Apple's Arguments for Encryption Sound Very Familiar

[Talking Monkey]

Thought this was interesting. From Apple's letter to its customers (http://www.apple.com/customer-letter/):

"We can find no precedent for an American company being forced to expose its customers to a greater risk of attack. For years, cryptologists and national security experts have been warning against weakening encryption. Doing so would hurt only the well-meaning and law-abiding citizens who rely on companies like Apple to protect their data. Criminals and bad actors will still encrypt, using tools that are readily available to them."

[RoyGBiv]

I've avoided Apple products for a LONG time, due mainly to their closed systems. Their routinely obsoleting accessories with new models chaps my ass too.
My family understands that if they buy an Apple product, they have to provide their own tech support. :o

I hope Apple sticks to their guns on this one....

[Chance]

"We can find no precedent for an American company being forced to expose its customers to a greater risk of attack."

Then they didn't look. I would comment at length, but I've got things to do today. Suffice it to say tech companies have been walking a very awkward line for a long time, and the only difference in this case is that the court decision was headline news, so Apple couldn't duck under the radar.

[StraitR]

"It's for your own good, so we can keep you safe. You don't need that encryption. You don't need them guns. Stupid little people."

For some reason, this is all I hear.

ETA: My opinion is based on what I heard on NPR during my drive in to work this morning.

[farscott]

This whole case confuses me. Apple is refusing to unlock the phone. If it is an Apple 6 or older phone, the passcode is four digits unless the user reset the passcode once iOS 9 or later was installed. If it is a newer phone, the passcode is 6 digits as those phones all shipped with iOS 9 or later. It is my understanding that Apple regularly unlocks phones already, so what is the government asking to be done and what is Apple refusing to do?

The easiest way to unlock a phone is if it was connected to a PC or Mac with iTunes or if connected to iCloud. The processes to unlock phones in those cases are well understood. If the phone was never backed up to the iCloud or to a computer, it would be more difficult. That being said, that is very unlikely as Apple really pushes people to use the iCloud.

[StraitR]

This whole case confuses me. Apple is refusing to unlock the phone. If it is an Apple 6 or older phone, the passcode is four digits unless the user reset the passcode once iOS 9 or later was installed. If it is a newer phone, the passcode is 6 digits as those phones all shipped with iOS 9 or later. It is my understanding that Apple regularly unlocks phones already, so what is the government asking to be done and what is Apple refusing to do?

The easiest way to unlock a phone is if it was connected to a PC or Mac with iTunes or if connected to iCloud. The processes to unlock phones in those cases are well understood. If the phone was never backed up to the iCloud or to a computer, it would be more difficult. That being said, that is very unlikely as Apple really pushes people to use the iCloud.

Admittedly, I did not read the attached letter from Apple, so I could be talking about something completely different. My apologies if that's the case. What I'm referencing is the .gov's attempt at getting manufacturers to dumb down the encryption so they can be more easily spied on. And in that case, it's not just an Apple issue.

[Gadfly]

Perhaps next time the Police shoot someone, they should chop off the index finger and drop it in the freezer. Then, they had a pass key for the phone.

[JDM]

Perhaps next time the Police shoot someone, they should chop off the index finger and drop it in the freezer. Then, they had a pass key for the phone.

It is my understanding the fingerprint reader won't function with dead tissue.

[Chance]

This whole case confuses me.

The problem is that users can set a feature which will delete the contents of the phone if someone enters the wrong pass code too many times. With hard drives, permanently deleting data is hard to do, but with solid state drives, it's fairly trivial. So if the FBI trips that fail safe, the data are gone for good. You're correct about the iCloud, but disabling the phone pushing the data to the cloud is pretty straightforward.

The government ordering such backdoors be installed into systems has been going on for years, but it usually goes through the Foreign Intelligence Surveillance Court, which is why it's rarely discussed in public. Apple is putting on a big show because they're in the spotlight, not because the order is without precedent.

This could be an existential threat for Apple, and I expect them to fight tooth and nail to the bitter end. There is nothing inherently superior about Apple products, and they've been beaten at their own game many times over, despite what their fanboys will shriek at you. Apple is all about image, and the whole "Think Different" culture their mindless drones think they have. (I'm not the biggest Apple fan, if you can't tell.)

If Apple gives even the slightest suggestion that they've helped "The Man" oppress the masses, poof. Their social conscious fan base would convince themselves they're being socially conscious with another company.

[Peally]

Apple products are a royal pain in the ass when you're dealing with more than 5 of them. I can't think of a worse enterprise level device that I've ever used.

[Luke]

Perhaps next time the Police shoot someone, they should chop off the index finger and drop it in the freezer. Then, they had a pass key for the phone.

Who uses an index finger? I though the right thumb was the go too?

Even more off track: you can store multiple finger prints, I have me, my wife, and my daughter. Been meaning to do the left thumb as well.

[TCinVA]

This whole case confuses me. Apple is refusing to unlock the phone. If it is an Apple 6 or older phone, the passcode is four digits unless the user reset the passcode once iOS 9 or later was installed. If it is a newer phone, the passcode is 6 digits as those phones all shipped with iOS 9 or later. It is my understanding that Apple regularly unlocks phones already, so what is the government asking to be done and what is Apple refusing to do?


All data on the more recent iPhones is encrypted. On an encrypted drive/device, you need a key to actually make the encrypted data sensible so it can be used. This passkey is accessed when the pin number is entered correctly on the phone.

Cracking the pin isn't a problem. The .gov has big computers that can brute force a pin code in relatively short order. Brute forcing...guessing combinations of numbers until you hit the right one...is done all the time. Especially by hackers and criminals.

Knowing this, and knowing how often these devices are stolen and the kind of important data they contain, Apple designed it's later versions of iOS so that if someone inputs the wrong pin 10 times, the passkey for the encryption on the device is deleted. This, in effect, completely obliterates all the data on the device.

Apple does not have a way around this. If you forget your pin code and do not have a backup of your phone's data in the cloud or on a computer via iTunes or something similar, you are SOL.

The FBI appears to suspect there is data on this specific phone that has not been backed up to a computer or the cloud. They want Apple to give them software that would allow them to get around the brute force pin limitation described earlier. Apple does not have such a thing, according to them, and if they were to invent such a thing it would allow access to millions of iPhones...not just this one.

[farscott]

The problem is that users can set a feature which will delete the contents of the phone if someone enters the wrong pass code too many times. With hard drives, permanently deleting data is hard to do, but with solid state drives, it's fairly trivial. So if the FBI trips that fail safe, the data are gone for good. You're correct about the iCloud, but disabling the phone pushing the data to the cloud is pretty straightforward.

The government ordering such backdoors be installed into systems has been going on for years, but it usually goes through the Foreign Intelligence Surveillance Court, which is why it's rarely discussed in public. Apple is putting on a big show because they're in the spotlight, not because the order is without precedent.

This could be an existential threat for Apple, and I expect them to fight tooth and nail to the bitter end. There is nothing inherently superior about Apple products, and they've been beaten at their own game many times over, despite what their fanboys will shriek at you. Apple is all about image, and the whole "Think Different" culture their mindless drones think they have. (I'm not the biggest Apple fan, if you can't tell.)

If Apple gives even the slightest suggestion that they've helped "The Man" oppress the masses, poof. Their social conscious fan base would convince themselves they're being socially conscious with another company.

It is my understanding that without the passcode, one can connect the phone to a PC/Mac with iTunes, create a backup of the phone with the encryption not used, reset the phone to factory default, and restore the phone. That is the workaround that Apple has used in the past to "unlock" phones. Has that feature been deleted in the current versions of iOS?

[TCinVA]

Perhaps next time the Police shoot someone, they should chop off the index finger and drop it in the freezer. Then, they had a pass key for the phone.

The fingerprint scan capable devices work in a more complicated manner than that. If the fingerprint has not been used in 48 hours, for example, the phone will require entry of the passcode to work.

https://support.apple.com/en-us/HT204587

So instead of chopping off the finger, the best thing they could do is unlock the phone on scene ASAP with the dead guy's finger.

...but you have to guess the right finger. After 5 tries the phone will no longer accept a fingerprint and will require a passcode entry.

[Chance]

All data on the more recent iPhones is encrypted.


It is my understanding that without the passcode, one can connect the phone to a PC/Mac with iTunes, create a backup of the phone with the encryption not used, reset the phone to factory default, and restore the phone. That is the workaround that Apple has used in the past to "unlock" phones. Has that feature been deleted in the current versions of iOS?

I stand corrected. TCinVA's explanation is why just copying the data to a different computer won't work.

[TCinVA]

It is my understanding that without the passcode, one can connect the phone to a PC/Mac with iTunes, create a backup of the phone with the encryption not used, reset the phone to factory default, and restore the phone. That is the workaround that Apple has used in the past to "unlock" phones. Has that feature been deleted in the current versions of iOS?

Old versions of iOS were not encrypted.

More recent versions of iOS are.

It is possible to restore from a backup, assuming one exists, but doing so will lose data that is on the device. That's not really a problem for your average home user. It's kind of a big deal for a forensic analyst looking for precisely that data in an investigation.

I don't know the iOS code so I can't say for certainty that Apple has no way around the encryption setup they have on the device...but I'm inclined to believe that they don't because they have no real interest in designing a system with a back door because the back door becomes the primary point of entry for malicious attacks.

A court order cannot magically undo the design of the system.

Depending on exactly how the code actually works, it may be utterly impossible for Apple to push software to the phone that will disable the self-destruct safety mechanism. Updates can be downloaded to the phone OTA, but those updates still require permission to actually install...which is a good design feature to help prevent malicious code from executing. There wouldn't be a way to grant such an update with the phone in a locked state.

[JHC]

The FBI appears to suspect there is data on this specific phone that has not been backed up to a computer or the cloud. They want Apple to give them software that would allow them to get around the brute force pin limitation described earlier. Apple does not have such a thing, according to them, and if they were to invent such a thing it would allow access to millions of iPhones...not just this one.

From the read of Apple's letter; for this to be the case (access to millions of iPhones) would not those iPhones have to have installed the prototype OS they are being requested to build with a back door? The letter specifically mentioned building the FBI a copy of the OS with the back door. I didn't think Cook really explained how that prototype OS would get installed across the world.

IMO I think this is 90% marketing on Apple's part.

[JV_]

An interesting thought on this issue:

5985

[Chance]

From the read of Apple's letter; for this to be the case (access to millions of iPhones) would not those iPhones have to have installed the prototype OS they are being requested to build with a back door?

Yes, but that's not the point. The point is the hack exists, and if Apple can break their own system, then other parties theoretically could as well.

[JHC]

Yes, but that's not the point. The point is the hack exists, and if Apple can break their own system, then other parties theoretically could as well.

I'm sure someone can and will one day. The point is marketing for sure. Not defense of liberty. And obviously not defense of life.

[JV_]

It is my understanding the fingerprint reader won't function with dead tissue.Here is the workaround: http://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid

TC mentioned other issues, like the 48h timeout.

