Hacker News Reader

Comment by FrankyHollywood | Hacker News Reader

I'm still not convinced Cook is right. This phone may very well contain information which could save a lot of lives.

According to the article, the ballpark is 2 weeks of engineering, so it is probably done in less time.

Why so quickly? Because the user used an extremely weak password.

Security is also the responsibility of the user, not only the tech companies. If you are really concerned with your own privacy, than you shouldn't encrypt your data with a 4 digit passphrase which is relatively easy to crack.

Considering the commited crime, and the relative ease of cracking the phone I'm in favor of the FBI. As long as the firmware is not handed over to them, but that should be possible I presume.

People worrying about Apple engineers smuggling the software outside should be worried everyday. People with access to the codebase can do this probably allready.

View on HN

It obviously is not about this particular phone, but if you are still convinced that is the case nothing I will say will make you move.

The real reason is the millions of other phones out there. If there was any indication that this couple was acting as the vanguard of a large number of others acting in a similar way what exactly do you think the chances are that that data would be left on a phone when they took the effort of destroying their other phone?

This is the prelude to a large number of fishing expeditions and it seems the FBI made this particular effort possible by first ordering a third party to make it impossible to reach the data in any other way. If they actually cared about that data you'd think they had contacted Apple right away about the best possible way to get it out without bringing this to a head over a terrorist case where lots of panicky people would make the wrong decision out of fear.

If you really are concerned about your privacy: don't store your important stuff in a phone or a computer for that matter.

Ironically, terrorists on a suicide mission don't need ironclad encryption. They just need to stay ahead of the law long enough to do their deed and to make sure the data flows in only one direction through their organization without leaving a source address for any transmissions. So for actual terrorists that are even remotely looking at their operational security they could be transmitting at the same level within their cell in plain text using a few silly code words and you'd only know what they were up to when the ambulances arrived.

If I understand you correctly, you think the FBI deliberately got the phone in a worse state, so there was a necessity to get new firmware?

No, I'm not saying that. I'm saying that they caused the situation to exist in the first place, whether or not it is deliberate is anybody's guess at this point in time.

Your Apple engineers smuggling code example seems a little out of left field.

I haven't been following this super closely but as the recall the FBI is essentially asking Apple to provided them with a backdoored OS that lets them get around the passcode attempt limits. Apple is concerned that this both sets a precedent while also providing the FBI with a way to get around any passcode on any iOS device they possess. Cook has stated repeatedly that there is no way to guarantee that a backdoored OS would only be used for this one instance.

You say you're in favor of the FBIs request as long as the firmware isn't handed to them - but isn't that exactly what they're asking?

They want the information on the phone right, not the firmware? (well, they want the firmware but the officially want to access the phone :)

I can imagine Apple handing over the information only...

Alledgedly, the FBI already has the information (via iCloud backup), or at least had access to the information before an FBI made error.

In any case, Apple has already been known to comply requests to hand over data on an iPhone. If it were simply the case they needed the information, Apple may have done the whole thing behind closed doors.

The FBI decided to bring this case out into the open, and given the reports about even more phones that need to be cracked open, you have to consider that this may have been a move made to force Apple's hand.

It's not this particular case that has Apple and others up in arms. It's the bone chilling precedent that the government can compel Apple to create software to compromise their own encryption protections.

The FBI directed the custodians of the device to reset the password in order to bring about this situation. Why would they do that? Because they want the precedent.

IANAL, but by that action alone the FBI's request should be dismissed with prejudice. Besides, most of the data they are seeking can be obtained by other means (such as phone carriers) as Apple points out in it's filing.

We talk about consumer electronics. This encryption is strong enough so your wife can't see who you called last night. But now it's being used by terrorists who plan attacks on a country.

I mean, an iPhone is not a heavily secured server storing Iran's nuclear secrets. If you really need to protect information, you as a user also have a responsibility.

We have laws for a reason. And the law is clear with regard to Apple's rights.

From Apple's Filing (https://www.documentcloud.org/documents/2722199-5-15-MJ-0045...)

Contrary to the government’s contention that CALEA is inapplicable to this dispute, Congress declared via CALEA that the government cannot dictate to providers of electronic communications services or manufacturers of telecommunications equipment any s pecific equipment design or software configuration.

In the section of CALEA entitled “Design of features and systems configurations,” 47 U.S.C. § 1002(b)(1), the statute says that it “does not authorize any law enforcement agency or officer —

(1) to require any specific design of equipment, facilities, services, features, or system configurations to be adopted by any provider of a wire or electronic communication service, any manufacturer of telecommunications equipment, or any provider of telecommunications support services.

(2) to prohibit the adoption of any equipment, facility, service, or feature by any provider of a wire or electronic communication service, any manufacturer of telecommunications equipment, or any provider of telecommunications support services.

True! That's why I don't understand the issue at all. It's probably the reasen the FBI went in the open, to get public presure to get what they want.

Anyway, China and Russia also act to their laws so we cannot rely on that. What if Trump takes his first shit in the White House and wipes his ass with every privacy law he can find?

Hackers should be independent of laws, provide for their own tooling which can protect people like Snowden.

People who care about privacy must take care of themselves. And if some terrorist decides to kill people and use a 4digit passphrase I won't defend the guy.

I'm not against privacy, on the contrary, having worked on compliancy/risk management software. (Some of) you guys have no idea about the crazy amount of data which is acquired about almost every person with a SSN. Kept in hundreds of databases, balancing on legal boundaries.

All made possible by law...

I see your point. In the case of countries without a strong rule of law one doesn't want to rely on legislation to protect data. Better to possess a technical means then.

Where my opinion differs is regarding "[people] who care about privacy must take care of themselves." I don't think an activist should have deep technical knowledge of cryptography in order to do activism. Doing so establishes a de facto barrier to entry. (Cryptography is hard, and not everyone has the means to acquire the expertise.)

I would actually go a step farther and advocate a responsibility of knowledgeable hackers to provide activists (whose objectives they agree with) with the tools needed to communicate securely. In the age of media ubiquity, privacy rights are sacrosanct. Something along the lines of what Open Whisper Systems is doing.

As for the terrorists case, I won't defend them or their actions. However it's still a provable fact that the FBI was in possession of a means to access the data they are seeking, yet they chose to deliberately reset the passcode and create a need for this additional access. Viewed in the kindest light possible, it's incompetency. Assuming the worst, it's an attempt to manipulate the media and the public into giving them more invasive tools to surveil citizens.

Reply on news.ycombinator.com