FBI Can't Win: Apple Engineers Will Quit Before Unlocking iPhone
- Thread starter LJ Ellis
- Start date
I hate apple, I really do. But in this case, I'm totally on their side. The FBI is looking for a frankly dangerous court precedent here: namely one that allows them to legally compel anyone to do anything in the name of preventing terrorism or face trouble in court. Basically, it would give them carte blanche to make internet and phone providers do what they were doing before under the patriot act.
I think a lot of people tend to forget that the constitution was put in place to protect us from the government. Keeping them from coming into our homes and businesses and forcing us to do what they want would definitely qualify.
I think a lot of people tend to forget that the constitution was put in place to protect us from the government. Keeping them from coming into our homes and businesses and forcing us to do what they want would definitely qualify.
It's a hypothetical situation. It's that way because I said it was, I created it. It doesn't have to conform to anything you accept or even hold up to iron clad logic. A dissection of the question is not the purpose of most hypothetical situations and serves no purpose here.Deathfish15 said:
The point is - would they and should they still say no in that situation? Where does the line get drawn, I wonder. It's not a question to argue for or against it, it's just a hypothetical question.
Except it isn't that simple. Encryption services, such as telegram or WhatsApp, are readily and freely available, with new ones popping up every day. There was one a while ago that was essentially a heavily encrypted version of snap chat, wherein the message would be deleted after an amount of time determined by the sender. So even if Apple were to lose this court case, it still would NOT ultimately help the issue you so sarcastically brought up. The issue here is regarding the legal precedent the case will set.Rastrelly said:
That's the thing. There's no evidence that these people are a part of an organized terrorist cell. Claiming that the evidence might be inside the phone is a bad argument. You can say that about anyone who committed any act of violence or civil disobedience. And we've already seen how the government labels people terrorist with ease. Who the fuck would in their right mind give the authorities such a power? It's insane. Setting such a strong precedent that gives the government overwhelming power based on an assumption that it might kind of sort of maybe be useful is a TERRIBLE idea.Rastrelly said:
It's not just about Apple. This would affect every other tech giant and not just in the US. And it wouldn't be a very good publicity stunt. Imagine all the people who could be buying an iPhone right now but they might be waiting to see what becomes of this. Apple is right to raise such a ruckus over this. A part of their defense is educating people on the importance of strong encryption.Arnoxthe1 said:
You're somewhat right. 2048 bit encryption only refers to asymmetric key cryptography, which is not what's being used here. I haven't had a chance to work with iPhone Decryption, but based on literature in the field it basically works as follows:iseko said:
Step 1: Provide a Passcode (usually a 4 to 6 digit number)
Step 2: The passcode is hashed with a unique identifier on the phone. At this point the OS will add one to the number of login attempts. If this number exceeds 10 wipe the iPhone encryption key used in step 3.
Step 3: This hash is used as a key to decrypt the iPhone's storage key which is unique to the phone. This key was generated in a secure manner when the phone's file system was first formatted.
Step 4: Verify a hash of the decrypted key to ensure that the decryption was successful. If it was successful reset the login counter to 0. If it failed check if the login counter is now ten if so erase the iPhone encryption key used in step 3.
Step 5: You're either logged in or back to step 1.
Odds are the iPhone uses some AES256 variant like they were back in 2014, which is hard to crack, but brute forcing a 6 digit number isn't. However to brute force this number you would need to get access to the encrypted key, which is possible by physically removing the chip a technique known as chip-off.
This does have a few hard parts to it which are:
1. You risk damage to the chip and thus the data.
2. You need to know how the flash controller works so you can emulate the flash translation layer (FTL).
3. You need to know how the file system works.
4. You need to write a tool to decrypt the encrypted file system once you have the key since putting back on a flash chip once it was removed is nearly impossible.
Assuming a competent team was starting from scratch this process would take about a year... which is likely less time than this issue will sit in the courts. If the team had access to Apple engineers who were willing to share details about the flash translation layer and file system it would take significantly less time.
Yeah... a company like... pApple.Gorrath said:
They are a new company that makes cell phones, and cell phone accessories.
I'm so confused about this subject. So if I get hammered because my wife left me and fat finger my passcode too many times in an attempt to drunk dial her, does my iPhone just lock me out permanently? Erase everything? If I take it to a Genius bar will they just tell me to eat shit and buy a new one?