[Drang]

...So instead of chopping off the finger, the best thing they could do is unlock the phone on scene ASAP with the dead guy's finger.

...but you have to guess the right finger. After 5 tries the phone will no longer accept a fingerprint and will require a passcode entry.
Emphasis due to the fact that biometric readers generally require that the digit be at body temperature, which means that freezing and thawing could get... messy.

During my brief tenure as an office temp at Microsoft someone (I think from the Microsoft Gun Club, but I'm not sure) experimented and found that one could "forge" fingerprints for about a $10 investment in materials. It took some technical skill, but it can be done.

[TCinVA]

From the read of Apple's letter; for this to be the case (access to millions of iPhones) would not those iPhones have to have installed the prototype OS they are being requested to build with a back door? The letter specifically mentioned building the FBI a copy of the OS with the back door. I didn't think Cook really explained how that prototype OS would get installed across the world.


Now you're getting into very technical territory.

Apple might well be able to build a version of iOS that will get around their previously created self-destruct sequence.

...but how does that get loaded on this guy's phone?

How do you completely replace the operating system of an encrypted device without destroying the data that is actually on the device?

I'm unclear how, exactly, they would accomplish this. They could try and push a disable of the self destruct feature like they push updates to the iOS, but those updates require user permission to actually install...which isn't possible if the phone is locked.

And that's if the demand here is for just this guy's phone and not a demand that Apple gives the authorities a sort of master key to unlock iOS on any device they want. Apple's argument may well be that the only way they can produce what the government wants is to create such a master key, a magic bullet that completely bypasses the security on the device...and every other device running the same software.

Courts are often really poor at this sort of deep technical stuff.

I don't know what specialists the government has on this problem, or how much those specialists know about the design of iOS and what it can/can't do or be made to do. I don't know what Apple's deep internal knowledge about their iOS tells them about what can and can't be done on this device.

[Drang]

I can't help but wonder if someone from the FBI has seen too many CSI/NCIS/Clone TV shows where the genius hackers break the encryption Just In Time and have forgotten that if it worked like that, their own tame genius hackers would already have done so.

Or, Everybody Knows that programmers always leave a back door.

Or, the FBI knows better, but the political pressure has gotten so strong they're stuck on stupid.

[TCinVA]

I can't help but wonder if someone from the FBI has seen too many CSI/NCIS/Clone TV shows where the genius hackers break the encryption Just In Time and have forgotten that if it worked like that, their own tame genius hackers would already have done so.

Or, Everybody Knows that programmers always leave a back door.

Or, the FBI knows better, but the political pressure has gotten so strong they're stuck on stupid.

Right.

The FBI has a number of technical specialists on staff in subjects ranging from biochemistry to accounting. They have computer forensic specialists, too...but how much those specialists know about the workings of iOS and what is and isn't possible with a suspect device like this one I cannot say.

I do know that there are shitloads of people in government and the courts who don't have the foggiest idea how technology actually works. Everyone remember the healthcare website? Yeah. That.

I'm assuming the FBI has smarter eggs than that working on this, and that those smarter eggs suspect that Apple could create something that would allow access to this phone. I'm also assuming that Apple is balking at the idea because if they invented a method of accessing this phone it would be a method of accessing ANY phone and that would be bad for their bottom line and for the millions of people who expect that their device is reasonably secure.

[JHC]

Now you're getting into very technical territory.

Apple might well be able to build a version of iOS that will get around their previously created self-destruct sequence.

...but how does that get loaded on this guy's phone?

How do you completely replace the operating system of an encrypted device without destroying the data that is actually on the device?

I'm unclear how, exactly, they would accomplish this. They could try and push a disable of the self destruct feature like they push updates to the iOS, but those updates require user permission to actually install...which isn't possible if the phone is locked.

And that's if the demand here is for just this guy's phone and not a demand that Apple gives the authorities a sort of master key to unlock iOS on any device they want. Apple's argument may well be that the only way they can produce what the government wants is to create such a master key, a magic bullet that completely bypasses the security on the device.

Courts are often really poor at this sort of deep technical stuff.

I don't know what specialists the government has on this problem, or how much those specialists know about the design of iOS and what it can/can't do or be made to do. I don't know what Apple's deep internal knowledge about their iOS tells them about what can and can't be done on this device.

Interesting, thanks! Yes.

Makes me wonder (I'm suspicious of Apple's ethics) if Drang's second "Or" might be the case they don't want out. It's pretty freaking cool to be selling the un-hackable OS.

[JV_]

How do you completely replace the operating system of an encrypted device without destroying the data that is actually on the device? Don't forget a potential hardware fix. Replace the hardware chip which is responsible for security policy enforcement (TPM'ish)?

[PPGMD]

The government ordering such backdoors be installed into systems has been going on for years, but it usually goes through the Foreign Intelligence Surveillance Court, which is why it's rarely discussed in public. Apple is putting on a big show because they're in the spotlight, not because the order is without precedent.

A back door that is available for the government, is available to everyone.

That is a huge security risk that Apple, or any other company for that matter, wouldn't want in their product.

[TCinVA]

Don't forget a potential hardware fix. Replace the hardware chip which is responsible for security policy enforcement (TPM'ish)?

True...I hadn't really considered that as a possibility.

[JV_]

That is a huge security risk that Apple, or any other company for that matter, wouldn't want in their product.It happens all the time. Every 6 months we hear about vendors hard coding keys. Telefónica de España was just caught putting identical SSH keys in thousands of devices.

http://it.slashdot.org/story/15/02/19/1445251/duplicate-ssh-keys-put-tens-of-thousands-of-home-routers-at-risk

[Chance]

I'm assuming the FBI has smarter eggs than that working on this, and that those smarter eggs suspect that Apple could create something that would allow access to this phone. I'm also assuming that Apple is balking at the idea because if they invented a method of accessing this phone it would be a method of accessing ANY phone and that would be bad for their bottom line and for the millions of people who expect that their device is reasonably secure.

Everything can be broken somehow, it's just a matter of time and ingenuity. My question is: how exactly is the government going to determine compliance? It could take years and years for such a hack to be composed, and it may only ever be an incomplete solution. So how long is the FBI going to sit around and wait, and what happens if/when they get impatient? Can the FBI compel Apple to bring in outside experts?


It happens all the time. Every 6 months we hear about vendors hard coding keys.

That's another interesting aspect. Apple doesn't build these things in a vacuum, so when other companies get involved, what happens then? Does Apple get carte blanche to all of their suppliers?

[PPGMD]

It happens all the time. Every 6 months we hear about vendors hard coding keys. Telefónica de España was just caught putting identical SSH keys in thousands of devices.

http://it.slashdot.org/story/15/02/19/1445251/duplicate-ssh-keys-put-tens-of-thousands-of-home-routers-at-risk

And a company that had bad management and/or lazy developers has to do with quality companies not purposely leaving exploits in their product how?

[TCinVA]

From the order:



2. Apple's reasonable technical assistance shall accomplish
the following three important functions: (1) it will bypass or
disable the auto-erase function whether or not it has been enabled;
(2) it will enable the FBI to submit passcodes to the SUBJECT DEVICE
for testing electronically via the physical device port, Bluetooth,
Wi?Fi, or other protocol available on the SUBJECT and (3) it
will ensure that when the FBI submits passcodes to the SUBJECT
DEVICE, software running on the device will not purposefully
introduce any additional delay between passcode attempts beyond what
is incurred by Apple hardware.

3. Apple's reasonable technical assistance may include, but is.
not limited to: providing the FBI with a signed iPhone Software
file, recovery bundle, or other Software Image File that can
be loaded onto the SUBJECT DEVICE. The SIF will load and run from
Random Access Memory and will not modify the on the
actual phone, the user data partition or system partition on the
device?s flash memory. The SIF will be coded by Apple with a unique
identifier of the phone so that the SIF would only load and execute
The SIF will be

on the SUBJECT DEVICE. loaded via Device Firmware

Upgrade mode, recovery mode, or other applicable mode

available to the FBI. Once active on the SUBJECT DEVICE, the SIF
will accomplish the three functions specified in paragraph 2.


So the government seems to think that Apple can create code that will allow running passcodes into the phone through the data port (or wirelessly), and run in some upgrade mode that will disable the self-destruct functionality of the OS, and that they can code it so that it only works on this particular phone.

...alrighty, then.

[Drang]

Don't forget a potential hardware fix. Replace the hardware chip which is responsible for security policy enforcement (TPM'ish)?

Ever use a STU-III?
The reason those are (were?) available so cheap is that the encryption chip was encased in (IIRC) lucite, and was un-removable. Take it out, destroy the phone. In this case, Uncle Sam had the means to re-program the chip, but (allegedly) no one else did. So, Mr. Corporate Bigshot could have a STU-III on his desk to speak securely to the Beijing Branch, and the only folks who could listen in were at Ft Meade.
(Embarrassing to be in what was allegedly a major intelligence facility and have the STU-III go down and not be able to get it replaced for months...)

[farscott]

Well, I had no problems connecting a locked iPhone 5 (not mine) to my iTunes account, creating a non-encrypted backup, and restoring that backup to an iPhone 6. That allowed me access to a copy of all of the data on the original iPhone 5. It may not be sufficient for court, but there is no issue accessing the encrypted data on the original phone.

As such, I am still confused as to what the government wants versus what Apple refuses to do.

[JV_]

And a company that had bad management and/or lazy developers has to do with quality companies not purposely leaving exploits in their product how?It happens to "quality" companies too. Juniper: http://www.wired.com/2015/12/juniper-networks-hidden-backdoors-show-the-risk-of-government-backdoors/

[PPGMD]

It happens to "quality" companies too. Juniper: http://www.wired.com/2015/12/juniper-networks-hidden-backdoors-show-the-risk-of-government-backdoors/

I have no idea what you are trying to prove because the Juniper Networks backdoor debacle shows exactly why companies don't want backdoors.

[JV_]

Backdoors are put in to products, on purpose, all the time. It's only "unauthorized" when they've been caught.

[JV_]

the court decision was headline news, so Apple couldn't duck under the radar.

A slightly interesting tangent. Sometimes the government already has the data, but they can't use the it in the public place (like a court case) because it could force their hand to reveal the method/source. The way around that is to force someone to provide you the data (in public), Apple in this case, so you can use it where needed.

[JDM]

This is the most interesting thread I can remember reading for a long time.

Thanks, JV for the link above.

[Malamute]

A slightly interesting tangent. Sometimes the government already has the data, but they can't use the it in the public place (like a court case) because it could force their hand to reveal the method/source. The way around that is to force someone to provide you the data (in public), Apple in this case, so you can use it where needed.

Is it also possible that they can in fact get in, but this is a smokescreen to make presumed bad guys think they are more secure than they truly are?

[PPGMD]

Backdoors are put in to products, on purpose, all the time. It's only "unauthorized" when they've been caught.

And when a company decides that it doesn't want to put one in due to all the issues other companies have had with back doors?

Yes it used to be common to put back doors in products. But that mindset was built when physical security is all you needed to be worried about to protect the contents of their systems. With the modern connected environment and professional hackers, back doors are now avoided by most companies.

