How can Apple strengthen key retrieval routines so they won't be ordered to mod - Page 1
Forum section: electronics / general

author: JoeN
author_rank: Frequent Contributor
timestamp: February 18, 2016, 02:31:40 am
content: firmware in the future?What the FBI seems to be asking Apple to do is to create a version of firmware that can be uploaded to the iPhone such that either 1) attempts to decode the encryption key with the password doesn't delete the encoded encryption key after 10 failed attempts or 2) allows the FBI to get a copy of the encoded encryption key so they can just attack it externally on dedicated hardware. It seems the only reason that Apple can do this for the FBI is because their phones are field programmable. Obviously they must be. Maybe no one else can mod the firmware and upload it, but Apple technically can do that and now a court is going to make them do it.How about a hybrid setup where the MCU implements a encode store encryption key opcode (parameters: the password and the encryption key) and a retrieve encryption key opcode (parameters: The password), but no opcode to retrieve the encoded encryption key at all. The key is stored into memory cells in the MCU totally separate from flash, and these memory cells are completely unaddressable except implicitly by these two opcodes. And of course those memory cells are protected by the best technology possible to protect them, as well as the current 20nm process which must be a bitch to probe. Now the MCU allows for encoding and storing the encryption key, retrieving the encryption key (with the right password), deleting the encoded encryption key after n tries, creating no way of stopping this behavior in software, and allowing no way to retrieve the the encoded encryption key by software.The only think I don't see is how the retrieve encryption key opcode can know if a decoding of the encryption key was successful or not. Salt the key with a known value? If an attacker was able to decap the chip and actually get the encoded encryption key, would this wreck security? I would think that it would still depend on if the password was strong or weak, a strong password would still hold up. Any ideas? What do you think of the whole debacle?

author: Halcyon
author_rank: Unknown
timestamp: February 18, 2016, 02:41:41 am
content: Quote from: JoeN on February 18, 2016, 02:31:40 amI agree with the reasons behind why the court has made the order but as for the ramifications, I'm not sure yet. I think the majority of the population won't care too much. But in the next 10-20 years I definitely think this sort of thing will become the norm and it's something we will have to expect if we want to keep living the lives we are and expect law enforcement to be there to pick up the pieces when things go bad.As much as I wouldn't like the idea of my handset having a 'backdoor', the benefit outweighs any paranoia I have. There is really nothing on my handset which I wouldn't show to a family member, a friend or a colleague. If people are worried about having their privacy breached and someone stealing their dick pics and naked photos, well perhaps they should re-think what they store on their phones. Those who have a reason to be worried more often than not are those with something to hide.

author: dannyf
author_rank: Super Contributor
timestamp: February 18, 2016, 02:42:07 am
content: 'What do you think of the whole debacle?'Apple is following the Holder doctrine - if you don't like a law, don't follow it.The same thing is happening in some states, like Maryland.

author: jwm_
author_rank: Frequent Contributor
timestamp: February 18, 2016, 02:43:35 am
content: you are describing something similar to thishttps://en.wikipedia.org/wiki/Trusted_Platform_Modulewhich your PC probably already has and you can modify linux dm-crypt to use it for key storage if that is what you want.there are also a whole bunch of individual chips that do that sort of thing and are tamper resistant.an issue is if the phone/device is destroyed, you cannot recover the encrypted backup even if you know the passcode/key, this would probably be a dealbreaker for using them in cell phones.

author: Muxr
author_rank: Super Contributor
timestamp: February 18, 2016, 02:53:33 am
content: I commend them for it. They take the security of their devices and privacy of their customers seriously and they walk the talk.Juniper Networks had recently been embarrassed by a discovery of a backdoor in their VPN products. The very devices that are supposed to provide security are the ones with an intentional security weaknessJuniper Networks just did it thinking it wouldn't be exposed. There is no telling the kind of damage this has had on both the Juniper in terms of future revenues and on their customers whose information was compromised in the process. I know that my company will not be buying Juniper products anymore.If a company which specializes in security solutions will do something as stupid as this, there is no telling who else has done it.

author: Bud
author_rank: Super Contributor
timestamp: February 18, 2016, 02:55:47 am
content: For those who missed it here is a link to a copy of the court order documenthttps://regmedia.co.uk/2016/02/17/apple_order.pdf

author: rrinker
author_rank: Super Contributor
timestamp: February 18, 2016, 03:07:59 am
content: Can't support Apple here. There is a valid court order for this, this is not just some government agency trying to spy. The warrantless wiretaps and stuff like that is utter crap, but now you go and get a proper warrant and they STILL won't open up? Now you are just flaunting the law. Extract the requested data and turn it over, you don't have to reveal HOW you extracted it.

author: JoeN
author_rank: Frequent Contributor
timestamp: February 18, 2016, 03:21:09 am
content: Quote from: rrinker on February 18, 2016, 03:07:59 amJust to be clear, because one court somewhere issued one order doesn't mean anyone has to do anything just yet. There is generally a right to appeal in the U.S. It's not a privilege. It's there for the obvious reason - not all courts are of the highest quality, and especially so on issues that are fairly novel.Anyway, what my post is more about if Apple can or should moot the point by making the proposed solution technically impossible in future releases. As far as I know, it would not be illegal to do so under current law and Apple has already gone three quarters of the way down this road. As for the current issue, if the courts order it, after appeals are exhausted, it will be done. But all this order does (assuming Apple can write firmware to do this) is eliminate the brute-force protection, when court-ordered, for current devices. This does not decrypt the device, it just makes it more likely a brute force decryption will eventually succeed.

author: jwm_
author_rank: Frequent Contributor
timestamp: February 18, 2016, 03:28:04 am
content: Quote from: rrinker on February 18, 2016, 03:07:59 amIt is not a proper warrant if there is no law to back it up. You can't just get a warrant for anything and it has to happen or the prosecutor can just bypass any protection laws. And in this case, it is very questionable whether there is any law that lets them enforce this warrant.

author: Muxr
author_rank: Super Contributor
timestamp: February 18, 2016, 03:28:12 am
content: Quote from: rrinker on February 18, 2016, 03:07:59 amFBI is not asking Apple to deliver information Apple has.Tim Cook > "When the FBI has requested data that’s in our possession, we have provided it. Apple complies with valid subpoenas and search warrants, as we have in the San Bernardino case. We have also made Apple engineers available to advise the FBI, and we’ve offered our best ideas on a number of investigative options at their disposal."They are asking for a version of iOS which bypasses the security "a backdoor".Tim Cook's own words > "Specifically, the FBI wants us to make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation. In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession.The FBI may use different words to describe this tool, but make no mistake: Building a version of iOS that bypasses security in this way would undeniably create a backdoor.And while the government may argue that its use would be limited to this case, there is no way to guarantee such control."I agree with him.You can read the full thing here:https://www.apple.com/customer-letter/

author: retrolefty
author_rank: Super Contributor
timestamp: February 18, 2016, 03:29:55 am
content: Quote from: rrinker on February 18, 2016, 03:07:59 amWithout the rule of law any rights are pretty much useless. If a proper warrant is issued then Apple should comply if they can, which isn't yet clear to me. If Apple can but won't comply then the judge should hold Mr. Cook in contempt of court and order his personal appearance before him to face charges.

author: JoeN
author_rank: Frequent Contributor
timestamp: February 18, 2016, 03:39:01 am
content: Quote from: retrolefty on February 18, 2016, 03:29:55 amThat will happen if the court order is found valid. It depends on what the appeals court does next.If Mr. Cook believes in what he wrote above, it would be logical to moot the point by implementing the anti-brute force attack in hardware rather than software as I proposed. It completely follows the exact thinking that he laid out and it is 100% legal to do so.

