vectorjohn

> It's a very bad idea to wait until after the precedent is set to try to ensure that this does not become routine.

Well then why don't we start making this case about abortion rights precedent, for how applicable it is? This has nothing to do with the general practice of making devices backdoorable in general. It is a straight forward search of a device with a warrant.

Apple failed to secure the 5c, but they don't have to fail to secure others. I have every reason to believe they could have made the phone refuse to install updates without a user password, which would make this backdoor impossible.

No, they could have made the device actually secure without losing any ability to take a cut from app distribution. Later iOS versions do it (although it seems to be unsettled weather a backdoor is still possible in those versions). The iOS version in question has a very obvious backdoor, which Apple is understandably getting really defensive about and doesn't want that fact made obvious.

The government already does compel companies to perform work. Every other thing Apple already did to comply with the order was work. You think it was free? There are myriad examples of companies being compelled to do work to help an investigation.

If Apple could make the case that the change would be so burdensome that they can't feasibly do it without harming the company, they have a case to resist. I don't believe it, but they have to make that case.

The whole article is exceedingly disingenuous though. Which makes me not really believe their objections.

For example, calling it a "creating a whole new OS" is basically a lie. Saying it would weaken all devices is basically a lie. Unless what they mean to say is they cannot fathom a way to make a firmware that only works on one specific phone. But if that's the case they should have said that.

That's a lot of money to pay for a piece of software that only works on one phone that you don't even have access to.

But why would that be bad? It shouldn't require significant additional work, even in smaller cases. If the FBI is getting warrants to access things without actual probable cause, then we need to be outraged about that issue, not how they get access.

Well why don't we wait for that to be suggested to start getting outraged. In the case at hand, I don't believe Apple for a second that they would be decreasing the security for any other phone by complying with the FBI request. They're lying or exaggerating as far as I can tell.

The FBI or other agencies require things that cost money all the time. In this case, they offered to compensate Apple for they work. And it's disingenuous for Apple to say "create a whole new operating system". That's so absurd as to be pretty much a lie. What the FBI wants is not much more work than unlocking a door, just for more highly paid people.

And calling it "creating new technology" (not your words, but others'), is silly too. Doing almost anything with software is creating new software, but calling it new technology makes it sound like they have to go out and do a bunch of R&D and make some significant breakthroughs or something. In reality, it's a trivial thing.

To address the quote you posted, it sounds like Apple is probably lying there too. Especially given the vast exaggerations in other parts. I highly doubt they would have a hard time making a modified OS that was device locked.

But if it's really true that they can't make a device locked firmware, well, then of course I hope they win this fight.

Yes, I am trusting that. So are you. If they had the signing key they wouldn't need to ask Apple for anything.

Not at all. If they had a real skeleton key, they wouldn't need to get a warrant.

Rubber stamping is a separate issue. If that's what people were worried about, why would it be this case in particular getting everyones hackles raised? Every warrant to search a house or a car should be questioned, but this case isn't special.

> They may not even have a way to limit firmware to specific devices

They do. The new firmware may not be distributed, but it should be easy enough to make it such that if it was distributed, it wouldn't change security at all on phones other than the target.

For example:

    function handleWrongPassword() {
      if (deviceId = 1234) {
        return;
      }
      //do the normal phone stuff, like a delay or wipe
    }

Since the firmware is signed, no phone will run the firmware if you change the hard coded 1234.

Yep, exactly. If they did that, and the government was trying to somehow make that illegal, or demand a real backdoor, then it would be time to get up in arms. But that time is not yet.

The government absolutely should not be trusted. That's why Apple shouldn't give them a skeleton key to get into any phone, just the legally compelled access for this specific phone. Apple can make that happen trivially. If the government was telling Apple to make an actual backdoor for any phone, this would be different.

Nobody (except the most unreasonable) has any problem with the FBI searching property when they have a legal warrant. That's what is happening here. It's the equivalent of asking a manager to open a storage unit. This specific case is not anything like any of the examples you gave.

