> We recommend that all mobile device makers do the same.
Kind of insencere when the biggest competitor has been doing this since 2013 (the feature is marketed as “secure enclave” by Apple)
Kind of insencere when the biggest competitor has been doing this since 2013 (the feature is marketed as “secure enclave” by Apple)
The iPhone 5c came out in 2013 (and was a budget device based on the hardware design from 2012; the iPhone 5s--which I believe, though would happily be proved wrong, had already fixed this issue--actually came out at the same time as the iPhone 5c). I have no love for Apple (clearly), and I think they (and, sadly, the EFF) were being disincenuous at the time about the definition of "back door", but you are just spreading misinformation here: "as of 2016" would imply the iPhone 7 was vulnerable, which is a much newer device than the one from the infamous San Bernadino scenario :/.
For those who are unaware, Saurik created Cydia, the package manager for jailbroken iOS devices, as well as a whole bunch of jailbroken iOS-related software.
To mitigate these risks, Google Pixel 2 devices implement insider attack resistance in the tamper-resistant hardware security module that guards the encryption keys for user data. This helps prevent an attacker who manages to produce properly signed malicious firmware from installing it on the security module in a lost or stolen device without the user's cooperation. Specifically, it is not possible to upgrade the firmware that checks the user's password unless you present the correct user password. There is a way to "force" an upgrade, for example when a returned device is refurbished for resale, but forcing it wipes the secrets used to decrypt the user's data, effectively destroying it.
So while you do have to provide your passcode to update an iOS device, it could be that this requirement is only enforced at a higher level (ie. not by the secure enclave itself).
It wasn't a matter of feasibility, Apple could have done it but refused to.
You mean Samsung?