Hacker News Reader

Comment by majke | Hacker News Reader

Mr Zdziarski gave this talk also at the HOPE conference yesterday. It's highly recommended. Slides:

http://www.zdziarski.com/blog/wp-content/uploads/2014/07/iOS...

For the people wanting to secure their iphone, go to the end to the slide "Apple Configurator" and follow the described steps to disable your iphone from paring with anything.

View on HN

Thank you very much - bookmarked.

BTW, Apple is missing a great opportunity in my opinion. They don't need a ton of user data to make money and could evolve into the secure consumer device company. I see only upside for Apple if they work towards making as secure as possible devices.

> evolve into the secure consumer device company

They don't have this option. They are too big to not cooperate the US law enforcement and intelligence communities. They must cooperate, it's given. There are just way too many pressure points that can be exploited to make them cooperate, even against their will. If they start selling themselves as a secure and trustworthy device manufacturer you can rest assured it's just lip service and pure marketing.

OK, thanks. Our government has ways to get what it wants.

I disagree...Apple's size makes it ideal for resistance - the government has been very pro-business for the last decade, and congress has been way too receptive to lobbying groups. If Apple, Google, and a few others really put some muscle into it, they could make a real difference.

Lobbying against environmental or financial regulations is one thing. Taking on the national security state is something else entirely. I don't think it's loony or hyperbolic to say that the military/intelligence world really runs the U.S. at many levels. The U.S. has been a national security state at the highest levels since WWII transformed America from a civilian-centered economy to a military one and created what Eisenhower called the "military industrial complex." The whole topic makes for very interesting history... look into the national security act of 1947 for a starting point.

At lower levels you have a vestigial democracy and true "independent" free enterprise, but when you get to be a company the size of Apple you are too big to blend in with the ordinary civilian economy. Getting that large results in immediate audience before the king, which in America is the military/intelligence shadow state. I'd be very surprised if one can ascend to the billion-dollar stratum in America without some very interesting closed-door meetings with strict NDAs. I'm also sure that all kinds of next-level stuff kicks in when you start to become a major international corporation that does heavy business overseas, as Apple is.

There are endless forms of soft power that can be brought to bear against a large company, especially a publicly traded one. You've got the standard issue tax evasion practices of every major corporation for starters. Don't want to help us spy on users? How about a high-resolution IRS audit and some "offshore banking reform" specifically targeted at you? Then there's anti-trust, which is obviously selectively enforced. Does Apple have anything that could be called a monopoly or a monopolistic business practice?

They are doing this already, but you're not going to see a more secure software stack until the laws change.

but they DO have the option of designing their hardware and services to minimize trackable data, to get as close to "zero knowledge" as possible. The government cannot force them to collect data, only share data that they have collected.

For example, there are alternatives to Dropbox that do this: http://www.theguardian.com/technology/2014/jul/17/edward-sno...

Hmm, interesting point actually.

Lavabit shown the government can demand installation of their own surveillance equipment on a company's premises to gather that data themselves. I wonder if they could make the same demand on a company like Apple to install their own back doors if Apple decided not to collect that information themselves.

Governments can force them to do anything: they know where Tim Cook lives and can ruin his life six ways from Sunday. Really, other than all the selectively enforced laws that exist already, all governments have to do is start passing laws that say "all communication systems must be interceptible by the government". Indeed CALEA already does this, but it's (again) selectively enforced.

I don't know where this ends, but I suspect it ends up with lots of computer programmers rotting in jail, others going underground and everyone just accepting that they live in a totalitarian state run by the military, which constantly brainwashes its children to believe they live in the best country in the world.

There's another reason this won't happen: very few users really care.

If users really wanted it and clamored for it and showed a clear market preference for secure and privacy-respecting companies, then you might get somewhere.

Let's imagine a non-zero subset of users who care, today.

What would they buy, today, in order to "show a clear market preference"?

It's a bit difficult to show statistical evidence of people making choices which are unavailable to them.

Whilst I see your point, and I would love a major mobile device manufacturer to enter that space, there's a large barrier for Apple: the underlying operating system is not open source. Whilst that remains the case, the question of security ultimately breaks down to Apple saying "Trust Us". Given recent revelations, that's not something that should be afforded to any company that fails to demonstrate a commitment to protecting the personal data of it users from everyone including itself.

A 3rd party audit of the source would go some way toward building that trust, but falling short of a publicly available code-base allowing independent verification, I doubt it would be enough.

I'm confused. Normally one cannot "pair" a device without entering the passcode to unlock it.

Is this not the case?

Yes, but one issue is that you could be pressured into pairing the device. Or someone can brute force the passcode to access the pairing UI.

The slides mention a way to bypass pairing, but I don't think ever mentioned how.

Apple can boot the device over USB using a custom image that doesn't require the passcode. Other people can't because it needs to be signed with Apple's key in order to run.

Got it. But if you say "don't allow pairing" they're SOL from a software perspective? I find that hard to believe... but either way, who knows really.

Yes, the device needs to be unlocked to pair it, otherwise it doesn't access to the keys needed to create the pairing record. The pairing record (stored on your desktop) helps avoid needing to unlock the device for subsequent access.

I believe the device still needs an AfterFirstUnlock key to decrypt the escrow keys, so a cold-booted device wouldn't be accessible even if it was paired.

Is there a video of this talk?

I haven't found the specific talk, but HOPE 2014 has live feeds (July 18-20), and "archives" although it seems the archives are not up yet.

http://radio.hope.net/feeds/

http://radio.hope.net/archive.html

http://radio.hope.net/

Thanks!

Step 1: buy a Mac :-/

Not exactly.

> iPhone Configuration Utility 3.6.2 for Windows

http://support.apple.com/kb/DL1466

Has anyone tried using the configurator? I'd give it a go but it looks like it might completely wipe devices prior to applying the settings.

yeah, if your device wasn't supervisioned before it would clean install - i guess but i haven't tried and/or checked otherwise if you can than reapply your backup.

I found a way: you can apply the restriction to a non-supervised device, which simplifies the process. You don't need to re-install or wipe.

Just create a profile with the restrictions, then follow the instructions at: http://support.apple.com/kb/HT5833

(Edit to add: It's actually unclear if the non-pairing restriction gets applied when using this method, it doesn't seem to get listed in the profile details once on the device)

It does not. The Allow pairing with non-Configurator hosts requires that the device be supervised.

That is optional. (Source: Me, administers over 100 Apple devices with Configuration in day-to-day operations.) The software is so-so, but asynchronously managing USB connected devices is annoying, even with a shiny Apple interface.

Reply on news.ycombinator.com