If you came and asked me to put a back door in my product, I will tell you to piss up a rope.

[JV_]

back doors are now avoided by most companies.I agree, they're avoided by most. The turning point, IMO, was Snowden's data dump.

[Chance]

If you came and asked me to put a back door in my product, I will tell you to piss up a rope.

It's easy to talk a big game; it's not so easy to follow through. Here's one example we know about (https://www.schneier.com/blog/archives/2013/08/lavabit_e-mail.html).

Here is another excellent essay from Schneier discussing the issue (https://www.schneier.com/essays/archives/2013/08/the_nsa_is_commandee.html), and an article (http://www.cnet.com/news/how-the-u-s-forces-net-firms-to-cooperate-on-surveillance/)from CNet. From the CNet article:


Precedents were established a decade or so ago when the government obtained legal orders compelling companies to install custom eavesdropping hardware on their networks.

One example, which has not been previously disclosed, arose out of a criminal investigation in which the Drug Enforcement Administration suspected a woman of trafficking in 1,4-Butanediol. The butane-derived chemical is used industrially as a solvent and recreationally as a date rape drug or sedative.

The DEA's Special Operations Division, which includes FBI representatives, obtained a real-time intercept order -- sometimes called a Title III order -- against EarthLink and WorldCom, a network provider that's now part of Verizon Business. Both companies were targeted by the order because EarthLink routed outgoing e-mail messages through equipment leased from WorldCom.

WorldCom technicians were required to help the DEA install surveillance equipment that the agency had purchased and provided. Over the course of the wiretap, the government's hardware vacuumed up over 1,200 e-mail messages from the targeted account. EarthLink did not respond to a request for comment this week.

FISA gives the government a powerful club to wield against Internet companies. The law requires the firms to "furnish all information, facilities, or technical assistance necessary to accomplish the electronic surveillance" as long as it can be done with a "minimum of interference" with other users.

So yes, the government can compel you to place devices on your network, and backdoors into your software. The security community has known about this for years, and Snowden just provided concrete details. And, as a Schneier's essay describes, some of these companies have employees with security clearances who cannot tell their employers what they're doing.

And no, it's not always obvious what a "backdoor" looks like. I can start providing actual code examples, if anyone's interested.

[JAD]

I am having trouble with why we're going to such effort. Unless we've been misinformed SB was a case of relatively independent action. I was not under the impression that we were earnestly looking for a bearded mastermind sitting in a bunker who plotted this whole thing. I don't know what the FBI expects to learn that will help them to prevent similar events or to punish those responsible.

[hufnagel]

It's easy to talk a big game; it's not so easy to follow through. Here's one example we know about (https://www.schneier.com/blog/archives/2013/08/lavabit_e-mail.html).

Here is another excellent essay from Schneier discussing the issue (https://www.schneier.com/essays/archives/2013/08/the_nsa_is_commandee.html), and an article (http://www.cnet.com/news/how-the-u-s-forces-net-firms-to-cooperate-on-surveillance/)from CNet. From the CNet article:



So yes, the government can compel you to place devices on your network, and backdoors into your software. The security community has known about this for years, and Snowden just provided concrete details. And, as a Schneier's essay describes, some of these companies have employees with security clearances who cannot tell their employers what they're doing.

And no, it's not always obvious what a "backdoor" looks like. I can start providing actual code examples, if anyone's interested.

The differences in scale and financial reserves between LavaBit and Apple are vast. The latter could tie up court cases for years and can mount a soul crushing media campaign if needed. Plus I wouldn't be surprised if Apple as a company doesn't already have an exit strategy from the U.S. already mapped out, if for other reasons.

[JV_]

some of these companies have employees with security clearances who cannot tell their employers what they're doing.It also gets interesting when a lot of your development (MS...) is outsourced to other countries, like India.

[rjohnson4405]

And no, it's not always obvious what a "backdoor" looks like. I can start providing actual code examples, if anyone's interested.

I would be interested.

[Chance]

I would be interested.

The Underhanded C Contest (http://www.underhanded-c.org/) is a good example. The whole concept is to write C code that appears to be innocuous, but actually does something malicious. Some of the stuff on there is brilliant: even being told what the exploit is, I'm lost sometimes. Something like the code from that contest would be more than enough to leak sensitive data.

[JHC]

I am having trouble with why we're going to such effort. Unless we've been misinformed SB was a case of relatively independent action. I was not under the impression that we were earnestly looking for a bearded mastermind sitting in a bunker who plotted this whole thing. I don't know what the FBI expects to learn that will help them to prevent similar events or to punish those responsible.

I don't think we know that exactly. I recall that it appeared they could well have had Islamist connections overseas. And their mosque had some prior trouble with one of the rowdier sects that hung out there awhile. I'm sure they'd like to know who else was in their personal network.

Bearded mastermind, probably not. But imagine the hue and cry if the dead Islamists' buddies killed another 20 people in Sacramento next week. Why wasn't the FBI connecting the dots? How hard could that be right?

[JackRock]

Well, I had no problems connecting a locked iPhone 5 (not mine) to my iTunes account, creating a non-encrypted backup, and restoring that backup to an iPhone 6. That allowed me access to a copy of all of the data on the original iPhone 5. It may not be sufficient for court, but there is no issue accessing the encrypted data on the original phone.

As such, I am still confused as to what the government wants versus what Apple refuses to do.

At some point, you unlocked the phone to do this. You, an authorized user with an authorized decryption key (your passcode and/or your fingerprint) unlocked the system during that process. At some point, you decrypted the device.

What the FBI is asking Apple to do is to create the access without having anything that you had - the decryption key(s).

[farscott]

At some point, you unlocked the phone to do this. You, an authorized user with an authorized decryption key (your passcode and/or your fingerprint) unlocked the system during that process. At some point, you decrypted the device.

What the FBI is asking Apple to do is to create the access without having anything that you had - the decryption key(s).

No, I did not ever unlock the phone. Nor did the owner. All I did was follow Apple's instructions on how to recover a phone if the pass code is lost.

[GRV]

The real technical issues are missing from both the court order and Apple's letter. In fact, Apple's letter is even more misleading about the technical issues, I think.

I don't know how iOS security actually works, but everything I've read about this latest event leads me to believe the following must be the case (unless this is all just motioning):

1) Ground truth: the encryption is already weak. We know this. The key is derived from a pin, ergo the FBI can break the encrypted data. This is the core problem, and what we really need for secure phones is fingerprint for daily unlock with a fallback on a real password after N failures. Also, require a real password on every boot.

2) Instead, Apple gets around the brute force issue with the whole "10 attempts then wipe" and maybe other security features.

Speculation:

3) There is no way, currently, to get the encrypted data off the hardware. Probably blocked on the software front and infeasible on the hardware front. Though I find the latter pretty hard to believe for FBI-scale actors. Alternatively, they are unwilling to reveal that they have that ability, or want to play other cards first.

4) The iPhone will only accepted software updates signed by Apple's own private key. Almost certainly true. This is what is preventing the FBI from writing their own hack. Apple's private key, like any developers, is not feasible to brute force.

5) An iPhone merely in physical possession can be forced to take a signed update without wiping data. This is certainly a technological possibility. From a design perspective, it wouldn't be a big violation of the threat model either, because if you can't trust Apple-signed things then you have much bigger problems. However, it would nonetheless be unsettling. Any legitimate purpose that I can think of for this feature would be reasonably met by said forced, signed install being automatically prefaced by a full wipe. However, we've already seen proof that Apple implements spiritually similar features: namely, they are capable of remotely disabling apps without user permission. A controversial feature, might I add, for good reason.

[TheRoland]

No, I did not ever unlock the phone. Nor did the owner. All I did was follow Apple's instructions on how to recover a phone if the pass code is lost.

The iPhone 5 shipped before iOS8, so was likely essentially unencrypted.

[JV_]

1) Ground truth: the encryption is already weak. We know this. The key is derived from a pin, ergo the FBI can break the encrypted data. This is the core problem, and what we really need for secure phones is fingerprint for daily unlock with a fallback on a real password after N failures. Also, require a real password on every boot.It's AES 256, and used to use a SHA-1 hash, but I hope that's been updated.

The private crypto key is in the hardware, it's not based on the PIN.

More details are here:
http://searchmobilecomputing.techtarget.com/tip/How-iOS-encryption-and-data-protection-work

[TheRoland]

1) Ground truth: the encryption is already weak. We know this. The key is derived from a pin, ergo the FBI can break the encrypted data. This is the core problem, and what we really need for secure phones is fingerprint for daily unlock with a fallback on a real password after N failures. Also, require a real password on every boot.

3) There is no way, currently, to get the encrypted data off the hardware. Probably blocked on the software front and infeasible on the hardware front. Though I find the latter pretty hard to believe for FBI-scale actors. Alternatively, they are unwilling to reveal that they have that ability, or want to play other cards first.


These are actually the same issue, in a really clever way. Each iPhone has a hardware cryptographic engine that contains (in hardware) a unique key that's used to 'wrap' the PIN. If you're using the phone's hardware engine, you only need the PIN because it already knows the unique key. You'd have to brute force only 10,000 4 digit PINs.

But if you've extracted all the encrypted data, you need to brute force the entire AES however-many-bits keyspace.

[Mitchell, Esq.]

I believe this is theater, not substance.

With US Government technological and intelligence capabilities I have real doubts about the security of any data on any device.

Then again, I'm the guy who thinks Ed Snowden is actually a dangle by the US intelligence community for other countries to bite on, or they had knowledge of his plans to run and salted his "stolen files" with some grade A#1, USDA Prime disinformation and he is an unwitting salesman for one of the greatest intelligence poison pills ever.

[TheRoland]

I believe this is theater, not substance.

With US Government technological and intelligence capabilities I have real doubts about the security of any data on any device.

I think it's a safe bet that the NSA can take apart the phone and extract the key from the chip if they needed to (although that's very hard), or probably even brute-force the entire keyspace (which is also hard). But I find it plausible that it's a low priority to do this for this particular deceased nutjob.

[Mitchell, Esq.]

Alternatively, the FBI is thinking that they can use this as a way to force Apple to build them something they have wanted for a while.

[RevolverRob]

Apple products are a royal pain in the ass when you're dealing with more than 5 of them. I can't think of a worse enterprise level device that I've ever used.

That doesn't make sense. OSX is a Unix-based system. If it has issues interfacing with enterprise level software you are running, it is because the software itself is incompatible, or the network is not properly setup. We have over 350 Macs running in two buildings, all connected to an enterprise level database without any issues. In fact, if anything the complications come from the Windows-side of the house, usually stemming from continuous security updates combined with a lack of built in flexibility to manage different aspects necessary at any given user node (which may be considerable). We must have some Windows nodes for software by developers that haven't moved into the 21st century.


A slightly interesting tangent. Sometimes the government already has the data, but they can't use the it in the public place (like a court case) because it could force their hand to reveal the method/source. The way around that is to force someone to provide you the data (in public), Apple in this case, so you can use it where needed.

