Even with all the recent "featuritis" on the software side the unchanged simplicity of Apple's business model makes me totally fall in love with them again.
Tim Cook is the only one doing the right thing here.
back
1 comments
> Tim Cook is the only one doing the right thing here.
Because it was Tim Cook who was dragged into this mess. What if the shooter had an Android phone, rather than an iPhone? I'm sure Lary Page would be penning a similar letter, in that situation.
Hah, that's a laugh. If it were an Android phone, the feds wouldn't have had to call anyone. They'd have just broken the device's security and gotten what they wanted.
Only Apple takes security seriously.
I would wager that the FBI and CIA are technically capable of breaking the security on this phone. This is likely more about setting legal precedent via a case that is very much in the public eye.
I very much doubt that. These agencies are very capable of operating outside of the law if it will get the job done. All a stunt like this does is raise public awareness, limiting their options. They wouldn't do that unless they couldn't get it done via other means.
Only the fact that this is a terror case makes them willing to roll the dice at all on the craps table of public opinion. It gives them an advantage, but not an overwhelming one.
Well for a million + they could delaminate the chips and read the private keys off them in a painstaking way.
But that is incredibly risky; it would be easy to make a mistake, and if they do, the information is gone forever, which is the worst case scenario for them.
I absolutely believe that the FBI thinks this is the only way to get this data.
Yes, they might like to get a strong precedent in favor of this, but what if the precedent goes against them? You never know what you're going to get in court. This would be appealed to the 9th Circuit, which has a history of being skeptical of government arguments in favor of collecting digital data. And if the Supreme Court deadlocks 4-4 (as it could now), the appellate ruling would stand.
It seems like many people don't get the concept of evidence preservation.
Apple put in a feature, which they may circumvent, that will effectively brick the device if it is tampered in certain ways. The lowest risk option for retrieving the data is to get the people who designed the device to implement their circumvention method. That is exactly what the FBI asked for and what the judge agreed to.
Why should the FBI have to waste resources reverse engineering Apple's product (and risk destruction of evidence) when Apple is wholly capable of helping out?
using their magical AES breaking powers?
From Apple's letter [1]:
> Specifically, the FBI wants us to make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation. In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession.
> The FBI may use different words to describe this tool, but make no mistake: Building a version of iOS that bypasses security in this way would undeniably create a backdoor.
So it's not a matter of technical impossibility.
if the gov were capable of doing this themselves they would have done it already
For Apple it's not impossible. The government can't push updates to a phone without the necessary keys.
This is a recent development. Apple only started to care about iOS security around 2012 for example.
Oh really? iOS has page-based executable code hash/signing since at least iOS 2 (2008); Android still doesn't have any runtime code integrity protections.
Of all the random security issues in the past 8 years you'd be hard pressed to find one where this was relevant.
At least someone is.
In a complex system great security takes years of work, it isn't flipped on like a light switch in v1.0. Wasn't the first version of iOS running as the root user?
Yeah! That's why you can't even jailbreak every single one of their phones!
Sad but true
This is one of those citations needed statements. I have played with cyanogen with LUKS, luks nuke (a simple password that destroys the keys), firewall and tor without google services. And you can even make yourself a dead man's switch that will erase the keys dd if=/dev/zero - you know the drill if some condition is not met.
The best part - even if google can make custom version of the OS it won't help the least.
It is a tough nut to crack.
Of course you can secure your own device yourself.
But if you buy Apple you won't have to.
And in that case FBI will load their custom OS and open it. The entropy provided by the user in the apple current security solution is just too little for the device to not be vulnerable.
Apple tried to do it by providing also their own key, but that helps little when a dedicated agency has physical access to the device. And legal hammer to compel Apple to spill the beans.
This article explains the situation nicely:
http://blog.trailofbits.com/2016/02/17/apple-can-comply-with...
The short answer is, Apple compensates for the low entropy of 4 digit PINs by rate-limiting the number of guesses you can make.
But that is the root of the problem. Apple can control how the system is unlocked, they can update it, so they are able to circumvent their own measures. I wouldn't be surprised if they are able to do it with secure enclave too.
So apple didn't provided their users security. They provided security with potential backdoor in the design.
So I say - it is good if FBI can force apple to exploit their own backdoors - to learn their lesson.