Comment by xnull2guest | Hacker News Reader

Comment by xnull2guest | Hacker News Reader

Parent Full thread

I'll reply the same way as before (likely to end with the same result). Here is a much, much better source.

Apple's announcement itself:

"Unlike our competitors, Apple cannot bypass your passcode and therefore cannot access this data. So it's not technically feasible for us to respond to government warrants for the extraction of this data from devices in their possession running iOS 8."

https://www.apple.com/privacy/government-information-request...

"Specifically, Apple has radically improved the way that data on those devices is encrypted. Once users set a passcode, Apple will no longer be able to unlock your device—even if ordered to do so by a court."

http://www.slate.com/articles/technology/future_tense/2014/0...

"To get started, it's worth pointing out that disk encryption is hardly new with iOS 8. In fact, Apple's operating system has enabled some form of encryption since before iOS 7. What's happened in the latest update is that Apple has decided to protect much more of the interesting data on the device under the user's passcode.

...

So to a large extent the 'new' feature Apple is touting in iOS 8 is simply that they're encrypting more data. But it's also worth pointing out that newer iOS devices ... also add substantial hardware protections to thwart device cracking.

In the rest of this post I'm going to talk about how these protections may work and how Apple can realistically claim not to possess a back door."

http://blog.cryptographyengineering.com/2014/10/why-cant-app...

None of your quotes from Apple support your claim that they were able to decrypt encrypted data before. And in fact, I gave you a source right from Apple that said they couldn't -- the very document they give to law enforcement.

http://i.i.cbsi.com/cnwk.1d/i/tim/2012/04/02/police.apple.pn...

http://www.cnet.com/news/apple-deluged-by-police-demands-to-...

http://www.cnet.com/news/how-apple-and-google-help-police-by...

http://boingboing.net/2013/05/12/apple-can-decrypt-iphones-f...

http://www.theguardian.com/world/2013/jun/06/us-tech-giants-...

http://hbpub.vo.llnwd.net/o16/video/olmk/holt/greenwald/NoPl...

Haha, same thing as last time.

"Give me links as proof"

[Downvote them and not reply]

It's okay. Other HN readers know what's up.

I didn't downvote them. You can verify that I don't have enough karma to do that.

If I had to guess why you've been downvoted, I'd guess it was because you keep posting links that don't support your claim, wasting everyone's time.

Also, this is much different from last time. Last time, you didn't bother to post any links at all, even links irrelevant to your claim.

How is an article titled "Apple can decrypt iPhones for cops; Google can remotely "reset password" for Android devices" a waste of people's time? What sort of proof do you want exactly? Are you looking for a PR statement from Apple that says "we regularly decrypt your data and have backdoors build in and escrow worked out so that we can comply with law enforcement?"

You aren't going to get a nice first party source, although Apple has essentially admitted to it.

Apple says that "For all devices running iOS 8.0 and later versions, Apple will no longer be performing iOS data extractions as the data sought will be encrypted and Apple will not possess the encryption key."

You're going to interpret that as "oh hah, well some of the data wasn't encrypted before". But I included links earlier showing how Apple's (and Google's) announcement centered around the use of new technology that would not allow Apple to have a copy of the key. And if you look at the data they were pulling off, there was data that was 'encrypted' before but had engineered circumvention - 'active data' being one.

Apple will (currently) decrypt data it has in iCloud for a device. It is engineered to be very difficult to not store data in iCloud [1]. Apple's own list of information that may be in iCloud include "stored photos, documents, contacts, calendars, bookmarks and iOS device backups. iOS device backups may include photos and videos in the users’ camera roll, device settings, app data, iMessage, SMS, and MMS messages and voicemail."

https://news.ycombinator.com/item?id=8522316 for more.

Re: last time. I pointed to other areas of the thread, where plenty of sources were given.

[1] http://mjtsai.com/blog/2014/10/26/yosemite-uploads-unsaved-d...

