The timing of computer search warrants when it takes years to guess the password | Hacker News Reader

The timing of computer search warrants when it takes years to guess the password

reason.com

75 pointsloteck70 comments

> The magistrate judge doesn't know anything about computer forensics or how long the brute force attack is going to take.

That's a bit ad hominem.

Let's look at it another way. Should warrants be issued for indefinitely long periods of time? If so, what would keep limitless warrants from being used to harass people? Imagine if the cops just seized property and said it's just going to take them literally years to access it, and the owner can't get it back in the meanwhile. Also, imagine if this is done to extend the statue of limitations. There are so many ways this could be abused.

Then it becomes not too different for arresting someone even when they've done nothing wrong - sure, the charges might be dropped, or no charges brought at all, but spending the night in jail and missing work still has deleterious effects.

> Requiring the government to exercise "greater care" to make sure it is keeping up with a series of requests [...] seems exceedingly odd to me.

So... the author is advocating for rules being too hard, and for the government to not be required to follow them? This is similar to the common response to the simple question about privacy intrusions: why not just have investigators get warrants? "But terrorism! It takes too long! Do you want the terrorists to win?"

Most of the copterbation movies and shows on TV try to show us that cops often don't get the bad guy unless they're allowed to break the rules. It's all absolutely bullshit.

For context, in 2016 Apple was claiming the six digit passcode would need 5.5 years of brute forcing[0]. Not sure if they still claim the same.

[0] https://www.washingtonpost.com/news/wonk/wp/2016/02/17/how-l...

>“This means it would take more than 5 ½ years to try all combinations of a six-character alphanumeric passcode with lowercase letters and numbers,” Apple security guide says.

So given that it took them three years, 3/5.5 means they went ≈54.5% of the way through all the possible combinations. That seems in line with the estimate (assuming all passwords are 6-char alphanumerics).

Assuming they started at 000000 this also puts the passcode itself somewhere in the 545000 range. I hope it was 543210.

If they really just incremented from 0 they could have done a lot better. I bet the distribution of 6 digit passcodes in the population is far from uniform:

* A ton of people just take their 4 digit PIN and append 00 or 01

* Passcodes that are easily convertible to dates. Bonus points for targeting their particular birthday, their family’s birthdays, their pet’s birthday, significant historical dates etc

* Passcodes that make a nice pattern on the keypad like 084265

* Passcodes that have a numerical pattern like 024680

Yeah you'd definitely want to do an intelligent pass before brute force. Might be fun to write something that attempts to sort all the 6 digit numbers based on some heuristics "how likely is this as a human generated passcode"

As a serious security person, this is why I use 999999 as my passcode

I use 999997. You'd think they'd try 999999, and 999998 and go "fuck this" and try something else.

All of the best security practices rely on the attacker being easily bored. Thank you attention economy!

This is why I use more than six numbers in my lock screen pin: the field itself turns from six slots into a single large field, such that you cannot tell if the password is seven digits or seventy. It massively increases the potential address space.

Sure, you have an enter key you have to press to submit the pin instead of having it auto-submitted with the sixth digit, but that’s a small price to pay.

Would the probability of guessing all the possible combinations be higher than brute-forcing from 000000 to 999999?

I was thinking this through as well but if you were Apple estimating this number, wouldn't you have already done the averaging math to arrive at an estimate of 5.5? Seems to me more likely that speed of Greykey brute forcing improved or Apple's estimate was off.

I get what you mean, but the quote said "all combinations" specifically. I think they'd choose that wording because that's the biggest number they could report truthfully.

Shouldn’t they technically write “all permutations” for the biggest number?

If the author thinks a judge shouldn't be allowed to impose a time frame on a search warrant, does that mean the author thinks the government should be able to execute the warrant any time in the future? That sounds ripe for abuse: the government could get a warrant, wait as long as they want for the suspect to do something else they think is suspicious, then execute the warrant at their leisure.

While obviously Orin Kerr has far more background on these subjects than I do, I don't agree with his reasoning here. The fourth amendment requires police to get a warrant from a judge before performing a search and seizure[1]. The judge's job is to ensure the warrant application has ample justification and the scope of the search is reasonable by fourth amendment standards, and may put limits on this search (ex ante restrictions) as necessary to bound the scope to what is reasonable. The police have no authority to perform a search beyond what the warrant allows[1]. If they think the warrant is unnecessarily restrictive, the solution is to appeal. It is not acceptable to just ignore the restrictions because they don't agree with the judge. The police should be held accountable for going beyond the scope of a warrant even if a broader warrant that included their activities would have been a reasonable search.