Well then...FUCK THEM.

Seriously, if the government can't reveal its sources regarding evidence in a court of law - They can't make the necessary case(s) they need to. I'm sorry, but I side with Apple and any other developer who tells the government to pound sand. These requests are ridiculous, ludicrous, and in most cases unconstitutional. The FBI wants Apple to break-in to a single iPhone for them, and they don't care if it places more than 1-billion devices at risk. Allow me to reiterate, FUCK THEM. Talk about the the needs of few outweighing the needs of many.

-Rob

[JV_]

The FBI wants Apple to break-in to a single iPhone for themThey want to be provided with some firmware/hack that will allow them to break in to millions of phones, they're just using this one instance as the catalyst to get it. It's a good patriotic excuse ... any good American should be against a murderous terrorist...

A lot of people are saying a good workaround is to have Apple break the phone, turn over the data, and destroy the phone. As I understand the LE side of things, that would break the "Chain of Custody" and they could no longer guarantee the turned over data was untouched.

[PPGMD]

That doesn't make sense. OSX is a Unix-based system. If it has issues interfacing with enterprise level software you are running, it is because the software itself is incompatible, or the network is not properly setup. We have over 350 Macs running in two buildings, all connected to an enterprise level database without any issues. In fact, if anything the complications come from the Windows-side of the house, usually stemming from continuous security updates combined with a lack of built in flexibility to manage different aspects necessary at any given user node (which may be considerable). We must have some Windows nodes for software by developers that haven't moved into the 21st century.

Using an application to access a database, and managing a computer from an IT perspective are two COMPLETELY different things.

Microsoft makes it easy to manage their computers. You can easily push updates, manage security, or any of the hundreds of things that a systems administrator needs to do to user machines. Apple solution to the same issues is woefully inadequate.

[JV_]

You can easily push updates, manage security, or any of the hundreds of things that a systems administrator needs to do to user machines. That's my experience as well. AD, GPOs, KMS, and all of the integrated tools make running an MS Enterprise far easier (for most admins) than Unix/Linux.

[LittleLebowski]

That doesn't make sense. OSX is a Unix-based system. If it has issues interfacing with enterprise level software you are running, it is because the software itself is incompatible, or the network is not properly setup. We have over 350 Macs running in two buildings, all connected to an enterprise level database without any issues. In fact, if anything the complications come from the Windows-side of the house, usually stemming from continuous security updates combined with a lack of built in flexibility to manage different aspects necessary at any given user node (which may be considerable). We must have some Windows nodes for software by developers that haven't moved into the 21st century.



Well then...FUCK THEM.

Seriously, if the government can't reveal its sources regarding evidence in a court of law - They can't make the necessary case(s) they need to. I'm sorry, but I side with Apple and any other developer who tells the government to pound sand. These requests are ridiculous, ludicrous, and in most cases unconstitutional. The FBI wants Apple to break-in to a single iPhone for them, and they don't care if it places more than 1-billion devices at risk. Allow me to reiterate, FUCK THEM. Talk about the the needs of few outweighing the needs of many.

-Rob

We should hang out sometime.

[TC215]

Used to, if you were doing a search warrant on an iPhone and did not have the passcode, you would have to send the phone and SW to Apple so they could physically unlock it, and they'd send it back.

Apple would do everything they could to try to dissuade you from sending it in. The wait time was always at least 6 months, and you could tell talking to them that they hated doing it.

When the new, encrypted iOS came out, I figured it was more about them getting out of the search warrant compliance business than it actually had to do with securtity concerns for their customers.

[Chance]

Then again, I'm the guy who thinks Ed Snowden is actually a dangle by the US intelligence community for other countries to bite on, or they had knowledge of his plans to run and salted his "stolen files" with some grade A#1, USDA Prime disinformation and he is an unwitting salesman for one of the greatest intelligence poison pills ever.

I don't agree. In fact, I've yet to see anything in the Snowden leaks that I was the least bit surprised by. The information security community pretty much knew (e.g., very strongly suspected) everything the NSA was doing, Snowden just provided specifics. I'll elaborate if anyone's curious, but the Deep Eddy just came out, so the explanation might be interesting.


I think it's a safe bet that the NSA can take apart the phone and extract the key from the chip if they needed to (although that's very hard), or probably even brute-force the entire keyspace (which is also hard).

I don't know enough about the hardware to make an informed comment in that regard. But regarding brute forcing the key space, I think that's completely intractable.

[TGS]

The FBI has a number of technical specialists on staff in subjects ranging from biochemistry to accounting. They have computer forensic specialists, too...but how much those specialists know about the workings of iOS and what is and isn't possible with a suspect device like this one I cannot say.

FWIW, the computer forensics instructors at FLETC were more than aware of the issue even prior to this court decision.

I highly doubt the FBI is that ignorant on the topic that they just don't get it.

[Peally]

Used to, if you were doing a search warrant on an iPhone and did not have the passcode, you would have to send the phone and SW to Apple so they could physically unlock it, and they'd send it back.

Apple would do everything they could to try to dissuade you from sending it in. The wait time was always at least 6 months, and you could tell talking to them that they hated doing it.

When the new, encrypted iOS came out, I figured it was more about them getting out of the search warrant compliance business than it actually had to do with securtity concerns for their customers.

Judging by the times I've had to contact them before on behalf of my employer those retards wouldn't piss on you if you were on fire if they could help it.

[TheRoland]

I don't know enough about the hardware to make an informed comment in that regard. But regarding brute forcing the key space, I think that's completely intractable.

Yeah, sorry. Brute forcing AES-256 would take impossibly long. I'm not sure what I was thinking.

To get at the hardware, you'd have to literally get into the silicone, I think. It's beyond my expertise but has been done to previous (non-Apple) chips.

[BJXDS]

What I don't understand/believe is that China an Russia can Hack the U.S, OPM, TS clearances.... Al the technology we have and "WE" can't hack into an iPhone??? BS.

[JV_]

What I don't understand/believe is that China an Russia can Hack the U.S, OPM, TS clearances.... Al the technology we have and "WE" can't hack into an iPhone??? BS.This is on par with the same silly argument of "we can put a man on the moon but we can't do [insert something]".

The processes, people, and skill-sets of the people that run government servers is vastly different from the developers creating iOS and the iPhone.

Apple has more people taking a smoke break, at any given time, than the whole IT department of some of the agencies who's server has been hacked.

[Chance]

What I don't understand/believe is that China an Russia can Hack the U.S, OPM, TS clearances.... Al the technology we have and "WE" can't hack into an iPhone??? BS.

No one "hacked" OPM. OPM gave away the data. Literally.

[LtDave]

They want to be provided with some firmware/hack that will allow them to break in to millions of phones, they're just using this one instance as the catalyst to get it. It's a good patriotic excuse ... any good American should be against a murderous terrorist...

A lot of people are saying a good workaround is to have Apple break the phone, turn over the data, and destroy the phone. As I understand the LE side of things, that would break the "Chain of Custody" and they could no longer guarantee the turned over data was untouched.
If you were going to prosecute someone in court, chain of custody would be an issue. Since the perps here are dead, I would think they want the info more for the intel value and to cover all bases. Unless they have other info that the phone data would confirm...

[scw2]

I'll elaborate if anyone's curious, but the Deep Eddy just came out, so the explanation might be interesting.

Yes please.

[JAD]

An interesting point that I heard was the supposition that once apple demonstrates that they can do this for the FBI, China is going to want a whole passel of dissident phones unlocked. Russia, too.

[BWT]

My theory is this.

There's a back door, but this is a very public traditional legal proceeding.

http://www.theverge.com/2013/6/6/4403868/nsa-fbi-mine-data-apple-google-facebook-microsoft-others-prism

Why would they stop cooperating with the FBI/NSA? I highly doubt they have; I would be absolutely stunned if there was not a back door.

I think several factors keep them from exploiting this.

One, Apple's stock price is dropping; they're becoming less relevant without meaningful innovations and marketing pushes by Steve Jobs (one of the best marketing minds in modern history; in my opinion) http://www.marketwatch.com/story/is-apple-a-value-stock-or-a-value-trap-2016-01-06. Consumer confidence is already reluctant to put things in the cloud because things in the cloud have been and will continue to be accessed without consumer's consent http://www.ibtimes.com/apple-icloud-hacked-millions-ios-83-passwords-targeted-part-white-hat-security-1960278. Apple will only damage their reputation by not defending their consumer base.

Two, it's an election year and Apple is traditionally well-respected in liberal circles; why alienate their voter base and lend legitimacy to the Republican's concerns over Privacy concerns? I predict a very meek Obama.

Third, our administration traditionally hasn't taken a hard line against terrorists (this was the first one declared a terrorist attack and by the FBI before the WH); http://sofrep.com/45079/fbi-san-bernadino-investigation-stymied-by-politics/#ixzz3tqK7ETgn why would they start now?

Also, why would they start backing the police on the ground and going after islamic terrorists when the figure head of our country is visiting mosques and trying to gather the islamic vote? https://www.washingtonpost.com/news/acts-of-faith/wp/2016/02/03/president-obamas-mosque-visit-will-spotlight-a-new-generation-of-muslim-americans/

Fourth, our Administration doesn't really have any interest in supporting Law Enforcement; whether that be Federal, State, or Local. There's no love lost between the two but there would be repercussions if they backed LE by the liberal voter base.

Between my theories and the others here; I just don't see this iPhone being opened up for L.E.

God Bless,

Brandon

ETA: I take that back; the Boston Bombing I believe was labeled a terrorist attack but several others have been intentionally misnamed to down play domestic threats.

[45dotACP]

That doesn't make sense. OSX is a Unix-based system. If it has issues interfacing with enterprise level software you are running, it is because the software itself is incompatible, or the network is not properly setup. We have over 350 Macs running in two buildings, all connected to an enterprise level database without any issues. In fact, if anything the complications come from the Windows-side of the house, usually stemming from continuous security updates combined with a lack of built in flexibility to manage different aspects necessary at any given user node (which may be considerable). We must have some Windows nodes for software by developers that haven't moved into the 21st century.



Well then...FUCK THEM.

Seriously, if the government can't reveal its sources regarding evidence in a court of law - They can't make the necessary case(s) they need to. I'm sorry, but I side with Apple and any other developer who tells the government to pound sand. These requests are ridiculous, ludicrous, and in most cases unconstitutional. The FBI wants Apple to break-in to a single iPhone for them, and they don't care if it places more than 1-billion devices at risk. Allow me to reiterate, FUCK THEM. Talk about the the needs of few outweighing the needs of many.

-Rob

Highly agreed.

[Edwin]

An interesting point that I heard was the supposition that once apple demonstrates that they can do this for the FBI, China is going to want a whole passel of dissident phones unlocked. Russia, too.