It erases the decryption key for your phone, which effectively erases everything. The difference is that it takes far less time.LetalisK said:
Only if you have that turned on. It's under Settings>Touch ID & Passcode> Erase Data.LetalisK said:
It's about setting a precedent. As soon as the courts say the F.B.I. is in the right, they'll use that example for all other cases (think they have 12 right now) to force compliance down the road. They're not trying to win this one fight, but all the others down the road. The F.B.I. is using this case in particular to argue because it sounds so good in the media. (Apple wont help us fight terrorists!!)BoogieManFL said:
The argument I've heard is that they ARE able to work together to hack a cell phone but the technology they would have to use to do it would be in the hands of the CIA if it does exist, if it does exist it would be very much in the interests of the CIA to keep it secret. If they do in fact find the threads of another terrorist plot the FBI would have to reveal how it is they know what they know to a court in order to get warrants and such things and then the technology and the way it works would no longer be secret.Deathfish15 said:
So even if they could they can't, it makes no sense to spend millions developing top secret tools and then immediately reveal their capabilities, of course you could also argue that if you can't lend them out to different agencies why spend so much developing them?
The solution would almost be to let the FBI create their own tools with an additional budget but if they share the same capabilities and modes of operation of the CIA tools then it won't matter because everybody else would still know what to look out for and perhaps develop a means of defeating them.
It's a very strange problem.
I just asked this in another thread but this one is more directly set on this. Let me propose a specific solution to our concerns and I'd love it if an expert could tell me why this wouldn't work (I will admit to having extensive pc security training though my job does not revolve around setting up security so much as getting through it on an upper level so I wouldn't consider myself an expert but would call myself familiar):
Let's say that they created a back door for new phones and such from the start. Something like bit locker that a key word could unlock. If left there, anyone who knew the word would get in. Now, let's say that the key word was tied to an algorithm that itself was under encryption with no back door. If left there, if the encryption ever got out or was successfully reverse engineered (not sure if non-back door encryption on it would prevent that) then anyone having it would be in. Next, let's include safety measures like it unlocking requiring second and third factor authentications that could include encrypted communication with a machine that has to be in physical range. Second and third factor authentications virtually remove the possibility of external success in cracking something. If it was even tied to specific machines that had to be physically present then that would destroy almost any kind of access I could think of even if an employee stole and released the algorithm.
Sure, you'd have workers on site that could abuse their access to the key algorithm and the physical devices for multi-factor communication, but they would be under incredibly close scrutiny and would be let go pretty darn fast by the people watching them and then that would be it (not to mention the employee would actually have to be the sort of person that can obtain a device containing information they'd want to hack). Combine it with stringent human management like making any device go through two random employees for the process and individuals may not even actually have access to both parts.
Surely there are ways like this that would ensure phone security for many years if not a decade. Two-factor authentication is currently amazing successful and if they tweaked it in the ways I specified then there would be nothing more secure on Earth that I know of. Even an offline machine you have to manually log into would be less safe than this.
Let's say that they created a back door for new phones and such from the start. Something like bit locker that a key word could unlock. If left there, anyone who knew the word would get in. Now, let's say that the key word was tied to an algorithm that itself was under encryption with no back door. If left there, if the encryption ever got out or was successfully reverse engineered (not sure if non-back door encryption on it would prevent that) then anyone having it would be in. Next, let's include safety measures like it unlocking requiring second and third factor authentications that could include encrypted communication with a machine that has to be in physical range. Second and third factor authentications virtually remove the possibility of external success in cracking something. If it was even tied to specific machines that had to be physically present then that would destroy almost any kind of access I could think of even if an employee stole and released the algorithm.
Sure, you'd have workers on site that could abuse their access to the key algorithm and the physical devices for multi-factor communication, but they would be under incredibly close scrutiny and would be let go pretty darn fast by the people watching them and then that would be it (not to mention the employee would actually have to be the sort of person that can obtain a device containing information they'd want to hack). Combine it with stringent human management like making any device go through two random employees for the process and individuals may not even actually have access to both parts.
Surely there are ways like this that would ensure phone security for many years if not a decade. Two-factor authentication is currently amazing successful and if they tweaked it in the ways I specified then there would be nothing more secure on Earth that I know of. Even an offline machine you have to manually log into would be less safe than this.