Hacker News Reader

Comment by kbenson | Hacker News Reader

> Knake said that the Justice Department’s narrowly crafted request shows both that FBI technical experts possess a deep understanding of the way Apple’s security systems work and that they have identified potential vulnerabilities that can provide access to data the company has previously said it can’t get.

I assume the actual request is more technical then, because the overview they gave here explains the things you would want to do if you knew nothing about the encryption and wanted to brute-force. Reduce password attempt timeouts, allow automating the password attempts, and don't melt-down after too many failures.

View on HN

That's why a lot of people (myself included) are so cynical about the request. We all know the intelligence community has experience with side channel attacks, decapping processors, etc. But they've apparently decided not to use them in this case, "in the interest of time."

If they really wanted that data, they could get it with their current capabilities. They don't really want that data; they want the legal precedent to compel companies to subvert their own security mechanisms, and they want to intimidate one of their harshest critics (Cook). That's part of their broader strategy; if we can compel you to break security you built, you build security you can't break. The next logical question is whether they can compel you to not build security mechanisms you cannot break in the first place. That's the legal question the FBI really wants to ask.

In the latest Ctrl-Walt-Delete, Nilay (an ex-lawyer) makes a great, and chilling point, that it's entirely possible that the FBI can easily get into the phone with the help of the NSA, but that they're choosing to make a public request in this case to set precedent since so many facts are on their side. Terrorism, simple request, giving Apple full control, etc.

Facts are on their side? Please could you explain that?

public opinion is pro-government in the specific matter of the San Bernardino attack.

Not just in the San Bernadino case. There are a lot of perfectly reasonable cases where you might need to get into a locked phone that do not involve terrorism.

Examples include investigating the murder of the phone's owner, accessing financial information of a parent who has passed away, or recovering corporate passwords from the phone of an ex-employee who cannot be located or refuses to give them up.

This is a misuse of the word 'need'.

So yes, there are many cases where all or most of us (even simultaneously) might want into a locked phone. But we're all worse off if it's possible.

I doubt you can get the FBI to compel Apple to unlock the phone of a cheating lover or because the death of a loved one.

It shouldn't be in their favor since even the most basic of background checks would have shown her a ravi g lunatic who hated Americans and was highly supportive of terrorists. They failed us through utterly gross negligence and somehow the public is on their side.

On the other side the risk to Apple is the congress deciding the answer to the question posed by the FBI. There are members in congress who believe service providers should comply with court orders regarding access to encrypted information, and further the public by and large, subscribe to that view. Now, Apple's business proposition, and the position of many technologists, though not all, is that Apple shouldn't be compelled to comply because it will weaken privacy for all, not just that of the subject of a criminal investigation. However, long term, there is reason to believe that if not the USG, other large markets will ask Apple to comply, in order to have access to the markets. As noted before India[1] as well as some ME countries forced BBM to comply as a condition of doing business.

[1]http://www.wired.co.uk/news/archive/2013-07/11/blackberry-in...

Another option the FBI has is to issue a search warrant for Apple's code signing key. Then they could flash the device themselves. That's what they did to Lavabit and it has a lot more legal standing than this All Writs Act thing.

I do not understand why no one is talking about this possibility. This is a much more terrifying option, the precedent already exists (lavabit), and it would enable a much broader application of different versions of FBiOS.

If the FBI were to do this, would it be possible for Apple to counter it in the future by splitting the key across multiple entities, some in non-US jurisdictions, in such a manner that all of them would have to agree to sign anything?

You just described David Chaum's crypto plan. Also widely derided as having a backdoor. So it's really just moving the goal posts.

It's kind of an interesting idea. Doesn't seem like it would work for RSA cryptography, though -- in that model, your private key is a pair of prime numbers, and your public key is their product. It's hard to produce both factors from the product, but it's pretty easy to produce one factor if you know the product and the other factor.

I actually think that either case(win or lose) have a lot of benefits for the government. If they win, they have the precedent and legal access ,so it makes their lives easier.

If they lose and the media circus leads people to strongly believe that the iPhone is 100% secure while it really isn't - gaining the trust that was lost due to snowden - this is really useful both from surveillance point-of-view , from blocking access to foreign countries, and for helping the iPhone usage grow, especially among "important" users ,be they legal or illegal.

But just looking at what seems more valuable for the government ,it seems that the second option is far more valuable. So i wonder ,why do everybody automatically accept the first motive ?

No other consumer phone is notably more secure than iPhone, so iPhone adoption is not a useful goal for netsec hackers.

It's not just about phone adoption - it's about the total pattern.

If you don't trust the iPhone ,maybe ,for your important communications, you'll only use Qubes + Whonix + TOR ? write your own software in addition(as a rich terrorist org) ? use a machine not connected to the internet and pass files ? Be more careful in what you communicate over the phone ? etc..

> If they lose and the media circus leads people to strongly believe that the iPhone is 100% secure

I don't think this is it. IMO if they lose they will ask congress for a law to require backdoors because they have already shown that not having such a law helps terrorist.

And the likelihood of passing such a law is high ?

Of course it is. Both parties are in favour of more government power.

As are apparently 90% of my facebook friends. Sigh.

If they really wanted the data, they could turn to any one of the countless Beltway bandits that have sprung up in response to the massive influx of contracting dollars the various three letter agencies have been pumping into the DC/NoVA/Ft Meade areas.

This has nothing to do with capability, and everything to do with precedent

Does that means we should return to using blackberries for security?

I'm not sure how that would change things. If the phone in question had been a BlackBerry, wouldn't the FBI be making the same demands of that company?

Also, RIM actually folds to these types of requests.

"RIM's carefully worded statements about BlackBerry security are designed to make their customers feel better, while giving the company ample room to screw them" - Bruce Schneier

https://www.schneier.com/blog/archives/2010/08/uae_to_ban_bl...

I read through that article, and it didn't seem to support your statement, especially given the edit at the bottom.

> The U.A.E. wanted RIM to locate servers in the country, where it had legal jurisdiction over them; RIM had offered access to the data of 3,000 clients instead, the person said.

If it has the access to offer then it seems to support the point.

Particularly: > RIM respects both the regulatory requirements of government and the security and privacy needs of corporations and consumers. While RIM does not disclose confidential regulatory discussions that take place with any government, RIM assures its customers that it is committed to continue delivering highly secure and innovative products that satisfy the needs of both customers and governments.

What happens when those needs are diametrically opposed?

Well, this article seemed to suggest the FBI might know of vulnerabilities in the iPhone, which would presumably not be on the BlackBerry. Although the BlackBerry could conceivably have its own vulnerabilities too.

Reply on news.ycombinator.com