Bingo. (http://www.nytimes.com/2016/02/18/technology/apple-timothy-cook-fbi-san-bernardino.html?_r=0)

https://pbs.twimg.com/media/CbcotCqWcAAN3tO.png

Remember when, after the FBI chief first called for encryption backdoors, China did the same a few weeks later? I do. (http://www.reuters.com/article/us-usa-obama-china-idUSKBN0LY2H520150302)

Reminder: The CIA & NSA have sunk money into developing methods to extract data from iPhones w/o Apple's help. [link (https://theintercept.com/2015/03/10/ispy-cia-campaign-steal-apples-secrets/)] If the gov hacks the iPhone themselves, they don't get the legal precedent they are so desperate to establish in this case.

[JV_]

It's interesting that the shooter had 2 other phones, both of which he destroyed. This is his work phone, that he didn't destroy.

Apple has already turned over his iCloud backups and other data for this phone. They've also already collected data from FB, the carrier, and other sources linked to this phone.

It seems unlikely that this phone contains a huge cache of new/useful data.

[Dr. No]

This thread is what aggravates me about the world today.

We are only reading Apple's "side of the story". The FBI side is only stated through the search order.

From what TC posted, they are looking for a firmware update that will disable the auto-wipe functionality so they can brute force the pin and then execute their search warrant.

Very different issue than cracking encryption or installing a backdoor on every iphone.

TC, if you have a link to the full FBI search order I'd like to read it. You know, get all the facts available before I make a decision.

[rob_s]

So, I'm confused. Are we siding against Apple because:no-hipster (even though the hipster thing really is Android or now this other google thing...) or are we siding against the FBI because:no-the-man?

[JHC]

So, I'm confused. Are we siding against Apple because:no-hipster (even though the hipster thing really is Android or now this other google thing...) or are we siding against the FBI because:no-the-man?

I'm a law and order fiend. My default is siding with the FBI.

[Dr. No]

Found it ... let me go read https://assets.documentcloud.org/documents/2714001/SB-Shooter-Order-Compelling-Apple-Asst-iPhone.pdf

So it's all of three pages.

Only having this information, it seems like Apple is doing the ultra right wing "ZOMG THE GUBBERMENT" crap. The FBI is not asking for them to backdoor the device or crack the encryption. They are asking them to disable the auto-wipe so they can brute force the PIN and execute their search warrant.

Apple would be smarter to give the feds what they want and then fix whatever vulnerability they exploit in order to do this so that it's not possible in the future. Probably wouldn't be able to look like "American Hero Patriots" (who manufacture all their shit in China) that way though......

[JV_]

I'm a law and order fiend. Same here.


My default is siding with the FBI.When I'm forced to side between citizens and the government, when both have potentially valid arguments, I'll side with the citizen.

[JV_]

The FBI is not asking for them to backdoor the device or crack the encryption. They are asking them to disable the auto-wipe so they can brute force the PIN and execute their search warrant. Disabling security features which allow the encryption to be easily access/bypassed/decrypted is (essentially) a backdoor. Auto-Lockout and Wipe-After-X are essential features to security/encryption where the keys only have 10K possible combinations.

[LittleLebowski]

As usual, IowaHawk (https://twitter.com/iowahawkblog) nails it.



On one hand, Apple is a bank refusing a court order to open a safe deposit box.
On the other, the government is asking for a generalized skeleton key to everybody's safe deposit box.

[JV_]

It's interesting that Google is siding with Apple and agrees with the potential (much wider) implications.

[Dr. No]

Disabling security features which allow the encryption to be easily access/bypassed/decrypted is (essentially) a backdoor. Auto-Lockout and Wipe-After-X are essential features to security/encryption where the keys only have 10K possible combinations.

No, it is not. A backdoor is an unauthenticated or known authentication which gives access to the software. IE: The Juniper password.

This does not give the FBI access. It gives them the ability to brute force without destroying data. Very important distinction.

[GRV]

It's AES 256, and used to use a SHA-1 hash, but I hope that's been updated.

The private crypto key is in the hardware, it's not based on the PIN.

More details are here:
http://searchmobilecomputing.techtarget.com/tip/How-iOS-encryption-and-data-protection-work


These are actually the same issue, in a really clever way. Each iPhone has a hardware cryptographic engine that contains (in hardware) a unique key that's used to 'wrap' the PIN. If you're using the phone's hardware engine, you only need the PIN because it already knows the unique key. You'd have to brute force only 10,000 4 digit PINs.

But if you've extracted all the encrypted data, you need to brute force the entire AES however-many-bits keyspace.

Very cool, did not know this (I'm not an iPhone guy). So it basically has a TPM in it? If you know a good but more technical summary of the setup, I'd definitely be interested, but I think I get the gist.

I think I still stand by all my assertions, but that makes sense out of how some of the them are implemented.

I still wonder whether or not three letter agencies have the sophistication to crack open a TPM and read the key with a microscope, but this doesn't necessarily tell us anything about that one way or the other.

[JV_]

No, it is not. A backdoor is an unauthenticated or known authentication which gives access to the software. IE: The Juniper password.That's why I said "essentially". It's not an exact backdoor, but the end result is the same. With those 2 features disabled, someone can sit down and manually enter all 10K combinations in a couple of hours. At that point, Apple may as well do that for them too.

[Dr. No]

That's why I said "essentially". It's not an exact backdoor, but the end result is the same. With those 2 features disabled, someone can sit down and manually enter all 10K combinations in a couple of hours. At that point, Apple may as well do that for them too.

People are talking about this everywhere like the feds are going to be able to grab suzie the home-maker's home "adult" photos off the wire without effort. Very much not the case. They still must have physical possession of the device and need special tools to load it ... and then they STILL have to break in.

Apple probably should, considering they do have a search warrant for the phone ...................

[JV_]

So it basically has a TPM in it?It can't be an actual TPM chip because those can't be used in China and Russia - where iPhones are sold.

[GRV]

No, it is not. A backdoor is an unauthenticated or known authentication which gives access to the software. IE: The Juniper password.

This does not give the FBI access. It gives them the ability to brute force without destroying data. Very important distinction.

It's a very sticky thing here, but I'm inclined to say that iPhone is inherently insecure exactly because it is at all possible for Apple to do this. Essentially, what it means is that the data encrypted on your phone does not have "forward secrecy" even in the short term. Anyone with access to Apple's signing key has the ability to crack the data.

I understand Apple's argument, and agree that creating such software could be dangerous, but they're a group that publicly prides themselves on making it impossible even for them to screw with your data. It's their own fault that they have the ability to build this atomic bomb. They should have seen this coming, or contemplated the consequences of future corrupt employees.

I have a very hard time calling what the FBI is asking for a "master key". The analogy is flawed in too many ways, and I think it perpetuates some really bad misconceptions about the way crypto works. Likewise, it's not a backdoor. Or, if it really is a backdoor, I'd only be willing to call it that if one agrees that the iPhone essentially already has the backdoor and what the FBI is asking is for Apple to execute the convoluted procedures necessary to make use of it.

It's a pretty interesting case though, for a few reasons, and not the way I envisioned the encryption battle shaking down. It'll be very interesting to watch.

[GRV]

It can't be an actual TPM chip because those can't be used in China and Russia - where iPhones are sold.

Do you mean to say that it's not ::wink:: ::cough:: ::nudge:: a TPM? Or is it really a conceptually different device in some significant way?

[Dr. No]

It's a very sticky thing here, but I'm inclined to say that iPhone is inherently insecure exactly because it is at all possible for Apple to do this. Essentially, what it means is that the data encrypted on your phone does not have "forward secrecy" even in the short term. Anyone with access to Apple's signing key has the ability to crack the data.

I understand Apple's argument, and agree that creating such software could be dangerous, but they're a group that publicly prides themselves on making it impossible even for them to screw with your data. It's their own fault that they have the ability to build this atomic bomb. They should have seen this coming, or contemplated the consequences of future corrupt employees.

I have a very hard time calling what the FBI is asking for a "master key". The analogy is flawed in too many ways, and I think it perpetuates some really bad misconceptions about the way crypto works. Likewise, it's not a backdoor. Or, if it really is a backdoor, I'd only be willing to call it that if one agrees that the iPhone essentially already has the backdoor and what the FBI is asking is for Apple to execute the convoluted procedures necessary to make use of it.

It's a pretty interesting case though, for a few reasons, and not the way I envisioned the encryption battle shaking down. It'll be very interesting to watch.

Exactly. Well said.

It's frustrating to see this discussion because the vast majority of information that is out on this is absolutely wrong or being interpreted by people who have no experience or knowledge on the subject.

Par for the course.

[JV_]

Do you mean to say that it's not ::wink:: ::cough:: ::nudge:: a TPM? Or is it really a conceptually different device in some significant way?I was speaking physically, not conceptually.

[Chance]

Yes please.

There were a couple of major clues. One of the large ones was the data center the NSA was building in Utah (https://www.schneier.com/blog/archives/2009/07/nsa_building_ma.html). Building data centers is down to an art these days, so by looking at various things such as how much power was being brought in, what cooling capacity was being put into place, and how large the facility was, you could make some pretty educated guesses about the capabilities of that center. Once researchers had a fair idea of the capabilities of the data center, they began asking, "What exactly would the NSA be using this for?"

The other piece to that puzzle was just looking at what personal data corporations were keeping track of. Companies like Facebook and Google are far more intrusive than the government could ever hope to be, so the government just started going to those corporations and getting their data (this is why I'm not bothered by what the NSA, or other government-intrusion-into-personal-privacy boogeymen do: corporations are far, far worse). Schneier has an excellent essay about this (https://www.schneier.com/blog/archives/2013/05/the_publicpriva.html), published about two weeks before Snowden took flight for Hong Kong. From the essay:


It's no secret that we're monitored continuously on the Internet. Some of the company names you know, such as Google and Facebook. Others hide in the background as you move about the Internet. There are browser plugins that show you who is tracking you. One Atlantic editor found 105 companies tracking him during one 36-hour period. Add data from your cell phone (who you talk to, your location), your credit cards (what you buy, from whom you buy it), and the dozens of other times you interact with a computer daily, we live in a surveillance state beyond the dreams of Orwell.

It's all corporate data, compiled and correlated, bought and sold. And increasingly, the government is doing the buying. Some of this is collected using National Security Letters (NSLs). These give the government the ability to demand an enormous amount of personal data about people for very speculative reasons, with neither probable cause nor judicial oversight. Data on these secretive orders is obviously scant, but we know that the FBI has issued hundreds of thousands of them in the past decade -- for reasons that go far beyond terrorism.

Do read the whole thing, it's wonderful. So we have a slice of what the NSA's capabilities are, and we know what data corporations are collecting on us, so it wasn't that difficult to start speculating on what an intelligence organization might be using those data and capabilities for.

In addition, one of a security professional's bests friends is air-gapping your network (e.g., not connecting your network to the Internet). That would obviously be a problem for NSA, so we could assume they spend a lot of time trying to address that. When the Snowden leaks came out, we got verification that the NSA's Tailored Access Operations were, in fact, spending a lot of time with that. Here's one such solution (https://www.schneier.com/blog/archives/2014/02/somberknave_nsa.html), though there are many more.