author: ajm8127
author_rank: Contributor
timestamp: February 18, 2016, 03:42:04 am
content: Quote from: Halcyon on February 18, 2016, 02:41:41 amThis is how I feel as well. If you have information that you cannot let anyone else know, DO NOT store it electronically.Electronic communication evolves so rapidly I think it is hard for the courts to keep up. If courts in the US can compel Apple to help break the encryption, then it sets a precedent for all courts I think. However, the perpetrators of the San Bernardino shooting committed an atrocity. It's like a search warrant. If the judge deems there is enough evidence to issue a warrant then your right to privacy in your home gets violated. I think it is well beyond reasonable doubt these individuals committed murder. I don't see how a warrant can be issued to search your crawl space or under your bed but your electronic devices are off limits. Surely if the FBI found a journal they would read it. If it was encrypted they would decode it.I think it is up to the device makers to figure out how to protect customer data but still comply with court orders. I think people are living in a fallacy if they think there can be complete security in electronic devices.

author: Muxr
author_rank: Super Contributor
timestamp: February 18, 2016, 03:42:24 am
content: Quote from: JoeN on February 18, 2016, 03:39:01 amWas thinking that as well. This will surely motivate them to remove any responsibility in the future by just implementing it in hardware.

author: linux-works
author_rank: Super Contributor
timestamp: February 18, 2016, 03:48:48 am
content: any attempt by ANY government to compromise the security of EVERYONE's data (infrastructure) is not a legit law; it would never have come from the people, it does not represent the wishes of the people and actually makes the whole world LESS safe.I stand by tim cook and we should not supply bad governments with tools that will end up repressing all of us.this does not serve any common good.and I'm not ruled by fear. think-of-the-children style arguments are less than useless, at this point in time. we are tired of the same old power-grabs and we are not falling for it!

author: Muxr
author_rank: Super Contributor
timestamp: February 18, 2016, 03:55:14 am
content: Quote from: ajm8127 on February 18, 2016, 03:42:04 amThis laissez-faire attitude about privacy is pretty annoying. As someone who's had my identity stolen I can tell you it sucks balls, I've been dealing with it for years, I cannot describe to you what a pain in the ass it has been.The thing is it's impossible to keep your information private when your private information is required to get things done. If you're buying a car, a house, your private information you don't want stored electronically is being stored electronically by your mortgage company or your car dealer weather you like it or not.That's the thing with security and privacy, you never know all the ways it can be abused until it's abused. And you really have no control over it. The only thing you can do is lobby for more security. Our lives increasingly revolve around internet, and this trend will continue to grow. Asking companies to make backdoors only sets bad precedents.Apple has resources to fight it, but a smaller company would either fold or just comply because they couldn't fight it.This company no longer exists because their entire business model revolved around keeping their users data private:https://en.wikipedia.org/wiki/Lavabit

author: rrinker
author_rank: Super Contributor
timestamp: February 18, 2016, 03:57:25 am
content: A special backdoor compromised OS version, no, I do not agree with that. By "turning over the data" I mean they should just give Apple the phone in question, let Apple extract the data through whatever proprietary methods they (likely) have, and turn over the recovered data. Not the method for recovering the data. Just the data in question.It's this secret government back door business that leads to warrantless surveillance. Or worse, "OK, we no longer will do warrantless wiretaps" because we don't have to, we have other ways that we don't even have to tell you about.

author: AndyC_772
author_rank: Super Contributor
timestamp: February 18, 2016, 07:29:45 am
content: Quote from: JoeN on February 18, 2016, 02:31:40 amTherein lies the very simple solution. Firmware updates not accepted unless phone is unlocked.I'm surprised that's not already the case TBH.

author: lassi
author_rank: Newbie
timestamp: February 18, 2016, 08:03:19 am
content: they already have done a better version.iphone 5C in question doesn't have the new feature/chip so on that deviceit is possible to do what the fbi is asking.it's even trivial - for an apple sw engineer one day at maximum. the only hard part is having the source for the firmware and signing key so the phone accepts it. on iphone 5C the code to wipe the key from the cpu is included in the firmware that you can update, on later models it is not.iphone 5s/6 onwards they have a chip that holds the encryption key, on 5C it's on the cpu and can be queried endless times if the phone firmware allows for it and the phone firmware can be updated at boot, presumably to help recover in case of bad firmware update.to sum it up, iphone 5c doesn't have whats called secure enclave, 5s has it and it has a hardware/firmware suicide for wiping the key on too many tries. it is unknown if it is possible to change the firmware on that chip or if it is burned in, but it is irrelevant to the case at hand. now why apple is refusing? normal people would not understand the difference and they would think that apple can open any iphone despite them advertising that they can't. apple can open any iphone prior to and including 5C though.and also they could in future be forced to feed in updates to ios that make the feature not work correctly on 5s forwards.

author: Halcyon
author_rank: Unknown
timestamp: February 18, 2016, 08:22:07 am
content: Quote from: AndyC_772 on February 18, 2016, 07:29:45 amIt is on Android. It'll check periodically for updates and ask you before installing. I don't even think "automatically install" is even an option.

author: dannyf
author_rank: Super Contributor
timestamp: February 18, 2016, 11:26:03 am
content: "Firmware updates not accepted unless phone is unlocked."Bingo. Automatic updates are really the biggest backdoor on any smart device.Apple is being overly dramatic here, for publicity and for marketing I guess. The fed seems to be asking for a special OS to flash to this device, not all future devices, as apple is alleging.They could have asked a little bit more nicely - like asking apple to provide the content of the phone, not to handle over the special OS to the FBI.

author: KM4FER
author_rank: Regular Contributor
timestamp: February 18, 2016, 02:11:03 pm
content: Thoreau is well known for his writings on nature and self-Reliance but it is my opinion that his most important work is an essay that goes by various titles, one being "On Civil Disobedience."I applaud Apple and Mr. Cook for standing by his convictions.Earl

author: free_electron
author_rank: Super Contributor
timestamp: February 18, 2016, 03:09:27 pm
content: This phone belonged to terrorists that blew themselves up. Unlock it. In my book all terrorists deserve to have a nuclear missile shoved up their ass and shot into space.These guys are dead anyway. so no privacy issue.

author: dannyf
author_rank: Super Contributor
timestamp: February 18, 2016, 03:59:54 pm
content: "This phone belonged to terrorists "Actually the phone is a work phone that belongs to his employer who I assume has happily given the fed consent for a search.I suspect apple is more motivated by marketing rather than concerns for privacy, for their users or a dead terrorist.

author: djacobow
author_rank: Super Contributor
timestamp: February 18, 2016, 04:15:52 pm
content: Quote from: free_electron on February 18, 2016, 03:09:27 pmThese particular terrorists were killed in a shootout with the cops. Too bad, as having them alive would have been much better for the subsequent investigation. There would have been plenty of time for justice later.

author: wraper
author_rank: Unknown
timestamp: February 18, 2016, 04:39:21 pm
content: Quote from: free_electron on February 18, 2016, 03:09:27 pmWould be good if it worked this way. Today too many freedom/free speech limitation, spying on individuals and similar awful things happen under the umbrella of fighting terrorism. Today they might use it against particular terrorists, tomorrow they'll use it against you.

author: Marco
author_rank: Super Contributor
timestamp: February 18, 2016, 04:40:37 pm
content: Quote from: dannyf on February 18, 2016, 02:42:07 amThey are not following someone who thinks He Is The Law.

