Hacker News Reader

Comment by nefitty | Hacker News Reader

I think the fear is that those 12 will lead to the other 700 million iPhones.

That's not a justified fear. Requiring Apple to backdoor all phones is not similar at all to requiring Apple to help hack particular phones, that they have the capability to hack, in response to court orders.

You're telling me you would trust that software to remain in the hands of trusted actors? In 2015, alone, the IRS was breached, LastPass, the director of the CIA, Hacking Team, even Kaspersky Labs was breached! There can be no absolute guarantee that this backdoor would remain safe indefinitely. That is just the most blatant problem, not to mention the overt displays of cynicism and misuse of authority by the NSA as revealed by the Snowden leaks. Consider the political climate in the US at the moment. Now imagine a truly evil actor came into power, being handed over control of organizations with unheard-of amounts of surveillance power. I don't mean to seem paranoid, but in this case the feeling is completely warranted.

A gaping "backdoor" already exists in the form of the software update mechanism. By the same logic you're using, Apple can't keep their source code and signing key secure forever, which would be a much worse leak than them losing control of a modified iOS that would let someone brute force a PIN for a phone in their physical possession without the phone being wiped.

So would it be okay for the FBI to have to bring the phone to Apple?

Don't you see the slippery slope here? Next, the German or French police will knock on Apple's door. When they get access, China, Russia, and others will line up next.

Moreover, who says that the FBI or some other agency will stop after this iPhone, or the next 12 iPhones. Why not push to get their own signing key after they succeed in this case? They will try to get as far as possible.

We live in 2016. many of our devices with our private data are directly addressable from anywhere in the world. Intentionally weakening encryption and security in any way is a dangerous proposition.

It's good that Apple fights this tooth and nail. Sure, it may align up with their PR. I don't care, it benefits every citizen of the net who wants privacy and security.

worse. If this becomes "normal", then rather than the CTO or CSO or VP iOS Engineering having to unlock the code-signing keys to sign releases (presumably via N of M), it'll have to be automated so that "oh, the FBI needs another custom build for the 4th time this week, just do the build and click here to sign it". At that point the security of the master code-signing keys has evaporated to nothing and we're all sunk.

I think the precedent that emerges could be that law enforcement can force companies to sign specific functionality. This access-to-data power would be in line with their access to telephone and telegraph copper in centuries past.

People keep suggesting that on the slippery slope of Apple complying with cases of limited scope the next logical step is compelling the production of a signing key.

This is the very essence of why a slippery slope is often a logical fallacy, because one does not necessarily follow from the other, and no supporting evidence is given that it would.

There are plenty of things that would keep this step from occurring, primary among them that there would be no legal justification - in the context of the All Writs Act, there would already be a solution available to law enforcement that was less burdensome to Apple than providing the keys to the kingdom.

I, too, think it is laudable that Apple would fight for privacy, but I also think that a lot of the argumentation around this case is soft and ideological.

The main point here is that neither the government nor Apple could guarantee that this backdoor software would remain safe. If the FBI brought the phone to Apple to update the custom OS, the software would then exist, which is inherently a dangerous situation. Furthermore, suddenly a precedent is set wherein Apple is obliged to continue unlocking phones for the government with custom created software. I sincerely doubt any organizations involved would tolerate the continual creation and destruction(can data be truly destroyed?) of customized OS's each time the government needed access to a phone. That means, the incentive is to create and maintain this backdoored version of the OS, setting up the exact vulnerability Apple is trying to fend off.

Basically, this project, from whatever angle it is approached, has a non-zero chance of backfiring dramatically thus risking the security and privacy of millions of iPhone users throughout the world.

I'm under the impression that this "backdoor" is the fact that these phones can download updates to the OS. The phone checks that the update is signed by Apple. If Apple can be trusted to keep their code-signing keys secret, then surely they can be trusted to keep a special version of the OS secret.

I'm still opposed to this, though... The FBI wants to be able to dictate to a private company what features to build (because of the All Writs Act).

Only if you think Apple should be an unhackable "trusted actor".

Let's face it, the fact that Apple can be compeled to create this bypass is a civil rights issue, but the fact that it can create it at all is already a security bug. One that, in their defense, they seem to be trying to patch a step at a time in newer versions of their devices.

What if there were a limit of 3 unlocks a year? Like in NFL football, where the coach is only allowed to challenge 3 plays a game, even if each challenge is successful. (I know, still too slippery a slope)

Or if each unlock cost the requester a $10 billion fee (donated to charity)? To make them think harder about when to use an unlock.

Then there would be another terrorist attack and emergency legislation would be passed giving the coaches 6 challenges.

How about forcing the prosecutor and Director Comey and the judge to place the entire contents of their own phones on a public server? Every call, every email, every GPS coordinate. Let them feel our p.

pain.

You haven't been paying attention. Please explain how a security hole can only be exploited by Apple+FBI and no one else.

Why? It's a crystal clear agenda. The FBI has called for an end to effective crypto in the hands of US citizens.

> The FBI has called for an end to effective crypto in the hands of US citizens.

This is where it will end, and perhaps rightly so. There is no physical space in the US where US citizens can hide from the FBI and other authorities. Why should there be a virtual space where US citizens can hide. US citizens are not free to hide from the authorities and the law.

But it wouldn't be just the US. It would be any other country, and not just the country's citizens.

"Why should there be a virtual space where people can hide from US/China/Russia/Saudi Arabia/etc."

> perhaps rightly so

I see no 'rightly' in this, at all. The end-game is an abject panopticon that makes the Stasi look like amateurs.

(Regardless of what Google, etc. may collect, corporations do not have guns or the ability to put you in jail. Not yet, anyway).

Reply on news.ycombinator.com