So in this case, it would have been completely reasonable for the judge to authorize the police to spend as much time as they needed to crack the password, mirror the device, and then come back for another warrant to search the contents. But the judge's warrant didn't authorize that, and the evidence should be discarded for going beyond the scope of the warrant.

[1] Beyond the normal exemptions that allow warrant-less searches.

Maybe the article deserves a second reading, but as an attorney, I found this argument rather odd as well.

DOJ should have asked for more time at the beginning. If they did and didn’t get it, they should have objected to the district court judge. If they did and were overruled, and this was so important, they should have bothered to get the renewals.

To argue that a judge can’t or shouldn’t place a time limit on search warrants is unpersuasive.

I wonder too how statute of limitations would play into such a "timeless warrant". What if a crime was committed, digital evidence exists, but the statute of limitations passes before investigators can access the evidence? How would that possibility play out?

I think you need a process of extensions where each extension can be reasonably denied or approved.

Old evidence is evidence, e.g. DNA and that should be used to both prosecute and to set innocent people free.

I get the potential for abuse, that is why you need a time limit and process to extend it.

The author believes the reasonableness provision of the fourth amendment would cover that.

The author is engaging in severe self-delusion.

It is deeper than that, the author appears to be a constitutional absolutist and is pitching a perspective that calls into question any law or condition that narrows or refines the conditions under which a warrant is issued. But this is obviously the case since the article is on a hyper-libertarian rag.

In Finland, the police can just force your finger on the fingerprint sensor! :)

Same in the US. You cannot be compelled to provide a passcode, though. On the iPhone if you tap power five times or hold power and volume up or down for a couple of seconds it disables face/touchid until you enter the passcode. The passcode is also required after some number of incorrect face/touchid entries and when powering on.

> On the iPhone if you tap power five times or hold power and volume up or down for a couple of seconds it disables face/touchid until you enter the passcode.

It should be noted that those two methods are not equivalent.

The "tap 5 times" methods starts a countdown to call emergency services, which you will need to cancel if you are just trying to temporarily disable biometrics. It can sometimes be a bit difficult to cancel that call.

Once when I used "5 taps" it opened Apple Pay after 2 taps (which is normal), opened the emergency screen and started the countdown after 5, and then switched back to the Apple Pay screen. I managed to get back to the emergency screen in time to cancel the countdown.

A couple other times when I've clicking cancel on the emergency screen it has turned on the flashlight.

The "hold power and a volume button" on the other hand brings up the emergency screen but down NOT start the countdown. If you keep holding the buttons for a few more seconds it will start the countdown. The phone vibrates when it brings up the emergency screen so it is pretty easy to wait for that and release the buttons so you don't start the countdown.

Also note that you can disable starting the countdown on 5 taps and/or on long power/volume hole in the Emergency SOS settings. 5 taps and long power/volume still bring up the emergency screen and still temporarily disable biometrics.

I don't believe this is true on iOS, unless there was a recent change I'm not aware of.

Right now, tapping power five times on my phone running iOS 16.1.1 opens an "emergency" mode, which allows anyone to call 911 or see my "Medical ID". It also has an option to "cancel" this mode, which returns the phone to a normal locked state but forces a passcode to unlock (i.e. Face ID will not unlock the phone in this state).

Check your "Emergency SOS" settings. For both "5 taps" and "hold power and volume" there is a setting to control whether they call emergency services.

If those are off then they just open the emergency screen. If those are on then they open the emergency screen and start a countdown to automatically call emergency services.

On my phone they are on, but I don't remember if I set them to that or they came that way.

You can also say "Hey, Siri, whose phone is this?" and it will lock the phone and a passcode will be required.

In the US too, I think in some cases. There are all these nuances. I remember seeing a whole presentation about this at defcon. Apparently biometrics locks like fingerprints are treated differently than the passcode.

You can temporarily disable Face/Touch ID by tapping the power switch 5 times in quick succession

which is why I avoid fingerprint unlock on my password app and other finance/banking apps requiring authentication, although my phone itself is unlockable with fingerprint

Why finance? In terms of government threat, all they'd have to do is subpoena the bank to get any info there.

But are they required to use a wrench? https://xkcd.com/538/

I remember there were some brute forcing tools for iPhone 3GS passcode back in 2010. It only took a few minutes. Perhaps, it didn't really brute force but searched the passcode from the device.

