Hacker News Reader

Comment by mikeash | Hacker News Reader

I find this rather silly. iPhones didn't get less secure because the FBI used a known vulnerability to break into one. iPhones were that insecure all along, and the only thing that changed is that we now know it.

The article further states, "There’s no such thing as a vulnerability that affects only one device." Except that I'm pretty sure that whatever attack the FBI used relied on the fact that the phone in question had a short passcode set. I'd bet dollars to donuts that whatever attack they used would not work against my phone with a secure passphrase.

I'm usually a fan of Schneier, but I think he really missed with this one.

View on HN

This is pedantic in my opinion. The main point of the article was that the FBI found a vulnerability. So before it was likely an unknown vulnerability, now it is known by law enforcement. The whole point of the article was that responsible organizations disclose vulnerabilities so that companies can make their software/hardware more secure. In this case the FBI is sitting on it, so they can continue to use it. Last week the FBI couldn't break into my iPhone. Now they /might/ be able to (it's a 6, so who knows if it is fixed). And Apple can't fix what they don't know about. Therefore, my confidence in the security of my iPhone has diminished, and it may be less secure than it was last week.

According to the article, the vulnerability was already known by a third party, and all the FBI did was ask/pay that third party to use it on this phone. I don't see how that act alters the security of iPhones.

I agree that the FBI should inform Apple of the vulnerability they used. I just don't think that failing to do so makes iPhones less secure. Failing to do so leaves them as they are, and informing Apple would make iPhones more secure.

I don't see this as pedantic, because it's the difference between the FBI actively harming us and the FBI merely not helping us.

I do not believe the FBI can legally report the vulnerability. They did not find it, they do not "own" it. They have used a service to get to the phone's data. Even if they reverse engineered the exploit used, it would be a breach of contract to disclose the vulnerability.

I'm not sure what "ownership" is supposed to mean in this context. Legally speaking, how does one "own" a security vulnerability?

If phones are no less secure when the existence of a vulnerability is disclosed, why do we prefer security researchers to notify the manufacturer before disclosing the vulnerability?

And perhaps the vulnerability in question wouldn't work against your iPhone, but how many millions of iPhones still use a short passcode? This vulnerability could still affect all of those phones.

Disclosing vulnerabilities makes us more secure, that's why we want people to do it. That doesn't imply that failing to disclose them makes us less secure. Not doing anything leaves us where we started.

Bruce Schneier is an advocate of full disclosure. He does not believe that companies should be notified first.

Schneier has tended toward more high-level and pragmatic assessments over time. Maybe because of his "security evangelism" efforts he's trained to think more like the pragmatic layperson.

Obviously all phones technically have the same vulnerability both before and after the FBI decision. But now there is a larger pragmatic chance of it being exploited. That is the point AFAIK.

Sad to see this downvoted, it's as far as I can see absolutely accurate.

Reply on news.ycombinator.com