author: Ian.M
author_rank: Super Contributor
timestamp: February 18, 2016, 04:41:13 pm
content: If any evidence is recovered from the phone, the Feds have to be able to provechain of custodyhas been properly kept. Otherwise they cannot use the evidence to build a case against other suspects or even to get a warrant, so can only use it to help target further investigations. Therefore it wouldn't be unreasonable for them to require Apple to provide forensic tools so they can extract the data they need in-house rather than handing the device over to Apple.However the court has bent over backwards to maintain the general public's privacy rights as the court order allows Apple to provide the access at one of their facilities, which would mean that the forensic tools would never leave Apple's control. Also the tools requested are required to be entirely RAM resident, so although they might contain a core of code from iOS, they would not be capable of replacing the iOS on a device, and also the court required that the tools be specific to the subject device, i.e. they wont work on any other phone, (presumably to keep the courts in control of such access in future). Therefore Apple's response is pure F.U.D.

author: Marco
author_rank: Super Contributor
timestamp: February 18, 2016, 04:44:30 pm
content: Quote from: rrinker on February 18, 2016, 03:07:59 amFinding an exploitable weakness in their implementation is probably a man year of a 5 digit salary engineers work, with no guarantee of success within that time frame.Give it to the NSA and let them spend the money to attack it on the hardware level.PS. changed my response after reading the order, not reading Ian's response, which I only noticed now ... he is right though, the Judge gave them leeway.

author: Ian.M
author_rank: Super Contributor
timestamp: February 18, 2016, 04:52:58 pm
content: Quote from: Marco on February 18, 2016, 04:44:30 pmNot at all. Court Order clause 5:QuoteAlso, *IF* Apple have so few competent engineers that tying one up on paid government work for as long as it take would be an unreasonable burden on their business (LOL), they are entitled to seek relief under clause 7.

author: zapta
author_rank: Super Contributor
timestamp: February 18, 2016, 04:59:23 pm
content: Quote from: Marco on February 18, 2016, 04:44:30 pmIt may be a red herring. Government has the ability to break it but doesn't want to expose means and methods.

author: Ian.M
author_rank: Super Contributor
timestamp: February 18, 2016, 05:01:11 pm
content: Exactly. Involving the NSA spooks is a major problem. Either you don't get evidence usable in court, or if chain of custody is preserved, and its used in court, that means a significant NSA capability has just been publicly disclosed. For all we know, the NSA may already have cracked the encryption on an image of the phone's FLASH, and the Feds just need Apple to give them access to the same data in a form they can use in court.

author: Marco
author_rank: Super Contributor
timestamp: February 18, 2016, 05:02:34 pm
content: Quote from: Ian.M on February 18, 2016, 04:52:58 pmEngineers are not interchangeable, even if they hire someone new he's going to try to run to the original team all the time for insight. You could not let him, but that would explode the time necessary.Here's a lab, a couple million LoC of relevant verilog, C code and some iPhones, have fun. It would probably be easiest for Apple to just do this and forget about it, hire someone famous so they can't be accused of not making a best case effort.

author: tooki
author_rank: Super Contributor
timestamp: February 18, 2016, 05:21:39 pm
content: Quote from: JoeN on February 18, 2016, 02:31:40 amThey already did this in newer models. In those, the passcode delay and auto-erase (by throwing away the encryption key) are enforced in the Secure Enclave chip, which is a separate security MCU running its own OS, so iOS cannot circumvent it or even read from it. And it DOES require the passcode to install system updates via the normal methods. (Not entirely sure about DFU mode though.)In iOS 8 and later, with or without a Secure Enclave in the phone, the encryption key is the combination of the user passcode and a long device key. In devices without Secure Enclave, iOS handles all of this. With Secure Enclave, it's out of iOS's hands completely. If you have it set to erase after 10 attempts, Secure Enclave will discard the key and that's the end of it, period.Instead of speculating, look for Apple's iOS security guide - they explain it in detail.The court order itself sounds fairly reasonable. The issue is the floodgates it opens. As a current AAPL shareholder and former employee, I am extremely glad that Apple is following through with the privacy commitments it made over a year ago, and is fighting this tooth and nail.The issue is twofold IMHO: 1) it sets precedence for law enforcement to demand companies create custom product that they expressly do not want to make. 2) even if Apple made it, built it to check the specific hardware serial number, and only used it internally (e.g. invited FBI agents to use it on Apple premises only), it would now be known that Apple has the source code for this, and once it exists, other agencies or governments (such as hostile ones we do business with) could demand Apple share that source code with them.

author: free_electron
author_rank: Super Contributor
timestamp: February 18, 2016, 05:29:30 pm
content: Quote from: wraper on February 18, 2016, 04:39:21 pmthese guys are dead already. there is no privacy issues. dead people don't have rights.

author: tooki
author_rank: Super Contributor
timestamp: February 18, 2016, 05:32:34 pm
content: But living people do, and this is a landmark issue in whether we have any civil liberties left going forward.

author: SeanB
author_rank: Super Contributor
timestamp: February 18, 2016, 05:37:26 pm
content: Fine to give them the access, but any back door will be abused. Think Edward Snowden, but working for a criminal group instead, and grabbing data off phones to use for blackmail, emptying your bank account ( but it was authorised from your own phone with your own login so we will not refund you anything, and you owe us $xxxx as well on the sudden overdraft you now have, plus costs of $xx and interest at Usury rate compounded daily. Please pay immediately or we will have you in debtors prison by the end of the day) or using it as a near untraceable relay for all sorts of non legal activity.Or you go on holiday and get thrown in prison because you did something that was against the law in the other country. Like chewing gum, or talking to an unmarried woman without her father present, or holding hands, being non heterosexual, or not following religious law, or wanting to meet the Dalai Lama, or eating beef, or pork, or any number of things.

author: Monkeh
author_rank: Super Contributor
timestamp: February 18, 2016, 05:41:52 pm
content: Quote from: free_electron on February 18, 2016, 05:29:30 pmBut I'm not dead. Why should access to my data be given away?

author: SeanB
author_rank: Super Contributor
timestamp: February 18, 2016, 05:45:05 pm
content: Quote from: free_electron on February 18, 2016, 05:29:30 pmThe phone has been communicating data, and this metadata already has been intercepted and stored, which is known. Thus you do know who, when and where all of this "non privacy infringing" metadata was generated, so while you do not have the actual information you know precisely who was communicated with, so you can ask them for a copy of the data. The metadata is as useful, and even more usable, than just the data. It is the context of a subject being trailed, everything he did and everybody he walked past, bought from, talked to, shared a book passage with, sat next to on a bus, went into a hotel room with, just not the actual whispered endearments only. The rest is good enough to get a divorce and lose all your assets, or to get placed in prison for life for gang violence.That they are dead does not mean the metadata is useless, it has been collected and stored, just the Government does not want to disclose how much actually has been stored. The actual data itself is almost a footnote only.

author: MT
author_rank: Super Contributor
timestamp: February 18, 2016, 06:03:36 pm
content: Quote from: free_electron on February 18, 2016, 05:29:30 pmActually they do, such as native burial grounds, holy sites, archaeological issues, burial procedures, cemetery laws etc.

author: JoeN
author_rank: Frequent Contributor
timestamp: February 18, 2016, 06:10:07 pm
content: Quote from: Ian.M on February 18, 2016, 05:01:11 pmIt seems these guys were probably communicating with someone out of the country. If that is the case, courts do not matter. Americans have rights not to be targeted by our government. The rest of the world's people, not so much.

author: free_electron
author_rank: Super Contributor
timestamp: February 18, 2016, 06:13:11 pm
content: Quote from: Monkeh on February 18, 2016, 05:41:52 pmthat's not what i'm saying.i'm saying : in this case : these guys are dead. no privacy issue.Dump the flash memory off the phone and decrypt it. it should be possible to make a piece of software to strip the datablocks out of the flash.then simply decrypt those. come on this is not exactly rocket science... they have the hardware. make a flash image ,throw on computer and do a brute force attack. you don't even need to boot the phone. these are simply toshiba or samsung flash chips. power up the phone in DFU and dump the sectors as is.