You also have to keep in mind that the NSA can read publicly-accessible security research too. A general rule of thumb is that if civilian researchers were working on something, but were limited due to funds, access to talent, or insufficient technology, the NSA was probably not similarly limited. You could safely assume that if civilian researchers wrote it up, the NSA had already been using it in the wild for some time. And again, that speculation was verified once there was concrete information available.

Because of all of this, I don't really think Snowden's leaks were that damaging. While I'm more familiar with information security than most, I'm nothing approaching an expert. Any sufficiently sophisticated adversarial organization is going to have actual experts available, who would have arrived at similar conclusions, given the above. Snowden was just a wake up call, but a wake up call in the wrong direction, in my opinion. Again, when it comes to mass surveillance, the NSA really isn't doing anything companies weren't already doing themselves, the NSA just got access to their data. But companies that give you free stuff can't possibly be bad right? It's the big, scary, secretive government organization that's the real bad guy. :rolleyes:

[JV_]

No, it is not. A backdoor is an unauthenticated or known authentication which gives access to the software. IE: The Juniper password.

FWIW: Tim Cook is also calling it a backdoor, it's in their Customer Letter. I admit it's a broad definition.

http://www.apple.com/customer-letter/

Building a version of iOS that bypasses security in this way would undeniably create a backdoor.

[JV_]

If you know a good but more technical summary of the setup, I'd definitely be interested, but I think I get the gist.

https://www.apple.com/business/docs/iOS_Security_Guide.pdf

[TheRoland]

Actually, I think this version of the iPhone5 doesn't actually have the Secure Enclave chip, just a device key somewhere in hardware. This is presumably why Apple could allow PINs to be submitted in an automated way, and get rid of hardware delays that might make this less practical for the 6.

This model wouldn't require a man to type in passwords for a day or two. It could be done over USB in a few minutes.

[JV_]

I believe the rule of thumb has been: If it doesn't have Touch-ID, it doesn't have the Secure Enclave chip. The 5c does not have Touch-ID.

You can brute force the 10K combinations in (no less than) 13.3 minutes. The phone requires 80ms to process each pin.

[TheRoland]

I believe the rule of thumb has been: If it doesn't have Touch-ID, it doesn't have the Secure Enclave chip. The 5c does not have Touch-ID.

You can brute force the 10K combinations in no less than 13.3 minutes. The phone requires 80ms to process each pin.

Right. But on a newer device that has the Enclave, the enclave enforces further increasing delays between each PIN, and it's unclear if Apple has any way of updating the Enclave to remove them. So the lack of the enclave is pretty important to note, as it turns usage of this tool from "turn it on and come back after a coffee break" to "turn it on and come back ?????".

[JV_]

The lack of the enclave is HUGE in this case, because the FBI could make the software themselves, because the phone doesn't require a signed OS.

https://www.washingtonpost.com/posteverything/wp/2016/02/18/why-you-should-side-with-apple-not-the-fbi-in-the-san-bernardino-iphone-case/
By Bruce Schneier


But that iPhone, an older model, has a security flaw. While the data is encrypted, the software controlling the phone is not. This means that someone can create a hacked version of the software and install it on the phone without the consent of the phone’s owner and without knowing the encryption key.

[snip]

There’s nothing preventing the FBI from writing that hacked software itself, aside from budget and manpower issues.


But the real issue here isn't just this one case.


Either everyone gets security or no one does. Either everyone gets access or no one does. The current case is about a single iPhone 5c, but the precedent it sets will apply to all smartphones, computers, cars and everything the Internet of Things promises. The danger is that the court’s demands will pave the way to the FBI forcing Apple and others to reduce the security levels of their smart phones and computers, as well as the security of cars, medical devices, homes, and everything else that will soon be computerized. The FBI may be targeting the iPhone of the San Bernardino shooter, but its actions imperil us all.

[GRV]

Thanks for the whitepaper JV_.

Interesting, so in that case, for this particular (old) phone, it sounds like the FBI is just being a bit muscly. Note, if they got Apple to do it the right way, signed, the exploit would work on the newer phones too, which do have secure boot. I wonder whether or not this is a motivation for pursuing it through the courts.

I'm guessing the 80ms iteration was calibrated for some sort of usability concern...but I can't help but think this whole thing could have been solved if they had just used a longer iteration. I haven't read the whitepaper in detail, but I'm imagining the PIN gets hashed somewhere and they really should have used more rounds of a better hash function.

[Edwin]

https://www.youtube.com/watch?v=dB2dQ7OtQUs&feature=youtu.be

[Kukuforguns]

I still wonder whether or not three letter agencies have the sophistication to crack open a TPM and read the key with a microscope, but this doesn't necessarily tell us anything about that one way or the other.

This fight is not about this phone.

Assume that the NSA has the ability to identify the hardware key of any iphone. Assume that the NSA is likely only to use this ability on matters that involve national security. Assume that the NSA will not use this ability on the hundreds/thousands of iphones that are gathering dust in evidence lockers around the country for ordinary criminal matters. Assume that the agencies that are housing the iphones want to access encrypted data on the iphones. Assume the FBI is an agency with iphones gathering dust.

Assume that the LA US Attorney deliberately chose this case because of its emotional impact.

Conclusion: ____________________________

[GRV]

...right...which is why "this doesn't necessarily tell us anything about that one way or the other."

[Kukuforguns]

...right...which is why "this doesn't necessarily tell us anything about that one way or the other."
I guess I'm less interested in whether NSA actually can determine the key by vaporizing bits of hardware -- even if it made a public announcement about its ability in this regard, I wouldn't believe it. I'm willing to live with "I assume it can."

[JackRock]

No, I did not ever unlock the phone. Nor did the owner. All I did was follow Apple's instructions on how to recover a phone if the pass code is lost.

Then I highly doubt the phone was ever encrypted. Locked, yes. Encrypted, no. There is a significant difference.

[Chance]

I guess I'm less interested in whether NSA actually can determine the key by vaporizing bits of hardware -- even if it made a public announcement about its ability in this regard, I wouldn't believe it. I'm willing to live with "I assume it can."

I could care less what intelligence agencies can do. If they can't do it now, they'll be able to do it soon. And who cares if they can't decrypt data on millions of iPhones because millions of iPhone owners voluntarily put all that data in the public sphere anyways.

In fact, I'm not worried about what anyone in the executive branch of government can do. Hell, I like the NSA; I think they do some amazing work.

My concern is that the legislative branch has no interest in balancing the interests of government with the interests of anyone other than the government. Politicians are the issue, not the people on the pointy end.

ETA: Like this. So much this.

Senate Panel Chief Plans Bill to Criminalize Firms That Don’t Decipher Encrypted Messages (http://www.wsj.com/articles/senate-intel-committee-chairman-working-on-encryption-bill-1455832584)

[JV_]

In fact, I'm not worried about what anyone in the executive branch of government can do. Hell, I like the NSA; I think they do some amazing work.
Beyond my own privacy and security concerns, I have concerns that the NSA (the Executive branch) spies on the Legislative and Judicial branch officials. The blackmail potential is just too great.

http://www.wnd.com/2016/01/congressman-demands-investigation-of-nsa-spying-on-congress/

[Dr. No]

Wait I thought we were mad at the FBI ... not the NSA ...

I wish you guys had even an inkling on how little the feds play together. It's downright baffling.

[JV_]

I wish you guys had even an inkling on how little the feds play together. It's downright baffling.As far as IT related inter-agency cooperation goes, I am familiar with it.

[Chance]

I wish you guys had even an inkling on how little the feds play together. It's downright baffling.

I do have an inkling, which is another reason I'm not worried about some grand conspiracy.


The blackmail potential is just too great.


Is it too much to ask that we have elected officials with no horrible secrets to expose?

...Okay, I just said that aloud. But we can dream, right?

[JV_]

Is it too much to ask that we have elected officials with no horrible secrets to expose?Yes. Almost EVERYONE, politician or regular citizen, has things in their life that they would like to remain private. People go through bad divorces, their kids may get in trouble, they may have financial issues, etc.

[Mitchell, Esq.]

Is it too much to ask that we have elected officials with no horrible secrets to expose?

...Okay, I just said that aloud. But we can dream, right?

So what color would you like that unicorn?

[Chance]

So what color would you like that unicorn?

White with a rainbow horn, dude. Obvi.

6001

Look, bad actors can always abuse tools. Call me hopelessly naive, but I think most of the people in the gov'rnment are decent people trying to do decent work. Lawmakers still define the tempo of personal freedom. Everything else is a symptom.

ETA: I may have finally found an avatar.

[rauchman]

Well then...FUCK THEM.

Seriously, if the government can't reveal its sources regarding evidence in a court of law - They can't make the necessary case(s) they need to. I'm sorry, but I side with Apple and any other developer who tells the government to pound sand. These requests are ridiculous, ludicrous, and in most cases unconstitutional. The FBI wants Apple to break-in to a single iPhone for them, and they don't care if it places more than 1-billion devices at risk. Allow me to reiterate, FUCK THEM. Talk about the the needs of few outweighing the needs of many.

-Rob

+ 4,654,786,852,525,222,153

Absofuckinglutely agree!

[secondstoryguy]

It is my understanding the fingerprint reader won't function with dead tissue.


It will with fresh dead tissue. Don't ask me how I know.

[Edwin]

If the FBI needs to get into someone's iPhone without permission they should just call U2 and ask how they did it.

[JR1572]

If the FBI needs to get into someone's iPhone without permission they should just call U2 and ask how they did it.

Yeah, they put that crap in my 5s and somehow it's in my 6s.

JR1572

[JV_]

An interesting tidbit was just released

http://www.macrumors.com/2016/02/19/apple-government-changed-apple-id-password/

According to Apple, the Apple ID password on the iPhone was changed "less than 24 hours" after being in government hands. Had the password not been altered, Apple believes the backup information the government is asking for would have been accessible to Apple engineers.

[Kukuforguns]

An interesting tidbit was just released

According to Apple, the Apple ID password on the iPhone was changed "less than 24 hours" after being in government hands. Had the password not been altered, Apple believes the backup information the government is asking for would have been accessible to Apple engineers.
http://www.macrumors.com/2016/02/19/apple-government-changed-apple-id-password/

That would, hopefully, be a game changer.

[Dagga Boy]

I am smelling "a lot more to this". Also, I sure wish the government was this concerned about "Islamic Terrorists" when it comes to actually dealing with them. These are the same people who are more concerned about "Islamiphobia" than "terrorism in the name of Islam". The same people who have removed the word "Islamic" from government training documents, and pulled surveillance on possible terrorists because they are afraid of the appearance of profiling......which I fully believe also happened with the shooters in this case in which the federal government dropped the ball on them. Now all of a sudden they give a crap, and Apple must create a back door program for the government with no due process. This is like the FBI showing up at my house with a warrant to start surveillance on a person who might come down my street....and I have to provide all the equipment and cost for that surveillance.

[JV_]

If they really cared about this issue they wouldn't be letting the terrorists inside of our borders in the first place. The wife probably shouldn't have been let in. We should be controlling our borders. We should be looking harder at the Syrians coming in.

