Hacker News Reader

Comment by AngrySkillzz | Hacker News Reader

Of course the industry response is muted; this is the chilling effect that we were all worried about. Most Big Co's don't want to put themselves in opposition to an organization as powerful and well-funded as the US intelligence apparatus. I'm sure they are all on Apple's side, but are less willing to speak out about it because they fear the consequences.

If you're cynical, you might think that this case is all about setting precedent and trying to scare one of the FBI's biggest opponents on the topic of data security (Cook). We know they have other options for cracking the phone in question (decapping, side channels, etc.). They want legal precedent for installing backdoors, and they want to scare Apple and other companies out of providing security features. No wonder those companies are hesitant to speak up.

View on HN

I don't think it's about opposing the government, the line in Apple's letter that symbolises for me the importance of their argument is "because we believe the contents of your iPhone are none of our business." – for many other companies, the contents of your device is absolutely their business, it's how they maintain revenue.

If Facebook can't read your data, then they can't sell your eyeballs to advertisers.

If the contents are none of Apple's business, why did Apple give themselves (via their signing keys) a backdoor that allows them to replace the firmware out from under the owner of an ostensibly locked device?

If Apple couldn't do an end-run on the key derivation protection mechanisms, then they couldn't use that backdoor to aid the FBI.

"Can't do it" is a strong defense.

"Won't do it" isn't.

You'll have to excuse any naivety on my part, but is that for all devices or for <= 5C? I was under the impression that was not possible for the 6 and 6S because of the secure enclave, and that the device had to be unlocked for a firmware update to occur.

The weight of evidence is that they can update the secure enclave firmware in place, too, without losing keying material.

People are disputing that now; apparently Apple has hinted that they could defeat the Secure Enclave on the newer phones.

e.g.: http://daringfireball.net/linked/2016/02/17/panzarino-apple-...

Actually - it seems to me that "won't do it" - when based on principle, is a much better defense.

Not when it comes to transparent, limited scope, reasonable writs.

This isn't some NSA mass surveillance program, or clipper chip reloaded(TM).

This is an active murder (and terrorism) investigation in which Apple's privileged position -- one they assumed by choice and to their own benefit -- already exists. It is not unusual, unethical, or establishing any new precedent for them to be compelled to use keys they already have to open this single device.

Apple does not need to, nor are they being asked to, provide a backdoor that can be used elsewhere, and any further demands of Apple will require the same judicial oversight as this one.

If Apple doesn't want to be in this position in the future, they can avoid the potential liability by not holding master signing keys that can be easily used to circumvent the security of an owner-locked device.

> Apple does not need to, nor are they being asked to, provide a backdoor that can be used elsewhere.

They are, however, being asked to _create_ a backdoor that can be used anywhere. The specific request is to remove the limits on guessing passcodes so that the FBI can brute force it.

The backdoor already exists, in cryptographic terms.

All they're being asked to do is to use it, entirely under their own control, for this one phone.

Tim Cook is trying to pretend that commenting out a few if statements in the key derivation code path is what creates the backdoor.

If Appke weren't able to update the software on your device, they really wouldn't be able to give you software updates. Since it's the software that enforces security, well you can sees where this is going.

It's not as easy as you imply. Denying themselves the ability to end run your security might well require them to not be able to upgrade or recover user devices. At all.

It's not as hard as you're implying; A locked device could support re-imaging by expunging all existing key material.

In general, Apple's guarantees about anonymity and security all assume that there is no risk to Apple sitting in a trust position. This case demonstrates why that's a bad idea.

Do you think they choose to ask Apple to do this in such a public way, because they are very confident the phone will contain information that will help with the investigation, which will make a positive precedent about this method for future requests, and also provide 'lobbying power' when new laws will be considered?

The phone might not even have to contain anything useful for it to be said to have been helpful by the elimination of that avenue of research. "Apple helped by showing the phone had no information on the attack and we've moved on to other investigative avenues."

One could twist things all day long to fit a goal.

They can be confident because they are free to assert whatever they want about the contents of the phone. Nobody will have access to information that contradicts their assertions.

The iPhone in question was his (government) work phone and they already found a bunch of their other 'burner' phones in a trash bin, which they got access to. I find it unlikely he used his work phone for planning when they purposefully ditched other devices. Additionally, I doubt he knew the iPhone encryption would block investigators from accessing the data, so the fact they can't access it is most likely just coincidental that the device's battery was dead.

But this is just speculation...

I'm definitely in the camp that believes this is a legal stunt by the FBI to set a precedent using a highly publicized terrorism case which the public will support. A previous All Writs Act claim in 2014 by the FBI for a credit card fraud case involving an encrypted iPhone didn't change Apple's position on the matter, so they are trying again with a higher stakes case.

Yes I agree. I can't be a coincidence. They deliberately picked the best weapon in this debate, biased public opinion.

Could it be possible that the government want to lose in this case(and in the media) - creating a strong illusion that the iPhone is 100% safe from spying ? How valuable such an illusion would be ?

Most people who think about this stuff often seem to think that TAO already has access and the only purpose is to create a precedent to use this legal process against anyone.

What is TAO?

https://en.wikipedia.org/wiki/Tailored_Access_Operations

Do you really think that the information in this phone is otherwise beyond the reach of all mankind? Spare a few snowflake engineers and managers at Apple?

There are dozens if not hundreds of viable methods to obtain this info, FBI is choosing to pursue the court order route instead of any of the other forensic tools available to them.

The simple fact of the matter is that the encrypted data and the key to decrypt it both live in a piece of physical hardware on the device-- no matter how well obfuscated it is, it can still be analyzed and recovered by a sufficiently advanced technical entity.

This is exactly the type of work that NSA TAO exists to accomplish, and they are widely regarded as one of the best organizations of this kind in the world.

In fact, they swore to it. https://twitter.com/mmasnick/status/700394031218499584

Who swore on it ? how high is he on the org chart ? is it possible that he is being kept in the dark ,intentionally ? or could such skills only availble at other agencies ,but the knowledge acquired can be shared ,like it has been in the past ?

The source link is a few tweets down. https://www.documentcloud.org/documents/2714170-SB-Shooter-M... The signatures are on page 20 but they're the same names as on the first page:

  Eileen M. Decker, United States Attorney
  Patricia A Donahue, Assistant US Attorney &
    Chief, National Security Division
  Tracy L. Wilkinson, Assistant US Attorney
  Allen W. Chiu, Assistant US Attorney

But the guy who said the specific statement you mentioned is just the regional director of the orange county forensic department in the FBI , Christopher Pluhar @pg 21.

Reply on news.ycombinator.com