Apple Says 'No'

[megaadam]

You need to get the full story. The government has not asked Apple to "unlock" that phone. The government wants Apple to create and install software on that phone which makes it hackable. Software can be copied. You may or may not love to hate Apple. But their words open another perspective: Customer Letter - Apple[^] :suss:

Life is too shor

[Steve Wellens]

The question is...can you trust the government. When you see how the IRS abused its power, I think the answer is obvious: No. Any tools given to the government will be used against real and 'perceived' enemies. A 'perceived' enemy is someone you disagree with politically.

[mbb01]

Apple are saying no because it will devalue their biggest selling product. Even if we believe that it was special software written to access one particular phone, the fact that it could be done to anyone on a court order may well deter people from their products in the future. Having said that, I find it disingenuous of Apple stand up for security concerns when they've allowed such easy access to the data to, albeit legitimately, installed applications such as Facebook. Ultimately we should consider any computing device, especially devices capable of over the air comms, as insecure anyway.

[Kiriander]

It not only could, it will. If one phone got unlocked, what's wrong with two? If two, what's wrong with three? And so on and so forth.

[maze3]

at first i as reading this as Mr. Crook, not Cook. Yeah Mr. Crook is ignoring court order.

[kalberts]

Vark111 wrote:

My understanding is that if you attempt bad passwords X number of times, the phone bricks itself essentially. The "new" iOS being requested by the courts/FBI would allow unlimited attempts therefore making any phone that can have that OS installed brute forcible.

Ten attempts. Then the phone not just blocks all info on the phone, it erases it completely. After that no tool can recover it; there is nothing to recover. The code in question is a 4 decimal digit code, so a brute force attack requires only ten thousand tries (or on the average half of that) - so little that it neither sounds very much "brute" nor very strong "force" :-)

[kalberts]

Duncan Edwards Jones wrote:

If the file exists on the phone and was encrypted using an existing version of the data, how would installing a new version of the iOS allow easier unencryption?

Unless the user specifies the full encryption key every time the encrypted information is accessed, the software does know the key. It is stored somewhere in the file system. Move that flash (/disk, for general PCs) over to another machine, as a secondary storage device, and the key can be read by that other machine. Sure, the key is usually encrypted; you won't find it in cleartext. But the OS/Application knows how to decrypt it. It must know, in order to decrypt the info for the proper user. But in a standard version, the OS/App refuses to do it until the operater has authenticated himself. The special OS edition on the other machine may be willing to decrypt the key without the the owner authenticating himself, e.g. presenting a password or fingerprint. Couldn't that info, given by the user, be (part of) what encrypts the key, so that an intruder would have to know that? But the OS knows that, too. It must know the PW (or some transformation of it) in order to check that the user gives the right one. So the alternate OS version may pretend that it has just read from the user a PW corresponding to the expected one, even if no user ever specified anything. Whether you install the alternate OS version on the same device or you move the storage device (flash/disk) to another machine makes no essential difference, as long as there exists a possiblity for loading a new OS version without logging in to the machine. In the old days, that wasn't always the case, but with modern automatic over-the-air updates and fixes, it it probably possible to replace all essential parts of the OS that way. The only safe encryption is where you are the one generating the key, the only one knowing it, and you never present it to the OS or to any application. For standard PC use, I would like to have a USB dongle where I can load, say, my X.509 certificates into a flash area that is not adressable across the USB interface; only the processor in the dongle can see it. So the PC sends the ciphertext across the USB interface, the dongle decrypts it, and returns hte cleartext to the PC across the USB interface. (Or it receives cleartext and returns ciphertext.) In many applications (such as S-MIME), the ciphertext will not be the full document

[Andy Hoffmeyer]

"The Gov isn't asking hem to unlock EVERYONE's phone" No, that's exactly what the government is demanding. They want a tool that will unlock any iPhone. And that is a dangerous precedent. If history has taught us anything, it is that no government should be trusted, at any time, to do the right thing, when the wrong thing is an option. It also represents a significant reduction in security, whose primary purpose is preventing hackers/crackers from gaining access to your data. If a backdoor is created, attackers will find it, and they will exploit it.

What can this strange device be? When I touch it, it gives forth a sound It's got wires that vibrate and give music What can this thing be that I found?

[Plamen Dragiyski]

I do not understand what it means "No". The article says the authorities have the device. So if the device could be unlocked (it doesn't matter if it is, it matters that it could), then everyone could unlock the iPhone (okay, without a source code it takes a little bit longer, but not so much). If the device is strongly encrypted (as it should be), no backdoor may unlock it, instead a strong encryption would take several million years to brute force for a super computer. Finally if the device is not really encrypted, or private key could be reached by the hardware or it is obfuscated, then device is already unlocked, just use the right tools (obfuscation is not a security, but prevents power users to poke around the device). So what it means "We could, but we said "No"!"? Are the iPhone's are really secure or they're just secure, because normal users does not have proper hardware/source code (first is easy to create, second could be reverse-engineered). A really secure device should be impossible to be unlocked by its manufacturer, unless wiped out.