author: Monkeh
author_rank: Super Contributor
timestamp: February 18, 2016, 06:16:32 pm
content: Quote from: free_electron on February 18, 2016, 06:13:11 pmIf you give them the ability to decrypt one phone, you give them the ability to decrypt all of them. This is data they do not own and have no right to decrypt.

author: free_electron
author_rank: Super Contributor
timestamp: February 18, 2016, 06:24:25 pm
content: so if apple doesn;t do it : there is nothing preventing the FBI to go after an attempt.

author: donmr
author_rank: Regular Contributor
timestamp: February 18, 2016, 06:39:30 pm
content: Quote from: Ian.M on February 18, 2016, 04:41:13 pmHow does the FBI (and Apple) PROVE that the new special OS didn't modify any data?The only way I can see to do that is to provide the defense and their experts with all of the source code, the documentation and access to the hardware in its UNMODIFIED original state.I suspect that instead of this they are just hoping for useful information and that they can find independent evidence once they know who these people are.

author: MT
author_rank: Super Contributor
timestamp: February 18, 2016, 07:03:41 pm
content: The reason FBI asks/force Apple:http://motherboard.vice.com/read/the-fbi-cant-find-hackers-that-dont-smoke-pot

author: Ian.M
author_rank: Super Contributor
timestamp: February 18, 2016, 07:15:04 pm
content: If it can be shown that the forensic utility has not changed the flash memory contents (i.e. device images extracted by direct probing, while holding the processor in reset), and the utility code and build toolchain is reviewed by independent experts in the field, the defence would then have to challenge the competence of the experts - which would be much harder to do. The defence would also have to show that the Apple employee(s) responsible for creating the forensic tool could reasonably have been aware of what the Feds wanted to find at the time the tool was built, and would have had motivation to code the utility to falsify the data returned in spite of the serious risk to their professional reputation and continued liberty due to forging data required by court order.

author: dannyf
author_rank: Super Contributor
timestamp: February 18, 2016, 11:15:42 pm
content: A couple of questions with thinking about.1. Can a 3rd party, related or unrelated, be compelled to perform by the government? If you are a locksmith, and government wants to break into a house. Can they compel you to open up the lock? I tend to think the answer is no. Apples position on this has my sympathy.2. What is the FBI asking? It seems to me that apple isn't telling the truth here. The FBI is asking for a piece of software that will circumvent a security feature on this phone that will erase its content if an incorrect passcode is inputed more than 10 times. The ask is specific to this phone and the ask is not about having a back door to the OS - at the most one may consider the ask to be adding a back door to the specific instance of iOS as installed on this particular phone. The FBI could have beenore artfully in their ask.Legally I guess apple will likely win, on the first argument. However, to the common good, I hope apple is nice enough to help the fed. I suppose cooks perspective might be different if some of the victims were apple employees.

author: JoeN
author_rank: Frequent Contributor
timestamp: February 19, 2016, 12:44:01 am
content: Quote from: free_electron on February 18, 2016, 06:13:11 pmNot likely. It's encrypted with the huge random key, not the passpharse. Not enough computing power in the universe to do what you want to do (using human technology). The attack is to get the passphrase to get the key and then decrypt with the key.

author: dannyf
author_rank: Super Contributor
timestamp: February 19, 2016, 12:21:45 pm
content: QuoteThere is actually a case from 1789 that's exactly the same as the apple vs. fbi case here. Unless Apple can overturn that case, law is on the side of the fbi.

author: Stray Electron
author_rank: Super Contributor
timestamp: February 19, 2016, 02:12:48 pm
content: Quote from: Muxr on February 18, 2016, 03:28:12 amMuxr is exactly right. Just one one of the problems with these kind of exceptions are they that they don't expire. It's the same with write taps, once they have permission to tap a line, then they consider that they're able to go back and tap it again at anytime even if an entirely different party is now using it. ALSO the FBI has never been known for playing by the rules (Fast and Furious if you need an example). If the FBI were to be given the broken OS that they're asking for, you can be sure that it would become a standard tool in the bag of tricks and it would be used from then on WITHOUT asking for a warrant. I'm sure that this is exactly the scenario that Apple is worried about. Third thing, if any of you have ever studied the history of code breaking in WW-II then you know that given the original plan text and the encrypted copy of the same message then it's a relatively easy to figure out the encryption process. Once you've done that then they are able to read everyone's messages, just as the US and Britain were able to read very nearly ALL of Japans and Germany's encoded messages for the rest of World War II.As much as I want to agree with the FBI in this particular case, I have to say that they WOULD abuse the process once it's in their hands. And not just the FBI, If they had it, the NSA would have it, the CIA would have it, the Mossad would have it, British MI-6 would have it, etc etc etc. AND worse, the unscrupulous politicians such as the Clintons would have it. The US has a long history of politicians using the FBI and it's resources, to investigate, smear and threaten their political enemies.In this case, the easiest way to deal with this would be for the FBI to turn the phone over to Apple and let them decrypt it and to deliver the original text back to the FBI.. But it appears to me that the FBI is using this case as an OPPORTUNITY to learn how Apple's encryption works.

author: linux-works
author_rank: Super Contributor
timestamp: February 19, 2016, 02:25:34 pm
content: ALL of the world's authority figures have shown that they are not able to handle this kind of responsibility and there is a 100% chance that it will be abused and used against non-criminals.this power is too great (like nuclear bombs) and should be given to NO ONE. period. full stop.the 'think of the children!' and 'terrorist!' arguments are pure distractions. the real issue is: not allowing the spymasters even more power than they already stole.

author: dannyf
author_rank: Super Contributor
timestamp: February 19, 2016, 03:11:07 pm
content: QuoteBut that's not the fed is asking. The phone will wipe itself clean if an incorrect passcode is used more than 10 times. What the wanted to do is to disable that feature so they can try all the combinations as they can.That probably doesn't qualify as a "broken OS".The fed is being incredibly in-artful in articulating their ask and Apple is spinning this thing for maximum publicity. and joe the public is buying, unfortunately.

author: tooki
author_rank: Super Contributor
timestamp: February 19, 2016, 03:25:35 pm
content: It's not about this one dead dude's phone. It's about the dangerous precedent it sets, and the Pandora's Box it opens with respect to other governments.And yes, providing a way to stop password entry delays is definitely "broken", since that's one of the most basic steps in securing a password based system.

author: langwadt
author_rank: Super Contributor
timestamp: February 19, 2016, 03:48:08 pm
content: Quote from: dannyf on February 19, 2016, 03:11:07 pmI'd consider an OS that allows you to brute force a 4 digit pin as brokenFBI a case they could spin as "OMG evil terrorists help us", if Apple give in it'll soon be Hollywood wanting phones opened tocheck if some teen has downloaded the lastest Biever album

author: dannyf
author_rank: Super Contributor
timestamp: February 19, 2016, 04:17:11 pm
content: Quoteapple doesn't have to give in.But there is a draft legislature in congress that would make companies making unbreakable encryption a criminal. So apple may just have to live with the consequences of its decisions.I find it unconscionable for any not helping the authorities tracking down those responsible for the heinous acts or to prevent those heinous acts. I understand why others may have concerns.But a perfect solution exists: we can always split up the country / world where unbreakable phones are sold and where unbreakable phones are banned. I would be happily living in the 2nd world.

