Freedom, the US Government, and why Apple are still bad | Hacker News Reader

Freedom, the US Government, and why Apple are still bad

mjg59.dreamwidth.org

50 pointszdw32 comments

Huh. The fact that Apple are the only ones that can sign software that runs on an iPhone may just allow them to defeat the DoJ in court.

http://www.bloomberg.com/news/articles/2016-02-24/apple-fbi-...

Apple has indicated that they're going to continue to keep increasing the security of their products in the future, which may make it impossible to update firmware to the Secure Enclave (or at least require the user's permission first), but that's actually a weak measure.

I'm not sure why tech people think that technical means to accomplish zero knowledge is the holy grail, that will never trump having the law on your side. Congress could pass legislation (like CALEA for tech companies) that would require everyone to design their products to make them accessible to law enforcement any time they want.

There are ways around this that involve First Amendment protections (e.g., an embedded compiler on the device, and features that allow you to download and install packages from source code -- protected speech -- thus adding encryption features).

Can't download? Take a photo of printed material, OCR it and then install. That's hard to outlaw in the US.

I wouldn't agree that it's hard to outlaw, but I would agree that when the original encryption export laws were written nobody had OCR in mind.

It seems like it would be quite easy to outlaw this, the only question is what collateral damage would result from the process.

The US courts are really, really reluctant to ban printed material. If something is printed with ink on dead trees, it's practically sacred.

In the 1990s, PGP was published as a printed-and-bound book in a layout that was readily OCR-able, with code-friendly fonts, checksum and other features to make digital reassembly easy. The theory was that the US government would be unlikely to successfully ban an actual, physical book.

Thought experiment: Apple provides a pamphlet, free for the taking in every Apple store, that when scanned will armor your phone. Extend the thought experiment to a web page that the phone just downloads, compiles and installs (yeah, you probably want that code signed).

This would be hard to forbid in the US. The government would probably go after the plugin system on the phone (which would be an interesting battle). Places like the UK would lose no time banning such media, but it would still be readily available.

But isn't the First Amendment already the legal protection you need?

After all, even if a law is passed to protect something, it can be changed later. Not like the Constitution hasn't been... stretched by now.

At this point you might as well kiss goodbye to the US tech industry as nobody overseas will by anything that has a US government mandated backdoored.

I'm pretty sure if Congress passes legislation mandating it they can influence plenty of non-American businesses by withholding their ability to do business in the US.

If they don't buy American products? I don't think so.

Do any of those businesses want to sell their products to Americans? Maybe they can sell different SKUs with those capabilities but they'll have to do it for every market they sell to because the US won't be the only government that will want backdoors.

Indeed. This already works the other way round: companies selling into China have to comply with their "great firewall" requirements.

Thereby gaining... what exactly?

Law enforcement access in exchange for access to the biggest and wealthiest market in the world.

If that were true then Windows wouldn't have 87% of the desktop/laptop OS share worldwide [1].

[1] https://www.netmarketshare.com/operating-system-market-share...

That's temporary. With their latest shenanigans, Russia, China and others are moving to their own Windows replacements. Who would want a foreign government having easy access to everything your government and people do?

I don't think so. So far the history of technology has proven that Balkanization doesn't last and that the markets gravitate toward a dominant technology (TCP, HTTP, Windows etc...).

Your average everyday person doesn't care about back doors and that's where market share is.

Governments accept some level of foreign penetration. The whole spy thing is just a complex game - trust me I know I played it.

Why do you think it would be legal to mention the existence of the backdoor?

If Apple doesn't come out of this high-fiving everyone, I think we can all guess

I agree with all the ideas in the article, but at a bare minimum, Apple should configure devices so that no firmware update can be installed unless the user enters their PIN first. This would be an easy move that would make this whole debate moot. The problem is that Apple only partially protected users from Apple itself.

There's a much bigger elephant in the room, though:

Updates to the OS and applications are encrypted, completely opaque, signed by Apple instead of the original developer, can be granted additional entitlements for arbitrary permissions, and cannot be audited by anyone but Apple without a jailbreak.

When coupled with push updates, Apple already has a targeted backdoor into every iPhone anywhere connected the network.

This is a much more difficult problem to solve, as securing against that threat model requires an diverse ecosystem of 3rd-party audit/review, software, and tools.

I don't see any way of solving that issue while also maintaining their stranglehold on the platform via DRM.

Don't users need to confirm OTA updates?

This person is talking about for applications, to which many users have "automatic updates" turned on; this is one of the places where Android is fundamentally by design more secure than iOS (though by implementation has often been weaker :/ see the Master Key family of vulnerabilities).

Ah. Missed that point.

What's the highest permission an app can have? Wouldn't that be the limit of the vulnerability here? Also, many permissions require manual granting, e.g. contacts, camera.

Edit: also, that could be mitigated partly by requiring user approval of any updates adding permissions.

The kinds of permissions that can be granted to an application by way of entitlements is pretty brutal and go well beyond the permissions that people tend to think of applications as being able to have: there are entitlements for things like "can install other applications" and "can obliterate all data stored on the device". I'm not certain if some of these are blocked to applications of certain kinds, but I know that a lot of them are available if Apple chooses to deploy them.

Moot?! Please. In 2018 Apple gets handed a national security letter with a demand to backdoor all deployed iOS devices, with which they comply. Users see a routine update (maybe even with some conveniently timed security fixes included too!), and... key in their PIN. Everyone is now backdoored. Not the specific situation you were thinking of? Welcome to the world of security design: holes are everywhere and plugging them piecewise doesn't work if the problem is fundamentally intractable. Your theory would protect the San Bernardino shooters, but not you or me or anyone else.

Why do people (smart people, even!) continue to insist that this problem can be solved by technical measures? This problem cannot be solved technically. Stop it. Please. This misinformation is hurting all of us.

If you want snoop-proof encryption then the user needs to manage the keys herself, which I believe was MJG's point in that blog post. (And even then you're trusting the hardware itself not to have a backdoor to pull off the pass phrase, etc...).

I agree, the general problem can no be solved technically. However I do think its valuable if apple builds the system in a way that forces the state to adopt clunky tools blanked backdoors.

At this point the techindusty should have drawn a line and fight for it.

Maybe this is Apples strategy. The want to raise the conversation but know they are gone lose this perticular case, so that they have a better position in the next, more important case.

I don't have anything against Apple retaining control of the firmware on an Apple phone. It is their closed system after all. It's just that Apple should not imply that their phones are somehow secure. The FBI thing reminds us that they are all effectively backdoored by Apple.

On this topic I have a large unfinished essay: https://github.com/pjc50/pjc50.github.io/blob/master/pentagr...

... is still bad? /grammarnazi

The British tend to use plurals with corporations.

Interesting... the plural says to me "all the individuals at Apple", vs the singular referring to the company as a single, faceless entity.

I wonder if that was intended by the author.

Surely not. Just a weird British thing. Like how they write "math" as "maths" and pronounce it "mafs"...

Whose logo is on your i-thing? Render unto Apple the things that are Apple's, and keep private what is truly private in the first place.

If you'll forgive the abuse of an old parable...

Reply on news.ycombinator.com