couldn't Apple just do X or Y?", Apple has published an eminently readable whitepaper on the software and hardware components of their security: https://www.apple.com/business/docs/iOS_Security_Guide.pdf

Of course, Apple could be implementing things differently from as described but the whitepaper lays out what is and is not possible in the described system.

View on HN

The iOS Security Guide is 60 pages of technical goodness, but when dealing with encryption, it's really not enough to fully understand the system, even putting aside concerns about it being closed-source. There is such an incredible level of detail in the document, it would take a really long time to peel that onion back to be able to claim to really understand the trust model. It's some of the best technical documentation on encryption methods I've read, but even still there is plenty of room for ambiguity.

The key section I think most people really should take a look at is "iCloud Backup" starting on page 42. Almost everything you do with your device will end up in an iCloud Backup if you have enabled that, and while the data is encrypted for transport, note well the following;

  The backup set is stored in the user’s iCloud account and consists of a copy of the
  user’s files, and the iCloud Backup keybag. The iCloud Backup keybag is protected by
  a random key, which is also stored with the backup set. (The user’s iCloud password
  is not utilized for encryption so that changing the iCloud password won’t invalidate
  existing backups.)

In plain English, if you have enabled iCloud Backup, everything but your keychain itself is accessible in plaintext to Apple, and can be restored, without your password, to any new device that [you / the Feds] may provide.

I would very much love for Apple to provide an opt-in where the iCloud backup key is tied to the account password with extremely aggressive key-stretching. I would take the risk of losing my iCloud Backup over the trade-off of having my backups accessible to Apple and anyone they can be compelled to share them with. But I do appreciate for the average user, it's not uncommon for iCloud Backup to be immediately preceded by a password reset (just look down-thread for an example).

Note, Apple says that they use a combination of S3 and Azure to actually store the iCloud data, but that they have an additional layer of encryption over the data before sending it out. So while backups technically reside on Amazon/Microsoft servers, it's a black box to them.

Yup. As the celebrity photo hacking should have made clear, Apple can only offer far weaker security guarantees on the web because they control less of the ecosystem.

At a minimum, if the police get access to your email account, they can force a Apple ID password reset and then restore your data onto a new device without needing permission from you or Apple.

Note however it is still possible to backup your iphone locally using iTunes and Apple now supports encrypted local backups. If you are worried about this threat vector, encrypted local backups provides a large degree of the same usability with significantly stronger security guarantees.

"if the police get access to your email account, they can force a Apple ID password reset"

That's an interesting assertion. I mean, yes, sure, they could do that, but it's an interesting question of whether they are legally allowed to do that. Effectively they'd be misrepresenting themselves to your email provider and to Apple as if they were you. Is that acceptable 'undercover policing'? Can they reset your banking password too? Can they do this only while they have you under arrest?

They don't need to admit they did it. Parallel construction works more effectively.

If they have information that was only present on your device or your iCloud backup, and they already can't get at your device, how exactly does parallel construction help them explain the fact that their evidence includes information that could have only been obtained one way?

Because that's not the evidence they present, they use that to figure out where else to look for evidence, pretending they found that randomly or by guesswork or suspicion or following an anonymous call.

Right. "By virtue of my training and experience, I had reason to believe" is a stock statement re anything, in trying to establish probable cause for searches, stops and the like.

It's a broad, overarching, and highly vague statement that amounts to, in many cases, "I decided you do, so therefore I have the right to act as if you do".

now supports encrypted local backups.

iTunes has supported encrypted local backups since the beginning of iOS.

restore your data onto a new device without needing permission from you or Apple.

and that's a great reason to verify your iCloud backup is always disabled on all devices (if you care about privacy). You just have to be vigilant about not accidentally enabling it during any setup process since iOS wants you to enable the feature, but it's easy to disable everywhere.

You make it sound like Apple is trying to trick you into enabling it, like they have default-on checkboxes everywhere to turn it on. IIRC they only ask once, during the setup wizard, and you're forced to make a choice (no default behavior). So just don't turn it on and you're good.

Apple has supported encrypted iTunes backups for years. I remember having it enabled when I upgraded to the iPhone 4. A quick Google search finds articles talking about it from 2011.

If they are doing things substantially differently than outlined in that whitepaper, and so actually do have access to locked devices, then they would have just perjured themselves and exposed themselves to extraordinary liability. Which makes me think they are probably telling the truth - short of 0-days, no one has access to locked iOS devices.

Reply on news.ycombinator.com