author: mtdoc
author_rank: Super Contributor
timestamp: February 19, 2016, 05:26:53 pm
content: Quote from: free_electron on February 18, 2016, 05:29:30 pmI think you've missed the point - which thankfully Tim Cook made clear: Once you've created a way to unlock the phone, you cannot uncreate it. What is known cannot later be unknown. The knowledge will be out there and there will be nothing stopping it from being used in the future against anyone the government (or criminals if they get their hands on it) wants to target.In this country the right to privacy is enshrined in The Constitution which supercedes any single judges opinion or order. This case, if upheld, would create a precedent that would then allow the government to not only unlock any phone's encrypted data but also then embolden them to order any tech company to assist them anytime they decide they need help accessing someones private information.

author: helius
author_rank: Super Contributor
timestamp: February 19, 2016, 05:56:08 pm
content: I'd be very surprised if the needed keys couldn't be accessed using FIB or DPA techniques. Electronic security features only go so far: with physical access and enough time, you can bypass anything, eventually. That's why truly important secrets are never allowed to be taken from physically secure facilities, no matter what encryption is used. The FBI doesn't want to use these tools, because they leave permanent destructive evidence. They want a way to bypass security quickly without leaving any trace, and that's what they ordered Apple to give them.Can a phone be designed so that firmware updates can't bypass its security features? Yes, using the techniques of hypervisors and process isolation. The hypervisor would be a permanent, read-only program, and it would not allow security policy code to be changed, only the part of the OS that runs the rest of the phone's features.

author: dannyf
author_rank: Super Contributor
timestamp: February 19, 2016, 06:05:21 pm
content: QuoteIt is also highly questionable whether evidence obtained this way is admissible in a civilian court.

author: chris_leyson
author_rank: Super Contributor
timestamp: February 19, 2016, 06:15:04 pm
content: And now John McAfee is getting some publicityhttp://www.bbc.co.uk/news/technology-35611763

author: PedroDaGr8
author_rank: Super Contributor
timestamp: February 19, 2016, 06:34:40 pm
content: Quote from: free_electron on February 18, 2016, 03:09:27 pmThis is exactly how they chip away at civil liberty. Find a heinous case (usually terrorism or child porn/abuse) so that the public sayas yeah sure they deserve it, but they never ever limit it to those cases. Year by year, its scope gets broadened more and more, bit by bit. Eventually, all police departments (as well as most cyber criminals) will have this software. It is much like civil forfeiture, which was meant to go after big time drug dealers and mob bosses, now it is used on people speeding if they have something that the local police force wants.

author: Rick Law
author_rank: Super Contributor
timestamp: February 19, 2016, 07:23:45 pm
content: Quote from: PedroDaGr8 on February 19, 2016, 06:34:40 pmPedroDaGr8, very well put!I too want to get the terrorist. One of the premise that our sense of justice is build upon is "rather let a guilty get away than risking an innocent being convicted." In that spirit, if to catch a few terrorist means giving up privacy for all, letting a few terrorist who assisted in this terrorist act stayed hiddenfor nowis the lesser of two evils. In other words, I view this "chipping away" as unnecessary and the bigger evil.That said, if one of my loved ones becomes a victim of the future acts of one of these "would have been caught" terrorists, I may regret supporting Apple in this case.

author: mtdoc
author_rank: Super Contributor
timestamp: February 19, 2016, 07:37:10 pm
content: Benjamin Franklin's famous quote comes to mind:"Those who would give up essential liberty, to purchase a little temporary safety, deserve neither liberty nor safety."

author: dannyf
author_rank: Super Contributor
timestamp: February 19, 2016, 07:44:10 pm
content: ", I may regret supporting Apple in this case"That's why it is always easy to say no when don't have the skin in the game.

author: chris_leyson
author_rank: Super Contributor
timestamp: February 19, 2016, 08:06:34 pm
content: Physically what are we talking about, reading some flash chip or chips. You don't need software, just read the chips direct. ATE pin drivers will overdrive anything and everything. What's so difficult about getting a few ones and zeros out of a piece of Silicon. Maybe the NSA acting stupid so as not give anything away. Just thinking from a hardware point of view.

author: dannyf
author_rank: Super Contributor
timestamp: February 19, 2016, 08:13:02 pm
content: QuoteYeah. and I'm sure the government has a lot more capabilities at their disposal that could have gotten to the phone. They probably wanted to take a short cut via the 1789 case and didn't expect Apple to put up such a public fight.In the end, both parties are going to get hurt badly in this, with justice for the victims and future victims being sacrificed.

author: chris_leyson
author_rank: Super Contributor
timestamp: February 19, 2016, 08:28:33 pm
content: QuoteDannyf I got to agree with you wholeheartedly there, you hit the nail on the head man.

author: langwadt
author_rank: Super Contributor
timestamp: February 19, 2016, 09:01:20 pm
content: Quote from: chris_leyson on February 19, 2016, 08:06:34 pmreading the flash is easy but the content is encrypted with out the key it is useless even to NSAThe key only exist inside the phone hardware and cannot be read

author: Kleinstein
author_rank: Super Contributor
timestamp: February 19, 2016, 09:18:16 pm
content: It's very old case law, this order seems to be based on. So given the importance, it is correct that Apple want's to challenge this order, because of the possible consequences. Maybe they change there mind if the supreme court has made up it's mind on this.As you can see from the discussions this is not a simple subject and can have important consequences.

author: Rick Law
author_rank: Super Contributor
timestamp: February 19, 2016, 09:28:14 pm
content: Quote from: dannyf on February 19, 2016, 07:44:10 pmRegret does not equal a change of mind. It would still have been the right choice, I would regret the cost I must pay.Quote from: chris_leyson on February 19, 2016, 08:28:33 pmI think the last part of the comment "with justice for the victims and future victims being sacrificed"missed the nail entirely. We have no evidence that justice for victims in the future will not be pursuit vigorously. So we cannot say "justice for the victims and future victims being sacrificed."What we give up are: (1) name of accomplices of this crime, (2) potential information on this crime, and (3) potential information of future crimes. It is the justice for this crime not being fully served but not justice for a future crime.In not getting additional information from the phones about future crimes: Yes, we are adding some risk - the same conceptual "added risk" every time when a convict leave the prison after serving his sentence. A convict has a higher probability of committing a new crime than average non-criminals. Yet we should not keep the same prisoner locked up for life just because he may commit another crime in the future. Future is future, we deal with it when a crime has been committed.SinceJohn McAfee (of McAfee anti-virus) already offered to break into that specific phone for freeand he said on-air he coulddo it in three weeks, I doubt the FBI would take much longer than 3 weeks to do the same. So, I am highly suspicious of the FBI's motive here in requesting a modified IOS.John McAfee offered to do it "in three weeks" here:http://video.foxbusiness.com/v/4764707572001/mcafee-there-has-never-been-a-backdoor-thats-been-kept-secret/?playlist_id=937116503001#sp=show-clipsand offered to do it here:Quote from: chris_leyson on February 19, 2016, 06:15:04 pm

author: dannyf
author_rank: Super Contributor
timestamp: February 19, 2016, 09:31:42 pm
content: The sad thing is that the government's position and apple's aren't that too far apart -> there are plenty of ways to get what the government wanted without raping apple's publically stated position.Unfortunately, the government took a pretty heavy handed approach and apple decided it is better to spin this thing crazy. They are behaving like two little boys.

author: dannyf
author_rank: Super Contributor
timestamp: February 19, 2016, 09:34:43 pm
content: QuoteHard to know what you are giving up if you don't know what you are giving up. No one knows for sure what's in that phone right now.QuoteThat's assuming McAfee's assertion is credible. At this point, anything believing in him I think is not credible.