[User 12302808]

> the good of the many outweighs the good of the one well the world does not work this way (or neither of us would sit in front of a computer and talk about this) - *remember*: we (as in *the west*) are not *the many* when you see it globally And the context here really matters: it's not for the good of anyone if Apple give in - the *bad* will just go and use some other - more secure - means of communication, while we all would lose even more of our privacy. > “If privacy is outlawed, only outlaws will have privacy.” (Philip Zimmermann)

[TealHaze]

From my understanding of what is being requested is to have a version of iOS that will not wipe the device if the incorrect password is typed more than 10 times. If the Feds can have a version of iOS that will allow an unlimited number of password attempts, then they can eventually type the correct password and access the phone. I suspect the source code to allow an unlimited number of sign-in attempts before wiping the phone is a pretty easy code change.

[dgreenx]

Once someone is convicted of a crime, have they not given up their right to privacy? Like a felon has given up the right to vote? I'm not for spying on innocent citizens, but what about citizens that have been proven to NOT be innocent? Liberty comes with a price, and so does wickedness.

[MikeTheFid]

I think it extremely interesting that the government is forced to go to the manufacturer to get the data. The entire situation itself indicates that the government (which obviously includes the NSA) isn't all powerful when it comes to invasion of personal privacy. I have to admit, my first reaction was, "why can't they just give the damn phone to Apple and have a government (FBI) representative (for chain of evidence reasons) present when the data is produced." That way the code-breaking capability doesn't leave Apple's "clean room" and reduces by many factors the vulnerability of such a program escaping into the wild. However, if Apple did such a thing, the government would be knocking on their door to do it again in less time than it takes to say iPhone. Ah those pesky precedents. I'll be stepping out shortly to get more popcorn for the rest of the show. Talk amongst yourselves.

Cheers, Mike Fidler "I intend to live forever - so far, so good." Steven Wright "I almost had a psychic girlfriend but she left me before we met." Also Steven Wright "I'm addicted to placebos. I could quit, but it wouldn't matter." Steven Wright yet again.

[Plamen Dragiyski]

So what, if someone steal your device, he/she cannot unlock it unless connects directly to processor bus (yes, there are devices that could do that). Normally such hardware price is high in the skies for normal users (which stealing person usually is). I don't think government cannot afford such a hardware, so besides legal problems why do they need Apple. Yes, modifying source code is easier, cheaper and faster, but modifying machine code is not that difficult.

[Jim McCool]

While I absolutely oppose inserting a backdoor into any security, this case is a bit different in that the owner of the phone also wants the security hacked. I have no problem with that, as a one-off hack. Most of us use company resources for personal (email for instance), but I don't pretend that anything that touches a company server is private. It's spelled out in company policy. the same applies to a company phone. All those records and content belong to the company. If an employee is stupid enough to give private information to the company, it's on them.

[Jim McCool]

While I absolutely oppose inserting a backdoor into any security, this case is a bit different in that the owner of the phone also wants the security hacked. I have no problem with that, as a one-off hack for the owner

[Bill tK Lewis]

The courts. Just like getting a warrant for anything else. The authorities would have to prove "just cause" to obtain a warrant. If your spouse, child or parent were being held hostage and the authorities got the phone of one of the abductors, and it was hoped that information in the phone might help lead to their recovery, wouldn't it be worth it?

[scmtim]

Actually they aren't asking Apple to unlock one person's phone. They are asking Apple to create software that can unlock that iPhone, which could then obviously be used to open any other iPhone or maybe any iDevice. If the government said they wanted to create a strain of Super Ebola transmittable through the air so they can study it. You know, just in case it naturally mutates that way we can be prepared. Don't worry we will keep it safe in just one lab in San Bernadino where only authorized scientists will have access. Would you be OK with that? There may be nothing useful in the phone at all. Everything that can fall into the wrong hands will fall into the wrong hands. Once that software is created, it will leak. Then every lost iPhone means that person loses every dime in their bank accounts. If a thief gets your phone they can log into your bank app and transfer funds. Even if you don't have the password saved, they can reset your password because your e-mail password is auto-saved. Heck it could even mean a huge spike in iPhone theft once the thieves have the tools to make so much more money from each stolen phone.

[Mike Hankey]

Just cause is a very broad term. I was pulled over in Texas and they searched me and the vehicle that I was driving because the officer said that my Garmin was obstructing my view. It was on the windshield under the rear view mirror just like thousands of other people. He stopped me because I had long hair and he just knew I was transporting drugs. In other words just cause is a fabrication, it can be anything.

New version: WinHeist Version 2.2.2 Beta
tomorrow (noun): a mystical land where 99% of all human productivity, motivation and achievement is stored.

[Bill tK Lewis]

NOT so -- in the case of getting a warrant or court order. The authorities have to PROVE that just cause exists to a judge. In your case (which I'm sure happens a lot more than we realize), the officer "bluffed" just cause which may or may not have held up in court after the fact if the stop had been challenged. To get a warrant or court order - they start off in court proving their case