The most important bit is that Apple can (and in fact, was asked to) make the change only work on a single phone. As in, there is no fear of it "falling into the wrong hands" as the FUD goes. If you believe in the security of cryptography, then you believe they can make this change cryptographically device locked.

What are you talking about? Where did I say Apple has information about Farouk?

I don't misunderstand at all. I just have a different opinion than you do. However, a lot of misinformation is being spread.

The FBI isn't asking for Apple to create a backdoor. End of story. They're compelling Apple to open a backdoor that Apple already created. Apple made an insecure system. They can, and I think should fix it, but in this phone at least the back door is there.

So, wait to use a slippery slope argument when it actually becomes applicable. You're so trigger happy to jump on the privacy, precedent setting bandwagon you didn't stop to think what this case actually is.

Basically, as long as you make insecure systems, the government can (by the fourth amendment no less) demand you let them in if they have probable cause and a warrant. If you make something impossible to get into, and the government starts demanding you stop making devices like that, then we have a problem. But this particular case doesn't get us any closer to that outcome. Not even symbolically.

I think you and everyone else overreacting to this case grasps gravity that isn't there. You're tilting at windmills.

The precedent is already set (the FBI can demand information about a person from a company).

In the future, Apple could make a phone that is actually secure. For example, requiring the phone to be unlocked before updating firmware.

This simply isn't true.

if (deviceUid = 12345) { openBackDoor() }

Cryptographically sign code. Done. We know it's secure and will only work on devicd 12345 because we trust cryptography.

There is so much misinformation floating around.

The FBI wouldn't get a backdoor to all phones. It would literally only work on this one phone.

Or put another way, the backdoor is already there and Apple is being compelled to open it for this phone.

Umm, this isn't an "I have nothing to hide" argument. It's a "the government has a warrant to search a house" argument. It would be pretty dumb to argue that the FBI can't search a house if they have a warrant. In this case, they have a warrant and apple is refusing to open the door.

The point, which you missed, is that the FBI already can look through your sock drawer with a warrant. And they already can get your private information from a company's server. If you want that not to be the case, it's an entirely different argument.

How would that give them the ability to use it on any iPhone in the world? You think they put the same software on all phones in the world? Same hardware?

No, this would not reduce the net security of anyone at all. The FBI isn't asking for a master key to everything, or a backdoor to all iPhones. They're asking for the data on this one single device.

In other words, if some other party got the modified software, it wouldn't do anything. The software was asked to be device locked, which is trivial to do.

The reduced security you worry about already happened on the iPhone.

Slow down there, you're moving the goal posts way too fast.

If you have an argument, stick with it.

If Apple doesn't want to look bad complying to FBI requests, they shouldn't have put a backdoor in their software.

I don't buy that.

"By what argument would Apple fight that warrant?"

By what argument can Apple use to fight this current demand? They clearly can break into the phone.

Perfect. To fix your analogy and make it more accurate, it's more like the safe making company has the ability to make a device that can disable the self destruct capability for a single safe.

If the safe company simply hadn't built in that capability, there would be nothing the FBI could demand of them, because it wouldn't be possible.

Complying with any request for anything by the FBI costs money and time. There's no difference between that and making a trivial backdoor for one phone.

But we already know they'd lying if they said they can't "do that" now. That's why they aren't saying "we can't do that." The threat to privacy is no different weather Apple complies or not. No precedent would be set, because this isn't different than any other time the FBI has demanded documents about a person from a company.

I'm not a lawyer, so I don't know if a company has to comply when the FBI demands information for a person. But if they do, this shouldn't be seen as any different.

Do you really think it would be that hard to modify the iOS software to make a phone hackable (by brute force, like the FBI plans) without the source? It's definitely doable. If China had Apple's keys, they could trivially do it.

But it exists already! The fact that Apple can write a backdoor means there already is a back door. Apple is just refusing to open it, which I'm not sure they have a legal standing to do.

The fact that they would have to write some software or whatever is irrelevant. It's no different than if they already had a button they could press to make the phone hackable.