author: mtdoc
author_rank: Super Contributor
timestamp: February 19, 2016, 09:38:22 pm
content: Quote from: AcHmed99 on February 19, 2016, 09:29:59 pmCorrect. Keeping the public in a state of constant fear about terrorism serves their purposes. This is a key example. They are using this tragedy and public fear as a tool to further erode privacy and civil liberties. They want access to all data, all the time. They see encryption as the enemy.As Edward Snowden pointed out with this tweet: ""The @FBI is creating a world where citizens rely on #Apple to defend their rights, rather than the other way around"

author: Keyrick
author_rank: Contributor
timestamp: February 20, 2016, 02:56:21 am
content: Even if the company is forced to comply (I don't see this as happening), it will not matter. As soon as they do what the feds want, some software company in say, India or Russia, will come up with an "APP" that will do the same thing. Then every business, individual, and criminal will download that "APP". We will be back to square one, only this time the US government will have little sway with a sovereign nation that refuses to comply.The Gov just needs to give this one up, as it has 4th amendment abuses written all over it.

author: JoeN
author_rank: Frequent Contributor
timestamp: February 20, 2016, 03:32:54 am
content: Quote from: Kleinstein on February 19, 2016, 09:18:16 pmNot only that, but this is a novel interpretation of that case law.

author: dannyf
author_rank: Super Contributor
timestamp: February 20, 2016, 02:35:21 pm
content: QuoteI agree. The original ruling does not make a lot of sense to me. And overturning it now has a lot of positive implications for conservatives - i can see multiple areas where this can be used against the government.

author: beaker353
author_rank: Unknown
timestamp: February 20, 2016, 09:05:30 pm
content: After speaking with a family friend that deals with IP and security law I think Apple is very smart to call the FBI/DOJ out. As it was explained to me, Apple cannot under any current law be FORCED to design and handover a software tool to any government entity that provides little or no ROI to Apple. Just like except under very specific war circumstances a government entity can't walk into a manufacturing facility and force the facility management and its owners to stop making the parts/pieces they are making money on and start building parts/pieces for the government without payment. The FBI and the DOJ can throw everything they have at Apple, but you can't force a company to produce something for you. Pretty straight-forward law.-EM

author: dannyf
author_rank: Super Contributor
timestamp: February 20, 2016, 09:46:28 pm
content: QuoteYou may want to avoid using that family friend of yours: unless apple gets it overturned, there are more than a couple precedents / prior rulings where the government can compel a 3rd party to perform, in exactly the same case as the government is trying to get apple to do.

author: Jeroen3
author_rank: Super Contributor
timestamp: February 20, 2016, 09:49:17 pm
content: Apple is mainly defending their own market. And as a direct side-effect the people of theunited statesworld with this.If Russia/China were to acquire said technology, which does not seem veryunlikely, they'd be able to use it on every iPhone they can get their hands on. Such as in searches at the airports.And many other countries would want this capability too. It has huge value. When this happens, Apple's market would collapse.It's a spy tool that needs to be area51 level secret, if ever made. That secrecy is now already blown.Apple already provided the iCloud data. Anyone using the overnight backup and claim the government can't search their phones are very wrong.

author: edy
author_rank: Super Contributor
timestamp: February 23, 2016, 01:30:27 am
content: I have listened to Steve Gibson and Leo Laporte on the "Security Now" podcast (twit.tv) talk about this for a while now. It seems that people who are asking for a way to break a code or get in to a phone are not understanding the mathematics of encryption and that it is just not possible to have good encryption mathematically yet at the same time allow government agencies (or anyone else for that matter) in through a backdoor type mechanism. They are incompatible.If Apple has designed the system properly, there can be no back door. The existence of a back door means that there is a flaw in the encryption software and it is therefore no good to anyone. If FBI wants to hack into a phone, and they don't know the 4-digit security code and afraid that it may render the device useless after 10 tries.... they are asking Apple to modify the system to allow the combination to be entered forever. That way they can brute-force hack the phone by trying all 10,000 combinations of 4 digits (0000-9999) until they crack in to the phone.Let's assume Apple does it, and word gets out that it is possible. The "math" is already available to the public and has been analyzed by cryptographic experts and mathematicians. Pick up a book, learn to program and implement the algorithms yourself if needed. The code is open-source. The software is available on mobile, on PC, everywhere... You can enable strong encryption if you want to and someone can just use that on an "unlocked" phone to hide stuff inside of files anyways. So what good is it to be able to get into the phone when a criminal can just hide stuff in encrypted apps/folders using 3rd party software?Then you have BlackBerry, Windows Phone, Android... are all of them going to be forced to ban encryption software from their App stores? You can side-load your own apps anyways, forget the stores. The tools are there, you can buy older hardware and not update it, keep the old OS's that don't have this government-imposed backdoor. It is simply ludicrous to ban encryption, our entire Internet eCommerce depends on it anyways. You need to have strong cryptography for so many useful things that to ban it is throwing the baby out with the bathwater.Finally, the argument that less or no encryption and back doors will lead to less terrorism or catching more criminals is completely insane. If people know their phones are bugged or can be easily opened by police, then hackers and criminals will also be able to easily open them. Criminals and terrorists will use other methods to do what they need to do.Anyways, that's my 2 minute rant after I saw again on CNN that the government is trying to force Apple to hack this phone, which they clearly can't if they actually implemented their security software properly. If they didn't, then they will admit a huge problem on their part and open the way for hackers to use this tactic (which will need to be kept secret) to find the exploit as well. And then you have Donald Trump calling to boycott Apple as well... he's pandering to the uneducated public for votes! Unbelievable!I, for one, am sticking with my old BlackBerry which even if the government wants to hack, made it's core business model security-based. Just use an old dead OS with strong encryption and 3rd party tools that nobody has a clue on how to use as they are so rare it is tough to find an expert on it.Speaking of which... Anyone remember what happened to TrueCrypt?https://www.grc.com/misc/truecrypt/truecrypt.htmNobody knows to this day what happened... they were shut down and the newest version pushed people to migrate over. The source had been studied and went through several audits. No smoking gun was found, as far as I know. Yet the web site got changed abruptly one day, no warnings, all old copies eliminated and that was the end of it. Claims that it wasn't secure and that people should change it. It couldn't be fixed? What gives?Conspiracy theories abound... VeraCrypt apparently fixed the so-called vulnerabilities but conspiracy theorists wonder if it actually a big ruse to make people migrate over from TrueCrypt to VeraCrypt which does indeed have weaknesses intended to allow government in.

author: Jeroen3
author_rank: Super Contributor
timestamp: February 23, 2016, 06:51:45 am
content: Someone, IT-chief in a large company, has been ordered to enable the bitlocker feature on company computers. He straight out told the board if they knew what they were getting into, because even they cannot access the data without the key.To this day, once a month, some poor guy comes in and, unable to access his data. They cannot help him.Then the boss of the poor guy call it, "don't play games with us, just use the master key", but there is no such thing....Then the boss of the boss calls, "unlock the data, of send it to some company who can", who also has to be given a "not possible" answer.Yet, no government request was ever made to have Microsoft help open a bitlocker encrypted disk...[insert aluminum foil picture again]

author: dannyf
author_rank: Super Contributor
timestamp: February 23, 2016, 12:00:22 pm
content: "word gets out that it is possible."Wouldn't it be naive for anyone, let alone some nasty non confirmative types, to assume whether it is or is not possible based on apples actions?

author: dannyf
author_rank: Super Contributor
timestamp: February 23, 2016, 12:05:41 pm
content: End of the day, we as a society of law should think about if we should let individual corporations and their shareholders, through their ceos, to decide how our privacy should be guarded. Apple today mya decide one way, it may decide a different way some other days.If privacy is that important to us, we should let the legal system decide, not apple or Google or any other corporation.From that perspective I think the legal stuff surrounding the case is good. Unfortunately justice for the victims got caught up in this.