[RevolverRob]

... This is like the FBI showing up at my house with a warrant to start surveillance on a person who might come down my street....and I have to provide all the equipment and cost for that surveillance.

Which incidentally is pretty damn unconstitutional...https://en.wikipedia.org/wiki/Third_Amendment_to_the_United_States_Constitution

A pretty compelling argument can be made that federal law enforcement, as agents of the federal government are the equivalent of soldiers during war or peace. In this particular case (the one you provide, Nyeti), I think one could argue that an intrusion by the government, even during a time of emergency (not declared war) is a 3rd Amendment violation. In the case of Apple, it would be more of a stretch, but it could be argued that in essence the government is asking Apple to provide aid and quarter to government facilities to complete this process. They must compromise their own livelihood to provide aid to the government. This is expressly the purpose of the 3rd Amendment. This is something I would find really compelling as an application of this amendment. Also it has potentially far-reaching implications vis-a-vis authorities requiring you to vacate your home during a criminal search (i.e., Boston Marathon bombers).

-Rob

[Wondering Beard]

What do you guys think?

http://www.theatlantic.com/politics/archive/2016/02/Is law-enforcement crying wolf about the dangers of locked phones? (http://www.theatlantic.com/politics/archive/2016/02/is-law-enforcement-crying-wolf-about-the-dangers-of-locked-phones/470055/)

[Dagga Boy]

I worked for a police agency where the administration used surveillance equipment from State of California DOJ program to instal a video camera in the men's locker room. No one was ever punished. Very simply......I do not trust that everyone will do the right thing and this will end with a glimpse into a single phone.

[Drang]

It is my understanding the fingerprint reader won't function with dead tissue.


It will with fresh dead tissue. Don't ask me how I know.

They have a detector for body temperature.

[SLG]

Waste of typing, disregard.

[Tamara]

Waste of typing, disregard.

I completely disagree that it was a waste of typing. I'm glad I read it. :)

[TheRoland]

Replied to deleted post; disregard.

[Dagga Boy]

Guess I missed something worthwhile.

[SLG]

Guess I missed something worthwhile.

No, you didn't. I appreciate that Tam liked it, as that always means something to me.

[Wondering Beard]

No, you didn't. I appreciate that Tam liked it, as that always means something to me.

Well now I want to read it

[Dagga Boy]

It is really a sad state of affairs in which someone like me has lost so much faith in the upper echelons of our government that it is affecting the work of actual Law enforcement folks trying to do their jobs.

I never thought I would see the day that the IRS is really used to attack political enemies, the head of the State Department can operate a computer system with no accountability or care for the handling of government documents, and a system where the full force of the government is used against local LE. Sorry, maybe someday I will side with the government in these matters, but I no longer trust motivation, or security of the information on how to crack these systems.

[JV_]

...I never thought I would see the day that the IRS is really used to attack political enemies, the head of the State Department can operate a computer system with no accountability or care for the handling of government documents, and a system where the full force of the government is used against local LE....
Just think about all of the other stuff which hasn't been made public, but is equally destructive to our country.

[TCinVA]

In another wrinkle to this case, it seems that the code for this phone was changed remotely by someone in the agency who paid for the phone...and it was done at the FBI's request.

[TAZ]

In another wrinkle to this case, it seems that the code for this phone was changed remotely by someone in the agency who paid for the phone...and it was done at the FBI's request.

Is it the passcode of the Phone that was changed or the Apple ID password? I read it was the Apple ID password so any cloud data couldn't be wiped remotely by any other interested parties. From my limited understanding this means that the government didn't have access to any data that wasn't backed up to iCloud. Which is what they want. I can understand why they would want to change the AppleID password, but why not just copy the data off of iCloud and pretend everything is normal. Allow any interested third party to log into the iCloud account to try and wipe it, then see if you can penetrate their systems while they are logged in.

I hope Apple prevails and the rest of the industry joins them in their apparent stand. I'll be shocked if this isn't a bunch of smoke and mirrors with the gov already having the data and needing a way to legally produce evidence or Apple having already turned over the keys to the castle, but now needing some help with image.

[JV_]

the government didn't have access to any data that wasn't backed up to iCloud.Apple provided the icloud backups, it's just that the latest one was a few weeks old, and there's more data on the phone than what's backed up.

https://news.vice.com/article/fbi-approved-hack-that-complicated-access-to-san-bernardino-shooters-iphone-data

. Apple has already provided the FBI with Farook's iCloud data, but the last backup occurred on October 19, six weeks before the shooting.

[farscott]

Apple provided the icloud backups, it's just that the latest one was a few weeks old, and there's more data on the phone than what's backed up.

https://news.vice.com/article/fbi-approved-hack-that-complicated-access-to-san-bernardino-shooters-iphone-data

The funniest thing about that article is the FBI blaming the owner of the phone (San Bernadino County) for changing the iCloud password, and the County saying, "The FBI asked us to change it". My experience suggests the latter story is true.


On Sunday, San Bernardino County also tweeted a link to an ABC News story, which included an FBI statement that refuted previous remarks from an unnamed federal official who on Friday blamed the iCloud password reset on a "county information technology employee." The official had said the employee "executed the reset without being asked to do so by federal authorities."

The FBI statement said that it seized the phone on December 3, a day after the shooting, and that the "logical next step was to obtain access to iCloud backups for the phone in order to obtain evidence related to the investigation in the days following the attack."

The FBI admitted that it worked with county technicians to reset the iCloud password on December 6, which seemingly contradicted the DOJ court filing that said the phone's "owner" was responsible for the botched iCloud hack. Regardless, the FBI maintained that the iCloud hack was irrelevant to its efforts to get Apple to unlock the phone because it's possible that not all of the data would have been backed up.

[Drang]

The funniest thing about that article is the FBI blaming the owner of the phone (San Bernadino County) for changing the iCloud password, and the County saying, "The FBI asked us to change it". My experience suggests the latter story is true.
Two government agencies arguing about who is responsible, each blaming the other? Say it ain't so!

[Chance]

According to a new poll (http://www.people-press.org/2016/02/22/more-support-for-justice-department-than-for-apple-in-dispute-over-unlocking-iphone/):


The latest national survey by Pew Research Center, conducted Feb. 18-21 among 1,002 adults, finds that almost identical shares of Republicans (56%) and Democrats (55%) say that Apple should unlock the San Bernardino suspect’s iPhone to aid the FBI’s ongoing investigation. By contrast, independents are divided: 45% say Apple should unlock the iPhone, while about as many (42%) say they should not unlock the phone to ensure the security of their other users’ information.

[Dagga Boy]

Just a question if anyone knows? Did anyone from the FBI contact Apple before they did anything? Common sense would suggest that before you touch a thing, someone would call the Apple tech and security folks and ask, "we will be needing to crack a phone, and are getting a warrant for it, what do you need?".

[tanner]

I read a report somewhere that indicated that the shooter deleted everything on his phone before the attack. I imagine they want to get at the deleted info. Something they would need the unlocked device.

I hope this guy wiped his like Hiliary's people wiped hers.

On the larger issue at hand? The government certainly has wanted this capability for some time and has seized upon this specific case to try to gain public support.

But Apple is certainly using it as a marketing ploy as well.

Theoretically, they can open the phone. Both sides agree on that. So isn't the genie that Apple is so afraid of already out of the bottle?

[JV_]

The shooter had 2 other phones, both of which he physically destroyed. He didn't do a good enough job destroying them because they're actively being rebuilt.

This phone, the one that needs unlocking, was owned by the county (his employer).

It seems unlikely he would go through the effort to physically destroy 2 other phones, leaving his one in-tact, if it has vast stores of critical information on it. It's speculated that they only want the GPS data on it, from after the shooting and before his capture. I don't think the GPS data they want is included in the iCloud backup.

[JV_]

https://theintercept.com/2016/02/23/new-court-filing-reveals-apple-faces-12-other-requests-to-break-into-locked-iphones/


Apple has objected to or otherwise challenged at least 12 government requests to help extract data from locked iPhones since September, bolstering its argument that its current battle about a terrorist’s phone is not as unique as the Justice Department has maintained.

[Shellback]

“There is nothing new in the realization that the Constitution sometimes insulates the criminality of a few in order to protect the privacy of us all.” — Justice Antonin Scalia (1936-2016)

[TGS]

I've tried to do some reading on it, and the more I read the more I think most people have a really warped understanding on this issue due to a media narrative. Just for my own understanding, can you guys confirm this:

1) The court is ordering Apple to upgrade the operating system with a disabled auto-delete feature, allowing the FBI to brute-force the phone.

2) The FBI wants the option to use this upgraded OS on phones that it has consent/warrant to search. It is not seeking that this replace Apple's current OS on the market.

3) The court order does not give a LE agency the right to view your contents at any time they wish for whatever reason; such is still protected under the 4th Amendment per Riley v California.

4) The legal basis for the order is the All Writs Act, as affirmed in US v NY Telephone Co.

[joshs]

I've tried to do some reading on it, and the more I read the more I think most people have a really warped understanding on this issue due to a media narrative. Just for my own understanding, can you guys confirm this:

1) The court is ordering Apple to upgrade the operating system with a disabled auto-delete feature, allowing the FBI to brute-force the phone.

2) The FBI wants the option to use this upgraded OS on phones that it has consent/warrant to search. It is not seeking that this replace Apple's current OS on the market.

3) The court order does not give a LE agency the right to view your contents at any time they wish for whatever reason; such is still protected under the 4th Amendment per Riley v California.

4) The legal basis for the order is the All Writs Act, as affirmed in US v NY Telephone Co.

How is what you posted different from the popular narrative?

Also, the facts of the case are different enough from NY Telephone Co. that it doesn't resolve the legal question.

[TGS]

How is what you posted different from the popular narrative?

Also, the facts of the case are different enough from NY Telephone Co. that it doesn't resolve the legal question.

It's more an observation from the stuff I'm hearing from people (talking to non-law types from varied backgrounds). Whatever news input they're getting is that the FBI wants to install back doors on all of our digital media equipment allowing them to look at what we're doing without any REP. As an example, just to get started off on two-solid feet planted on the ground I had to call time-out with someone (college educated, successful person with a good salary) last night and explain how the FBI breaking into the phone isn't a 4th Amendment violation to begin with.

So, was what I posted correct? Can you talk more about US v NY Tel Co and how it doesn't play into this?

[JAD]

So, was what I posted correct? Can you talk more about US v NY Tel Co and how it doesn't play into this?

I can't tell you if it's correct, but I can tell you it matches 100% with what I hear about the issue on NPR.

[joshs]

It's more an observation from the stuff I'm hearing from people (talking to non-law types from varied backgrounds). Whatever news input they're getting is that the FBI wants to install back doors on all of our digital media equipment allowing them to look at what we're doing without any REP. As an example, just to get started off on two-solid feet planted on the ground I had to call time-out with someone (college educated, successful person with a good salary) last night and explain how the FBI breaking into the phone isn't a 4th Amendment violation to begin with.

So, was what I posted correct? Can you talk more about US v NY Tel Co and how it doesn't play into this?

