Hacker News Reader

Comment by zingermc | Hacker News Reader

Honestly, it wouldn't take very much work for Apple to circumvent the lockout mechanism. It might even be possible just by commenting out a couple lines of code. The thing the FBI needs from Apple is the use of their private key.

View on HN

Not with the new iOS, right? There's no Apple's private key. There's only your own private key. If you loose it - you're loosing your data and nothing can help you. I think you have a choice of backing up your keychain in iCloud. If you haven't backed it up there's nothing that Apple can do to access data - except by changing security design. If you backed it up on iCloud then I don't know - maybe the whole keychain is just protected by password, in which case they could try to brute force it or something. Not feasible if your password is too long.

Apple has a private key for signing software updates.

The FBI wants a modified iOS that will allow them to rapidly try all possible passcodes without getting locked out after N attempts.

The FBI wants legal precedent. If they truly wanted the data they could have handed the phone over to the NSA have have it hacked before the weekend.

I'm genuinely curious -- how would the NSA would crack it?

My understanding is that iOS's filesystem uses AES 256 encryption. Even if you physically removed the disk, brute force is not an option.

Essentially there are two keys used to encrypt data on an iphone - one linked to the hardware (hardcoded and unique to each iphone, cannot be erased) and one linked to the software that's stored in NAND. After N attempts the NAND is erased and the key is lost thus all the data on the device is gone (one could try to brute force using a rainbow table style attack but at this point it's a lost cause because the amount of time it would take to decrypt the device). The NSA uses the old technique of copying this NAND to a backup and restoring it every time the device gets erased. This would give them infinite attempts at cracking the passcode with as little device meddling as possible

edit Apologies forgot to mention the passcode/fingerprint is tied into the 2 key process.

Ok, right, that makes sense. That's probably doable - making iOS being able to run auto-update when locked. Once for example. Update still needs to be signed of course.

It would probably make all crooks use long passwords for keychain, but who knows, maybe it would help in some cases.

If I'm not mistaken, the FBI wants a version of the OS that circumvents those limits and runs in RAM. Apple said it will take their team something like 2 weeks to build.

What they have to build and how long it will take them are moot points and detract from the overall argument which is can the gvt use the AWA to compel a 3rd party to create something that didn't exist before.

Who cares how much work it takes? That doesn't make what the FBI wants any less fascist (or their reasoning any less sociopathic).

Reply on news.ycombinator.com