author: edy
author_rank: Super Contributor
timestamp: February 23, 2016, 03:12:06 pm
content: Quote from: dannyf on February 23, 2016, 12:05:41 pmThat's the whole reason Apple changed the encryption methods in the latest iOS so that they wouldn't have to comply anymore with FBI requests to help them decrypt anything. Once you let loose a system that you no longer have any control over, you can ignore all requests to help because you are as helpless as the next person. You can't argue with the mathematical rigidity of the system. So far as in vulnerabilities of the physical hardware are concerned, if they implemented it right then it would be no easier for them to find than FBI or any other hacking group for that matter.... But even if they could explain to FBI all of their proprietary methods and give them the keys and source code to iOS, Apple would have the expertise to do the necessary code changes without having to train a team of programmers from FBI on the inner-workings of the entire iOS encryption system.If Apple does comply with FBI and does find a way to crack the phone more easily (by changing the firmware or installing an iOS version that reduces the wrong password delay time and allows infinite attempts) this "tool" will be in the hands of the US government. If it is kept in the hands of Apple only, I'm not sure if that is any better to be trusted. Once terrorists know this, then they will find another software-only encryption system or use a different platform. How does that help secure the world?Apple is closed enough they can remove all encryption apps from their App store, but Android and BlackBerry and other mobile OS's can fill the void. And at least I know that I can code, compile, sign and side-load my apps using my developer keys on those devices no problem. And the math code and methods are out in the open. BlackBerry has no doubt been pursued as well over the years to unlock phones when they were more popular.Remember MegaUpload?https://en.wikipedia.org/wiki/Mega_(service)#History. Kim Dot Com? He was in Australia and got raided by FBI or some other US government agency and was shut down. The older Mega site was not as strongly encrypted and they could argue that Mega knew what was going on and was complicit in helping huge amounts of copyright infringement. They couldn't extradite him to the US so he fled to New Zealand set up a new Mega (mega.co.nz) which he coded in such a way that NOBODY has the master keys for, at all. That way, he cannot claim to know what anyone is harboring on the site and can deny any responsibility. It is acting as an intermediary or service provider.In as far as it is nice to police the world, the US is not the only democratically elected government on the planet. And there are plenty of people who prefer to have strong encryption available (especially in countries that have dictatorships). One man's terrorist is another man's freedom fighter. It is the tactics that differ, but the motives may be the same. My point is, EVEN if you could get rid of all encryption from the system itself, terrorists and other criminals will find a way to use 3rd party software and add it back.Meanwhile, perhaps there are other options to reduce terrorism-related attacks than weakening everyone's encryption EXCEPT terrorists and other criminals who will find a way to get around it anyways. I think they are barking up the wrong branch of the safety tree and using this case to set a precedent to force public opinion.[Tin foil hat time]

author: dannyf
author_rank: Super Contributor
timestamp: February 24, 2016, 11:52:50 am
content: QuoteYou are giving too much credit to apple.QuoteYou probably remembered the facts wrong.

author: Mechanical Menace
author_rank: Super Contributor
timestamp: February 24, 2016, 12:17:37 pm
content: Quote from: dannyf on February 23, 2016, 12:05:41 pmI'm sorry but I fail to see how at all. The way I dee it is depending on your viewpoint seeing as the perpetrators are already dead justice for the victims has either already been dished out or isn't possible because corpses don't get a day in court. So how exactly does this impinge on justice for the victims?

author: dannyf
author_rank: Super Contributor
timestamp: February 25, 2016, 01:56:44 am
content: 'How can Apple strengthen key retrieval routines so they won't be ordered to mod 'A more interesting question would be if apple or anyone else for that matter had made a device that's unbreakable even by its manufacturer and such device became a standard issue for the terrorists, can the OEM be charged with aiding and abetting?Like Toyota and their trucks.

author: retrolefty
author_rank: Super Contributor
timestamp: February 25, 2016, 02:10:04 am
content: Quote from: Mechanical Menace on February 24, 2016, 12:17:37 pmSimple, to find out if they had any other person(s) aided and abetted them in their deadly deed. If there were then victims would surely want justice for them. To me it's a case of FBI having a valid search warrant and only wanting access to the one phone. The rest is mostly tin foil hat and slipper slop worriers. Lots of stuff I don't like about our present government but issuing valid search warrants obtained via probably cause, approved and issued by a judge is not one of them.

author: JoeN
author_rank: Frequent Contributor
timestamp: February 25, 2016, 02:34:39 am
content: Quote from: dannyf on February 25, 2016, 01:56:44 amLink to Toyota being charged with aiding and abetting? I'll wait right here.

author: Sal Ammoniac
author_rank: Super Contributor
timestamp: February 26, 2016, 02:49:07 am
content: Quote from: rrinker on February 18, 2016, 03:57:25 amApple doesn't stand accused of any crime in this case, so why should they be compelled by a court to perform any action whatsoever?

author: mtdoc
author_rank: Super Contributor
timestamp: February 26, 2016, 04:40:26 am
content: Quote from: Sal Ammoniac on February 26, 2016, 02:49:07 amIn particular why should they be forced to comprimise the privacy and security interests of hundreds and millions of people.?Apple made this point in their legal brief.QuoteQuoteQuoteQuoteQuote

author: zapta
author_rank: Super Contributor
timestamp: March 29, 2016, 03:02:47 am
content: FBI vs. Apple problem solved.http://www.npr.org/sections/thetwo-way/2016/03/28/472192080/the-fbi-has-successfully-unlocked-the-iphone-without-apples-help

author: Skimask
author_rank: Super Contributor
timestamp: March 29, 2016, 04:19:33 am
content: <tin foil hat>Or so "they" say "they" have...</tin foil hat>Not a conspiracy theory type guy by any stretch, but, suppose it's entirely possible they're just saying that so the hackers out there will get on the job thinking that there really is a way around it. Some hacker somewhere actually does it, posts it. The gov't grab the info needed. Saves time, money, effort. I know...those last 3 are unlike any gov't anywhere.Profit???

author: GEuser
author_rank: Frequent Contributor
timestamp: March 29, 2016, 06:08:41 am
content: At least its fair .Now Apple is not safe either .

author: Halcyon
author_rank: Unknown
timestamp: March 29, 2016, 06:12:27 am
content: Quote from: edy on February 23, 2016, 03:12:06 pmCorrect. Android and Blackberry did this a long time ago. Essentially negating themselves of liability and putting the onus back on the user. In Australia, a court can order a person to reveal passwords, encryption keys etc... If they refuse to comply, they can be jailed. I'm sure similar laws exist in the USA, UK etc...Apple, Google, Blackberry, Microsoft, can all legally and legitimately throw their hands up in the air and say "we don't know".As for the FBI "not longer needing Apple's assistance", I'd believe it. Anything up to and including Apple iPhone 4 passwords could be broken with a click of a button with nothing more than a laptop and USB cable.

author: JoeN
author_rank: Frequent Contributor
timestamp: March 29, 2016, 05:30:00 pm
content: Quote from: Halcyon on March 29, 2016, 06:12:27 amYerhonor. I am not refusing to reveal my password. As I have maintained from the beginning, I have been locked out myself for several weeks because I choose a very complex password for security sake and then promptly forgot it. I have revealed everything I can remember about that password. O0

author: RGB255_0_0
author_rank: Frequent Contributor
timestamp: March 29, 2016, 07:02:10 pm
content: Quote from: zapta on March 29, 2016, 03:02:47 amI found it hilarious that Apple wants the FBI to share how it was broken so they can fix it. Surely that's like asking the person who burgled your home how to make it safe?

