Hacker News Reader

Comment by Silhouette | Hacker News Reader

Again - extraordinary claims require extraordinary evidence.

It's no secret that there are groups actively looking for new exploits and that sometimes vulnerabilities are discovered that become zero days. It's a good bet that police and security services take an active interest in those vulnerabilities when they are found.

But that's very different to claiming the police can easily unlock any device any time they want to and there is a range of private companies around who provide that service to them.

View on HN

It's not extraordinary at all. Ron Wyden, a US Senator subject to special briefings, basically repeated the same thing when asked about federal backdoors:

  "As with all of the other information these companies store for or about their users, because Apple and Google deliver push notification data, they can be secretly compelled by governments to hand over this information," Wyden wrote.

https://arstechnica.com/tech-policy/2023/12/apple-admits-to-...

Push notifications for e2e messaging apps carry e2e encrypted payload, which can’t be decrypted unless Apple reads the private keys from those apps sandboxes…

In the case of iMessage/iCloud, it seems like that already happens: https://s3.documentcloud.org/documents/21114562/jan-2021-fbi...

That document appears to be over 4 years old, predating the availability of Apple's Advanced Data Protection system that claims to provide proper E2EE on most iCloud back-ups. The latter was controversially the subject of a specific legal attack by the British government using the Investigatory Powers Act resulting in Apple withdrawing the feature entirely from the UK market rather than compromise the security of their system - according to public reports anyway. Before ADP much of the data stored in iCloud backups was not fully end-to-end encrypted and Apple itself did not claim otherwise.

Those apps generally distribute keys, and E2E is if no help unless you validate those keys out of band. Do you, really?

Then there are all the ways, both white and varying shades of gray, of installing software in the end devices. That's your primary threat right there.

I'm going to assume they are referring to any cloud backups of said devices. Since they are stored on servers managed by not you and are unencrypted, able to be accessed for "national security reasons".

There’s nothing extraordinary about the implications of what was said.

There is nothing extraordinary about a claim that multiple commercial organisations routinely and reliably defeat the security of modern devices on behalf of law enforcement - something that would clearly undermine numerous public claims about the security and privacy of those devices made by their manufacturer? You and I have very different ideas of what is extraordinary!

Multiple vendors advertise and sell devices and software to crack iPhones, they have for years. In the US, any decent size city or county sheriff has access to one. State level forensics labs probably have several types.

The manufacturer provides the means to bypass many of the cheaper tools, but few people use them.

There are more exotic tools that can bypass security controls. These are more niche and not generally available to law enforcement. There may be some crossover when counter-intelligence interfaces with law enforcement. (Ie. FBI, DEA, RCMP, ICE, etc)

I like the term exotic tools like they aren’t utilizing GovCloud…

Multiple vendors advertise and sell devices and software to crack iPhones, they have for years.

Yes they do. Now name one that works consistently against a fully patched modern iPhone.

Reply on news.ycombinator.com