The second part of your post shows you're starting to understand that Apple doesn't do key escrow and can't decrypt data encrypted with the passcode today or ever before. You go off tilting at windmills to show that they can get data stored in iCloud. That was never in doubt. This whole thread has been about whether they have the keys to decrypt encrypted data on the device. They don't.

> Apple ... can't decrypt data encrypted with the passcode ... today or ever before.

The passcode of 12 bits...

Apple can and will provide ciphertexts, will hand over copies of the large amounts of data customers are encouraged and sometimes forced to upload.

> This whole thread has been about whether they have the keys to decrypt encrypted data on the device. They don't.

From the top of the post: "CALEA, the Stored Communications Act and Section 215 of the Patriot Act all compel corporations (via the Department of Commerce) to build DATA AND key escrow services into their products."

What you're saying is that they don't provide key escrow specifically (while wholly ignoring data escrow). What I'm saying is that by design the crypto doesn't matter in practice and the system had been (still is) architected to allow for data intercept.

When you argue the 'no key escrow!' case you are implicitly condoning 'they won't hand over your data!'.

Not true. It was the case and _still is_ the case that Apple and its manufacturers will give access to your private communications, metadata and data.

We've focused on Apple but Google is not different.

Look up what "condoning" means. It does not mean what you think it means.

> The passcode of 12 bits...

Even the weakest passcode option is more than 13 bits, but neither Apple nor Google restricts you to such short passcodes.

> [CALEA nonsense]

How many times do people have to tell you that CALEA doesn't apply in this case? Don't you find it suspicious that Apple and Google are essentially claiming to be flouting your imaginary version of CALEA, and nobody has called them on it except you?

> Google is no different.

Exactly. They don't provide the government with decryption keys either.

It's been fun, but you'll have to argue about imaginary laws, black helicopters, chemtrails, and ice bullets with your fellow conspiracy theorists. If you won't trust primary sources and common sense, there's nothing more I can do.

> Look up what "condoning" means. It does not mean what you think it means.

Whoops typo. Care to respond to the spirit of the argument, rather than its letter?

> Even the weakest passcode option is more than 13 bits, but neither Apple nor Google restricts you to such short passcodes.

Care to break down the entropy of user supplied passcodes? Does it surpass 80 bits? No. 12, 13, 14, 24, 50? At that complexity it's all the same to law enforcement.

> > [CALEA nonsense]

Nah, I was quoting the top of the thread and capitalizing "DATA AND key escrow" in response to "This whole thread has been about whether they have the keys to decrypt encrypted data on the device. They don't." It hasn't been wholly about whether they have the keys, but whether they can get the data. Keys are one way to do this. Brute forceable keys are another. Data backups are another. Broken crypto is another. Etc.

The thread has not been about whether they have the keys - but whether they work with law enforcement to create systems can be subverted, either by creating ineffective crypto, crypto with low entropy or controlled keys, key escrow or direct data escrow.

The other point was to remind you that the topic is about more than CALEA, but in fact other laws (and interpretations thereof). You're the one who has tried to make the focus about CALEA in isolation.

> > Google is no different.

> Exactly. They don't provide the government with decryption keys either.

Right, but they do provide _data escrow_ and mechanisms to defeat in place on-device crypto (such as access to data backups stored in the cloud).

> It's been fun, but you'll have to argue about imaginary laws, black helicopters, chemtrails, and ice bullets with your fellow conspiracy theorists. If you won't trust primary sources and common sense, there's nothing more I can do.

Straw men. All of it.

I directly quoted (this is just one example) from primary sources the policies in place today that provide data escrow. I also discussed the backdoorable design of the Secure Enclave using primary documents.

Common sense is something every man thinks he has a monopoly on. It is for neither of us to decide if the other has it (for I would be prone to say the same).

I'm sorry to hear that you are done contributing - there's so much left in the thread that was never challenged. I found the conversation very valuable as it has provided (at least me) a good opportunity to dig up additional sources and has provided a stage for dissemination of information to broader eyes.

I'm very glad that the discussion is in public record, and that other HN readers can access this information, do their own research, and decide for themselves.

See you around the next Snowden thread! ;)

Reply on news.ycombinator.com