author: Zero999
author_rank: Super Contributor
timestamp: March 29, 2016, 07:09:23 pm
content: Quote from: Halcyon on March 29, 2016, 06:12:27 amThat's an interesting law. I'm not aware of any similar laws in the UK.It might still be in the accused's interest not to hand over the password, if the penalty for not doing so, is lesser than what one would get due to the evidence on the phone.And what if the owner of the phone was dead or brain damaged and genuinely couldn't remember the password?

author: hamdi.tn
author_rank: Frequent Contributor
timestamp: March 29, 2016, 07:20:51 pm
content: Quote from: Hero999 on March 29, 2016, 07:09:23 pmbrain damaged and dead ppl can't be charged and don't pass time in jail even if accused and found guilty.

author: dannyf
author_rank: Super Contributor
timestamp: March 29, 2016, 07:33:30 pm
content: "In Australia, a court can order a person to reveal passwords, encryption keys etc... If they refuse to comply, they can be jailed. I'm sure similar laws exist in the USA, UK etc"It such a law did exist, it would likely violate the first amendment (compelled speech) and the fifth amendment (self incrimination).

author: Zero999
author_rank: Super Contributor
timestamp: March 29, 2016, 07:37:29 pm
content: Quote from: hamdi.tn on March 29, 2016, 07:20:51 pmYes, that's true but if there was more than one person involved, there's still the issue of the phone and all of the information on it. If they could crack the phone and access the data, they might be able to get the other gang members.

author: Syntax_Error
author_rank: Regular Contributor
timestamp: March 29, 2016, 09:58:01 pm
content: https://www.google.com/?gws_rd=ssl#q=U.S.+law+compel+password+disclosure

author: dannyf
author_rank: Super Contributor
timestamp: March 29, 2016, 10:09:10 pm
content: Do we think Apple a winner of its battle with the fbi?The word on the street is that the technique used to hack the iPhone is the same as used by Street vendors in China to add flash to your iPhone : they will need to reprogram the same area where the password is held.Those guys charge less than 100 USD each and can do it for you for a couple hours on the spot.Apple said it would multiples of its highly talented enginners weeks to do it. And now they are begging the fbi to tell them the exploit.Couldn't have been a more ironic ending.

author: Halcyon
author_rank: Unknown
timestamp: March 29, 2016, 10:23:45 pm
content: Quote from: dannyf on March 29, 2016, 10:09:10 pmAnd good luck to them! The FBI won't give it up. Even law enforcement agencies are reluctant to share certain methodology among each other.

author: thm_w
author_rank: Super Contributor
timestamp: March 29, 2016, 10:53:25 pm
content: Quote from: dannyf on March 29, 2016, 10:09:10 pmThey said it would take weeks to make a custom requested version of the operating system to allow unlimited password attempts.There is no mention of how long it would take to exploit the phone (they may have known of other methods and didn't mention them).http://motherboard.vice.com/read/apple-reveals-the-manpower-and-time-it-would-take-to-comply-with-fbis-order

author: edy
author_rank: Super Contributor
timestamp: March 29, 2016, 11:10:25 pm
content: Apparently it is the NAND memory which contains either the counter, or key that gets wiped or both. The technique I've heard so far is that you obtain a NAND memory dump which is a "save" point. So if you reach a limit on the password and something gets erased or currupted, you can re-write the NAND dump back to the chip and "reset" yourself back to where you started from the time you first copied it (like an unlimited "save point" which you can always get back to).I suspect that if you save a series of NAND memory images as you try different passwords sequentially on a phone and then compare them, you may be able to detect the difference in bits at certain spots and figure out whether there was a counter or key that was modified or erased there. That may allow you to decode or at least narrow down what part of the NAND memory you want to restore, rather than try and restore the entire chip. Then you can just keep writing a few bits to the same area over and over to restore it back to the save point, while you continuously try passwords. In effect, having unlimited password tries.So do you physically have to remove the chip (desolder) to read and write the contents of the NAND, or can you rig it in such a way that you can use it in-circuit within the iPhone to carry out the read/write process by tapping in to certain areas on the circuit? And I assume you can address specific blocks within the memory so you only have to write a small portion to reset it, assuming most of the memory remains the same and only a counter/key portion is modified.This is an old article (2012) that may hint at what may still be possible:http://esec-lab.sogeti.com/posts/2012/06/28/low-level-ios-forensics.html

author: JoeN
author_rank: Frequent Contributor
timestamp: March 29, 2016, 11:40:25 pm
content: Quote from: dannyf on March 29, 2016, 07:33:30 pmThis is unsettled law in the US. Different federal courts have gone different ways and the Supreme Court has not addressed it yet.https://en.wikipedia.org/wiki/In_re_Boucherhttp://arstechnica.com/tech-policy/2015/09/forcing-suspects-to-reveal-phone-passwords-is-unconstitutional-court-says/The best way to approach this is not to refuse to give the password at all so there is never a question over whether or not the refusal is protected. Give up the password immediately. That is, give up a very complex but totally wrong password immediately and stick by the fact that the password is correct forever and either the investigators aren't entering it correctly, or you are mistaken in the password, but the password that was surrendered is in fact the best version of the password that you remember. The law is very clear on if you can be held for failing to produce something that you cannot produce, and that is you cannot be held. You cannot be subpoenaed for something impossible and then held because you cannot produce it.

author: RGB255_0_0
author_rank: Frequent Contributor
timestamp: March 30, 2016, 08:01:02 am
content: Quote from: JoeN on March 29, 2016, 11:40:25 pmBut if they find out you were lying, could they not then do you for perjury?

author: tooki
author_rank: Super Contributor
timestamp: March 30, 2016, 10:20:10 am
content: The whole issue with the AAPL vs FBI thing is that it's not about the one phone, and it never was. It's about the FBI's attempted end-run around the legislative, which in the past has expressly chosen tonotgrant law enforcement the right to dictate engineering requirements. Obviously law enforcement doesn't like this, so they're trying to establish precedent. But clearly law enforcement doesn't understand the greater repercussions of weakening encryption, as borne out by the fact that the same government's intelligence community (whose own job it is to break encryption) is opposed to it.

author: dannyf
author_rank: Super Contributor
timestamp: March 30, 2016, 10:59:53 am
content: QuoteAnd would have cost them the opportunity to bargain.It is really a missed opportunity for all: we could have gotten the case to the highest court and maybe even get new laws out of this. Now, we default to the old case where the government is able to compel a 3rd party to perform, which seems to be quite odd in a democracy.

author: tooki
author_rank: Super Contributor
timestamp: March 30, 2016, 11:15:54 am
content: Quote from: dannyf on March 30, 2016, 10:59:53 amOh, this was no accident. The FBI suddenly can use a "new" method that was actually known for months before the trial? Literally two days before the trial? No, the FBI knew precisely that if this went to trial, they had the losing argument, and would establish precedent that works against them. (Most likely, they never guessed that Apple and the public would put up such a fight.) So they withdrew so that no precedent is set. This means this issue will be decided either by precedent in a future case, or by Congress deliberating and creating a new law (again, no guarantee of it being in the FBI's favor, but better chances than this court case would have had).I suspect that either way, this will eventually end up before the Supreme Court, since the constitutionality of compelled work by a third party is highly questionable.

author: JoeN
author_rank: Frequent Contributor
timestamp: March 31, 2016, 08:19:09 am
content: Quote from: dannyf on March 30, 2016, 10:59:53 amI would think so. Of course that would require the action on your part of decrypting the contents after making the credible claim that you cannot and then also failing to make a good case of having "remembered" the code. Probably at that point if you have any brains at all you realize the content is obviously so radioactive you really do make a good effort to forget the password.