Hacker News Reader

Comment by vinceguidry | Hacker News Reader

Hah, that's a laugh. If it were an Android phone, the feds wouldn't have had to call anyone. They'd have just broken the device's security and gotten what they wanted.

Only Apple takes security seriously.

View on HN

I would wager that the FBI and CIA are technically capable of breaking the security on this phone. This is likely more about setting legal precedent via a case that is very much in the public eye.

I very much doubt that. These agencies are very capable of operating outside of the law if it will get the job done. All a stunt like this does is raise public awareness, limiting their options. They wouldn't do that unless they couldn't get it done via other means.

Only the fact that this is a terror case makes them willing to roll the dice at all on the craps table of public opinion. It gives them an advantage, but not an overwhelming one.

Well for a million + they could delaminate the chips and read the private keys off them in a painstaking way.

But that is incredibly risky; it would be easy to make a mistake, and if they do, the information is gone forever, which is the worst case scenario for them.

I absolutely believe that the FBI thinks this is the only way to get this data.

Yes, they might like to get a strong precedent in favor of this, but what if the precedent goes against them? You never know what you're going to get in court. This would be appealed to the 9th Circuit, which has a history of being skeptical of government arguments in favor of collecting digital data. And if the Supreme Court deadlocks 4-4 (as it could now), the appellate ruling would stand.

It seems like many people don't get the concept of evidence preservation.

Apple put in a feature, which they may circumvent, that will effectively brick the device if it is tampered in certain ways. The lowest risk option for retrieving the data is to get the people who designed the device to implement their circumvention method. That is exactly what the FBI asked for and what the judge agreed to.

Why should the FBI have to waste resources reverse engineering Apple's product (and risk destruction of evidence) when Apple is wholly capable of helping out?

>Why should the FBI have to waste resources reverse engineering Apple's product (and risk destruction of evidence) when Apple is wholly capable of helping out?

so now apple has to pay for engineers to design and implement this change to their product because the government said so? why is apple required to "help out"?

Apple is currently required because there is an outstanding court order. I'm not sure if they have submitted a formal appeal.

I do think there are some interesting questions about "forced work" here, but that can be said of any subpoena, and I don't think many would contest the entire concept.

From my standpoint: Apple can prove critical in obtaining whatever evidence/information may be on the device. It may certainly be the case that there is nothing valuable there, but such events should be thoroughly investigated. This was a personal computing device of a person who killed many, we need to know what is on it, and we can. It wouldn't surprise me if Apple were already working on the software.

Apple is a $500 billion company that sells hundreds of millions of devices each year and has more credit card-linked accounts than any other company on Earth.

If a warrant can force Apple to do this work now, then what is the criteria that would determine when Apple wouldn't have to help out? That is the key legal question.

If a warrant can force Apple to do whatever the warrant says would be helpful to the FBI, then that's a pretty huge scope of potential work.

using their magical AES breaking powers?

From Apple's letter [1]:

> Specifically, the FBI wants us to make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation. In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession.

> The FBI may use different words to describe this tool, but make no mistake: Building a version of iOS that bypasses security in this way would undeniably create a backdoor.

So it's not a matter of technical impossibility.

[1] https://www.apple.com/customer-letter/

if the gov were capable of doing this themselves they would have done it already

For Apple it's not impossible. The government can't push updates to a phone without the necessary keys.

This is a recent development. Apple only started to care about iOS security around 2012 for example.

At least someone is.

In a complex system great security takes years of work, it isn't flipped on like a light switch in v1.0. Wasn't the first version of iOS running as the root user?

Oh really? iOS has page-based executable code hash/signing since at least iOS 2 (2008); Android still doesn't have any runtime code integrity protections.

Of all the random security issues in the past 8 years you'd be hard pressed to find one where this was relevant.

Yeah! That's why you can't even jailbreak every single one of their phones!

Sad but true

This is one of those citations needed statements. I have played with cyanogen with LUKS, luks nuke (a simple password that destroys the keys), firewall and tor without google services. And you can even make yourself a dead man's switch that will erase the keys dd if=/dev/zero - you know the drill if some condition is not met.

The best part - even if google can make custom version of the OS it won't help the least.

It is a tough nut to crack.

Of course you can secure your own device yourself.

But if you buy Apple you won't have to.

And in that case FBI will load their custom OS and open it. The entropy provided by the user in the apple current security solution is just too little for the device to not be vulnerable.

Apple tried to do it by providing also their own key, but that helps little when a dedicated agency has physical access to the device. And legal hammer to compel Apple to spill the beans.

This article explains the situation nicely:

http://blog.trailofbits.com/2016/02/17/apple-can-comply-with...

The short answer is, Apple compensates for the low entropy of 4 digit PINs by rate-limiting the number of guesses you can make.

But that is the root of the problem. Apple can control how the system is unlocked, they can update it, so they are able to circumvent their own measures. I wouldn't be surprised if they are able to do it with secure enclave too.

So apple didn't provided their users security. They provided security with potential backdoor in the design.

So I say - it is good if FBI can force apple to exploit their own backdoors - to learn their lesson.

> They provided security with potential backdoor in the design.

I'm not certain what you're asking for here. A device that is completely impregnable?

Depends on completely - but device that does not store critical encryption keys and allows users to set their master keys is a good start. The problem for apple is that every device that could be secured against malicious apple cannot be forced to be part of their walled garden.

Or just some honest marketing. Like - your device is not secure if we cooperate with LEO and let consumer make their choice.

I see. Never let profit stand in the way of principles. I can understand the appeal, even if I don't share it.

Reply on news.ycombinator.com