It is definitely applicable, I just said it doesn't provide a clear answer to the legal question. This is a better explanation than I could provide:
https://www.washingtonpost.com/news/volokh-conspiracy/wp/2016/02/19/preliminary-thoughts-on-the-apple-iphone-order-in-the-san-bernardino-case-part-2-the-all-writs-act/

[Chance]

It's more an observation from the stuff I'm hearing from people (talking to non-law types from varied backgrounds). Whatever news input they're getting is that the FBI wants to install back doors on all of our digital media equipment allowing them to look at what we're doing without any REP.

It sounds like they're getting some signals crossed (or intentionally ignoring nuance in favor of anti-establishment sensationalism... probably the latter). Obviously, LEOs have to go through court, but the implications extend beyond this particular case. Schneier addressed this is a recent essay (https://www.schneier.com/blog/archives/2016/02/the_importance_.html):


The FBI wants the ability to bypass encryption in the course of criminal investigations. This is known as a "backdoor," because it's a way at the encrypted information that bypasses the normal encryption mechanisms. I am sympathetic to such claims, but as a technologist I can tell you that there is no way to give the FBI that capability without weakening the encryption against all adversaries. This is crucial to understand. I can't build an access technology that only works with proper legal authorization, or only for people with a particular citizenship or the proper morality. The technology just doesn't work that way.

If a backdoor exists, then anyone can exploit it. All it takes is knowledge of the backdoor and the capability to exploit it. And while it might temporarily be a secret, it's a fragile secret. Backdoors are how everyone attacks computer systems.

This means that if the FBI can eavesdrop on your conversations or get into your computers without your consent, so can cybercriminals. So can the Chinese. So can terrorists. You might not care if the Chinese government is inside your computer, but lots of dissidents do. As do the many Americans who use computers to administer our critical infrastructure. Backdoors weaken us against all sorts of threats.

....

Even a highly sophisticated backdoor that could only be exploited by nations like the United States and China today will leave us vulnerable to cybercriminals tomorrow. That's just the way technology works: things become easier, cheaper, more widely accessible. Give the FBI the ability to hack into a cell phone today, and tomorrow you'll hear reports that a criminal group used that same ability to hack into our power grid.

That last bit is mild hyperbole, but the premise is very true. Worth reading the whole thing.

[JackRock]

...that the FBI wants to install back doors on all of our digital media equipment allowing them to look at what we're doing without any REP. As an example, just to get started off on two-solid feet planted on the ground I had to call time-out with someone (college educated, successful person with a good salary) last night and explain how the FBI breaking into the phone isn't a 4th Amendment violation to begin with.

Those of us in the security industry aren't railing about the FBI having such access. Legally speaking, they would require a warrant even with the court order as given.

Our problem is that once security is broken, it is weakened for everybody. Name one business with more than 100 people that we can guarantee have 100% clean criminal backgrounds, and never will in the future commit crimes. Even if Apple keeps the technology in-house, how can we guarantee that with such a large company that it won't get out?

With Cisco, Juniper and many other companies having backdoors for maintenance and the like, they were all discovered and exposed. Even though the companies tried their damndest to keep them secret. That's the point Apple's trying to make when they say it's too dangerous for such a tool to exist.

[HCM]

Those of us in the security industry aren't railing about the FBI having such access. Legally speaking, they would require a warrant even with the court order as given.

Our problem is that once security is broken, it is weakened for everybody. Name one business with more than 100 people that we can guarantee have 100% clean criminal backgrounds, and never will in the future commit crimes. Even if Apple keeps the technology in-house, how can we guarantee that with such a large company that it won't get out?

With Cisco, Juniper and many other companies having backdoors for maintenance and the like, they were all discovered and exposed. Even though the companies tried their damndest to keep them secret. That's the point Apple's trying to make when they say it's too dangerous for such a tool to exist.

As the Hells Angels say, "three can keep a secret if two are dead". Like it or not, it is correct.

[Edwin]

Here's a pretty good read on the situation. (http://www.zdziarski.com/blog/?p=5645)

[JackRock]

Here's a pretty good read on the situation. (http://www.zdziarski.com/blog/?p=5645)

Pretty good write up. And it shows, in much more detail, that this specific case by design gives the tool to many many people - any one of which, or any one of their coworkers. And each one of these is a risk point for ALL iPhones in the world.

We've already seen many cases of non-open-source software revers engineered, and thus "hacked" to do things it shouldn't. This process alone makes it possible for a malicious actor to re-work it so it works on any phone. That, plus the fact that the FBI has already asked Apple to use this technique on 12 new phones after the San Bernandino case came up, makes me feel that such a tool is way way beyond reasonable assistance for Apple to provide.

Throw in the fact that many people chose iPhones over their competitors precisely because of the heightened security, and it begins to eat into their business as a whole.

I can't support the FBI in this case, especially when there's probably nothing of interest (https://theintercept.com/2016/02/26/farooks-iphone-is-probably-useless-even-the-police-say-so/) on the device, anyway.

[Bigguy]

4 new ways to bypass passcode lock screen on iPhones, iPads running iOS 9 (http://www.computerworld.com/article/3041302/security/4-new-ways-to-bypass-passcode-lock-screen-on-iphones-ipads-running-ios-9.html?token=%23tk.CTWNLE_nlt_computerworld_dailyn ews_2016-03-07&idg_eid=60d006dc7cd8e87c8654924b2bc255bd&utm_source=Sailthru&utm_medium=email&utm_campaign=Computerworld%20Wrap-Up%202016-03-07&utm_term=computerworld_dailynews#tk.CW_nlt_%20comp uterworld_dailynews_2016-03-07)

[Edwin]

http://youtu.be/zsjZ2r9Ygzw

[TAZ]

4 new ways to bypass passcode lock screen on iPhones, iPads running iOS 9 (http://www.computerworld.com/article/3041302/security/4-new-ways-to-bypass-passcode-lock-screen-on-iphones-ipads-running-ios-9.html?token=%23tk.CTWNLE_nlt_computerworld_dailyn ews_2016-03-07&idg_eid=60d006dc7cd8e87c8654924b2bc255bd&utm_source=Sailthru&utm_medium=email&utm_campaign=Computerworld%20Wrap-Up%202016-03-07&utm_term=computerworld_dailynews#tk.CW_nlt_%20comp uterworld_dailynews_2016-03-07)

LOL... So there are already 4 distinct ways in which the system can be bypassed, granted it requires a specific set of apps. Yet the FBI wants a complete back door. HMMMMMMMMM....

[PPGMD]

Yet the FBI wants a complete back door. HMMMMMMMMM....

Because Apple would ask annoying questions like "Where is your warrant?"

The FBI has a history of getting slapped down by the SCOTUS for using technology in ways that is questionable.

This case has nothing to do with this phone, but the almost 2 dozen other Apple devices that the FBI is waiting to unlock.

[TAZ]

Because Apple would ask annoying questions like "Where is your warrant?"

The FBI has a history of getting slapped down by the SCOTUS for using technology in ways that is questionable.

This case has nothing to do with this phone, but the almost 2 dozen other Apple devices that the FBI is waiting to unlock.

2 dozen is a HUGE underestimation. Watching HBOnlast night (goofy Brit guy doing political commentary). He claims 172 just in NYC. I'll venture across the country there are thousands of phones and LEO agencies looking for the right precedent to be set. Agree with you. This one is special cause they can use the terror angle to play the useful idiot's emotional strings easier.

[JV_]

This could get interesting:

http://www.macrumors.com/2016/03/17/apple-engineers-could-refuse-fbi-order/

Apple employees are already discussing what they will do if ordered to help law enforcement authorities. Some say they may balk at the work, while others may even quit their high-paying jobs rather than undermine the security of the software they have already created, according to more than a half-dozen current and former Apple employees.

[Edwin]

They could always try this method: US secretly demands source code from tech companies, and firms that push back lose "most of the time," says ZDNet: (http://www.zdnet.com/article/us-government-pushed-tech-firms-to-hand-over-source-code/)

[PPGMD]

2 dozen is a HUGE underestimation. Watching HBOnlast night (goofy Brit guy doing political commentary). He claims 172 just in NYC. I'll venture across the country there are thousands of phones and LEO agencies looking for the right precedent to be set. Agree with you. This one is special cause they can use the terror angle to play the useful idiot's emotional strings easier.

I wasn't estimating. The FBI director under questioning (I forget if it was the House or the Senate) said they had 21 or 22 other phones that they are waiting to unlock. If it is 172 in NYC city alone than the FBI director was lying under oath.

[LittleLebowski]

I wasn't estimating. The FBI director under questioning (I forget if it was the House or the Senate) said they had 21 or 22 other phones that they are waiting to unlock. If it is 172 in NYC city alone than the FBI director was lying under oath.

I would bet those 172 are being requested by the hyper zealous NYC police officials, not the FBI. NYC is an Orwellian state.

[JV_]

In a court filing [PDF] submitted on Monday in a central California federal court, the DOJ requested a motion to cancel a Tuesday hearing and to suspend the and proceedings at least until next month.
United States Magistrate Sheri Pym, the judge who previously ordered Apple to help the FBI unlock the encrypted iPhone, granted the request.
The cancelled hearing is because the FBI wants some time to test an alternate method for unlocking the shooter's iPhone that will not involve Apple building a backdoored iOS version.



http://thehackernews.com/2016/03/how-to-unlock-iphone.html

[PPGMD]

I would bet those 172 are being requested by the hyper zealous NYC police officials, not the FBI. NYC is an Orwellian state.

Probably, NYC is often only a stop or two behind the Brits on their way to a police state.

[Chance]

The FBI has succeeded (http://www.bbc.com/news/world-us-canada-35914195) in breaking into the phone without Apple's help. No more info right now.

[TAZ]

The FBI has succeeded (http://www.bbc.com/news/world-us-canada-35914195) in breaking into the phone without Apple's help. No more info right now.

I disagree. The FBI had all the information already based on some unknown to us method. They just now figured out how to make it go live and look legit without giving too much away.

[rauchman]

I've seen it suggested (article on LinkedIn titled "The end of the iPhone encryption case and the questions we must ask", that I can't for the life of me figure out how to link) that the FBI knew all along how to get into the I Phone, but was hoping to get public approval in the process to justify a further encroachment of government vs. privacy.

[JV_]

It was also suggested in this thread, a while ago: https://pistol-forum.com/showthread.php?19269-Apple-s-Arguments-for-Encryption-Sound-Very-Familiar&p=408453&viewfull=1#post408453

[Drang]

I've seen it suggested (article on LinkedIn titled "The end of the iPhone encryption case and the questions we must ask", that I can't for the life of me figure out how to link) that the FBI knew all along how to get into the I Phone, but was hoping to get public approval in the process to justify a further encroachment of government vs. privacy.

The end of the iPhone encryption case and the questions we must ask by Kade Morton on Peerlyst (https://www.peerlyst.com/posts/the-end-of-the-iphone-encryption-case-and-the-questions-we-must-ask-kade-morton-1)

(I use an extension called CoLT...)