Hacker News Reader

The point is there currently is no backdoor. FBI wants Apple to create (and sign) an OS update with a backdoor and install it onto the suspect's phone. Specifically the backdoor is to remove the rate limiting and 10 attempts limitation on trying the passcode.

If you have a very strong passphrase (not a 6-digit code) then even that should be unbreakable even with brute force. Of course, most users have the 6 digit code.

If you read the actual court order a lot of your questions are answered. Here: https://www.techdirt.com/articles/20160216/17393733617/no-ju...

Also, the phone is an iPhone 5c. This doesn't have Touch ID and doesn't have the secure enclave. The same approach would not even be possible wouldn't even work on a 6 or 6s. http://blog.trailofbits.com/2016/02/17/apple-can-comply-with...

> The point is there currently is no backdoor. FBI wants Apple to create (and sign) an OS update with a backdoor and install it onto the suspect's phone.

If this is possible without the owner's permission, then the update mechanism is the existing backdoor. It just happens to also be the front door.

I think the missing information here is how the phone is encrypted. If it's done with the 4-digit numeric PIN, then the software could be built; it would take 10000 tries, but at less than .1 seconds per try, it would be able to crack the code in about 15 minutes. The current iPhone has a protection for this; after some number of tries, it will lock you out for increasing time intervals.

This is the only way that their claims might possibly be valid.

And a reminder, then: change your iPhone's password to a more complex one. If apple doesn't make this fake OS, someone will.

Edit: to expand on this, Apple's PR goal was to take advantage of the NSA mass surveillance scare. On-device encryption is not very relevant to that. iCloud security is much more important, and they've been quietly granting data from it to the Feds. Including iPhone backups which contain most of the data they're looking for.

Check out this comment where Adam Stew explains how the phones are secured: http://slashdot.org/comments.pl?sid=8756397&cid=51524693

That's really cool, thanks for the link

I mean this sincerely: has the government used one of its 10 tries on the attacker's birth year? I hope the government has burned a couple tries on low-hanging guesses before going through this legal hassle.

You don't want to burn any tries in case the Apple developers would need a few?

Is there a way to know how many attempts remain before trying a key?

Also note that new iPhones default to 6 digit pins. Still possible, but harder.

I don't understand your comment.

The iPhone in question is protected with an unknown passcode. Auto erase is enabled, so brute-forcing the passcode will erase the data.

However, a new OS version without auto erase and that accepts passcode input from USB would allow the FBI to try all combinations.

How is Apple at fault because most any passcode scheme can be cracked via brute-forcing all comginations?

> However, a new OS version without auto erase and that accepts passcode input from USB would allow the FBI to try all combinations.

It shouldn't be possible to just add a new OS onto the phone without the restrictions in place, without knowing the passcode first.

I see what you're saying but this has never been done before. BIOS passwords could be bypassed by draining the battery. Encryption is practically the only way to protect your data, because the storage can be taken out of the phone and hooked up to something else if need be.

Making a new OS is just the easiest way for Apple to do this; there are other ways.

While I agree, this is not what OP's comment was about. He makes it sound like Apple is forced to write a decryption tool that exploits existing backdoors into the encrypted content.

Highly ironically, the current "Error 53" hullabaloo is exactly about what happens once security it tightened to the extreme.

iPhone 5s and newer have a Secure Enclave, which limits brute force-ability and can not be changed via a software update (there is a belief, though undocumented, that any firmware patches would also wipe the stored keys). Apple could not help the FBI to get into these phones.

The phone in question, however, is an iPhone 5c, which does not have a Secure Enclave.

It's not possible now. The FBI is asking Apple to change iOS so it will be possible in the future.

The FBI is asking that it be built now and then loaded onto the already recovered phone.

> Specifically, the FBI wants us to make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation.

Why the downvote? That is what I said. I merely used a slew of different words.

> The FBI is asking that it be built now

Because it's not possible _now_.

> and then loaded onto the already recovered phone.

Thus it becoming possible after they have built the new version of iOS, and since they cannot go back in time and build it, it would indeed be _in_the_future_ that it became available, if Apple complied, that is.

I didn't downvote but Cook's letter suggests that the backdoor needs to apply retrospectively to existing phones (not just future phones).

Hence the parent post's suggestion that the argument is moot -- if Apple has the capability to retrospectively backdoor existing phones it would imply that Apple didn't secure it in a foolproof way in the first place.