Why the FBI's request to Apple will affect civil rights for a generation
macworld.com
macworld.com
Apple designed their devices in such way that there is way for them to circumvent their security. The fact that apple must comply is their own fault.
It is obvious that the security scheme of iOS is weak - it is security trough obscurity. They tried to make secure encryption with only 18 bits of user input. If the user provided all of the 128/256 bits the case would have been moot.
So what is the moral - when you design security solution - make sure that you can give the FEDS complete control over all of your data and company resources and they still would not be able to harm your consumer. How? Make sure the user and only the user can set the keys.
Within a week, a TSA officer took a close-up picture of all 7 key variants; from this image, 3D models of the keys were made, and now you can print all 7 keys and open anyone's TSA-approved luggage.
The FBI is slightly more competent than the TSA. Slightly. I doubt trusting them with any access to my device is a good idea.
The best security comes from open and auditable security schema and strong keys.
If I make good implementation of AES and someone encrypts a file with it but provides its own password - I can give the feds the AES spec, the source code, I can even consult them on dictionary attacks and so on - and they still won't be able to decrypt it.
Apple decided to go the other way.
The value of this letter is not that Apple may be forced to do something, but for the discussion it triggers: device security, state access and the reach of surveillance.