Back then they may not have had a temporary lockout feature after a few incorrect attempts

It was a simpler world, without the secure enclave and all that.

Reason magazine is such a neoliberal joke. Libertairanism had some interesting things to say in the 1970’s but since the Heritage foundation and Koch brothers types took it over in the 1980’s its just mainstream centrism dressed up in funny arguments for “quirky” people.

I'm curious, given the fact that they have physical access to the device, would it be possible to clone the hard drive as it is on multiple devices, and then brute force the passcode in parallel?

The flash is encrypted using a unique key that is burnt into the CPU at time of manufacture. So it is not possible to read back the contents on another phone even if you have the passcode.

The article indicates they _were_ hacking a clone (mirror) of the data... which is curious, since Apple does claim there is a hardware key to prevent exactly that. Presumably someone is doing a little lying-by-omission - Probably there is a way to clone the device key with sufficient access/tooling, but that is pure conjecture.

What's stopping someone from placing the silicon under ab electron microscope and reading the data visually? I mean, the circuit that encrypts data has to have some way to load the key (the circuit might not be in the CPU, but it exists somewhere).

There is not an infinite amount of budget to solve any particular case

Somewhat related, this sort of concern was mentioned in this talk about security on the XBOX One, https://youtu.be/U7VwtOrwceo?t=668

Essentially they set an max budget for cost-effective attacks on the hardware, "modding the console needs to be more expensive than 10 games" (about $600), and ignored attacks that cost more than that to for an end user to execute.

Makes me feel more secure having 2FA (OTP) on an iphone!

I use a decoy phone that doesn't contain evidence of any crimes, its basically a get out of jail free card.

> get out of jail free card

I wouldn't be so sure. Just because your phone is clean doesn't mean you're going to be set free from jail.

If you're at risk of being subjected to such a search, you have a different problem.

I meant in the context of not being subject to a search. I.e. someone steals my locked phone.

For me, the takeaway is use 2FA, where the both authentication methods are not biometric. This renders eye scans, face scans, and fingerprints useless, and at least doubles the time it takes the Feds to "brute force" an iPhone. ACAB.

Long alphanumeric password is an option

i have no hope. everything i do is currently in gmail and very much subpoenable because it's just the quickest way to get shit done and share with people, I'm not going to get a cave-style airgapped encrypted Linux desktop for my daily life. Some of my stuff is in the messengers but I'm almost 100% sure that eventually they will get to those as well, so yeah.

It would be funny though if OpenAI gets to that data and steals it, sorry, trains on it first. Like, before Palantir or whatever else is out there.

messengers are the new email.

not really. say hello to my lawyer and my real estate agent and countless others who send me low-res scanned PDFs to sign over email. Besides, like i said, all the messengers will be eventually, in a few years, hacked/arm-twisted/subpoena'd into sharing the data as well, so what is even the difference??

I hadn't thought about it before, but encouraging use of moderately weak encryption keys is an interesting way of balancing the needs of privacy and law enforcement.

On one hand, it protects against widespread warrant-less searches (stop and frisk, border patrol, etc). On the other, law enforcement can get access to the data before the statute of limitations runs out if they deem the case to be worth the resources (presumably with a warrant).

It also make it easier for criminals or any illegitimate party to get your data.

I'd rather have Three-Letter-Agency proof encryption everywhere.

If the need for encryption stems in part from the need to be safe from some particular sort of authoritarian government for whom evidence of non-crimes is enough to punish... then weak encryption subverts that need.

It's difficult to imagine evidence of the sort of crime that evidence for it easily goes on an iPhone or other commercial device and is so heinous that it should override this concern I've described. And of those exceptions (someone conspiring in chat messages to murder for hire) that they happen so frequently that might be the excuse.

When the government demands that encryption be crippled, it seems that they aren't doing this to protect me from any crime I might care about myself... but that they are primarily concerned with crimes against the government itself.

To be clear I don't support laws mandating the weakening of encryption in any form. If someone wants good security they should have it. However, most users don't want to enter a strong password every time they unlock their phone. Apple chose the pin length based on a balance of what the user would be willing to actually use and the security it provides.

Meanwhile biometrics provide stronger keys combined with convenience, but are more prone to abuse (forcibly pressing users finger to unlock during stop and frisk, etc). Security would be better served if device manufactures encouraged pins over biometrics, even though they can be brute forced, since they better protect against the most common abuses, and put a price on whether it is worthwhile to brute force.

Reply on news.ycombinator.com