Hacker News Reader

Comment by outworlder | Hacker News Reader

> And it would only be doing it on a single phone.

No, it would not. New custom software has to be developed. Software that can then fall into the wrong hands, from crooks with stolen phones, to nation states.

Seriously, it boggles the mind that they are asking for the security to be weakened, because terrorists. But they are not concerned that said terrorists will then be able to use the same software to crack their phones. Or Russia, or China. Maybe they are counting on the fact that it (for now) requires physical access?

View on HN

>No, it would not. New custom software has to be developed. Software that can then fall into the wrong hands, from crooks with stolen phones, to nation states.

Only if Apple stupidly wrote a generic firmware that could run on any iPhone and then lost it. That risk is essentially zero.

If Apple reasonably complied with the order, it would be as dangerous as any other Apple update, which is to say not dangerous at all.

>Seriously, it boggles the mind that they are asking for the security to be weakened, because terrorists.

In this case, there is no weakening.

> Only if Apple stupidly wrote a generic firmware that could run on any iPhone and then lost it. That risk is essentially zero.

The updates they write now are generic and run on any iPhone. So theoretically any new code, by default, would be as well. They may not even have a way to limit firmware to specific devices without many man hours more of work on top of creating the modifications already being requested.

> They may not even have a way to limit firmware to specific devices

They do. The new firmware may not be distributed, but it should be easy enough to make it such that if it was distributed, it wouldn't change security at all on phones other than the target.

For example:

    function handleWrongPassword() {
      if (deviceId = 1234) {
        return;
      }
      //do the normal phone stuff, like a delay or wipe
    }

Since the firmware is signed, no phone will run the firmware if you change the hard coded 1234.

> if (deviceId = 1234) {

... Is that a backdoor within a backdoor? :)

I don't know what you mean... but it's pseudocode for what the FBI asked Apple to do. It's a backdoor that only applies to a single device. Since it must by signed by Apple, it can't itself be backdoored by the FBI or a hacker or anyone else without Apple's consent.

Edit: oh, I see what you mean. The single =. But it's pseudocode. That happens to look a lot like Javascript with a bug :)

Reply on news.ycombinator.com