Add Comment

FORMATTING HELP

All Comments Hide marked as read Mark all as read

  • Posted by ProfChuck 8 years, 2 months ago
    There is a question that so far no one has asked. "Is it possible to do what Apple is being asked to do?" As I understand it the phone in question has the latest version of Apple's encryption software. A friend that is in a position to know such things tells me that Apple went to great lengths to create a system that was so unbreakable that even if you know exactly how it works it is still impossible to crack. If this is the case the real reason that Apple is resisting the court order is that they are unable to comply not that they don't want to.
    Reply | Mark as read | Best of... | Permalink  
    • Posted by $ WilliamShipley 8 years, 2 months ago
      I've been playing catch-up on this issue. I believe that the situation is that the phone prevents someone from using brute force to guess the password because it delete's the contents after 10 incorrect guesses. What the government wants them to do is to write a special version of their operating system that disables this feature so that they can guess the password by brute force.

      That seems certainly doable and would not be something that Apple would want to have out in the world.
      Reply | Mark as read | Parent | Best of... | Permalink  
      • Posted by ProfChuck 8 years, 2 months ago
        There are easier ways to accomplish that. One can make mirror copies of the phones memory without altering any of the contents and then experiment till the cows come home. The problem is that there are trillions of possible combinations of password protection so It can take a long time to test them all. It is likely that the encryption system uses a trapdoor algorithm where the answer is a function of operations on thousands of prime numbers. It is possible to find the answer but to open the door you must know the question. It may be that even Apple can't do that unless they deliberately built a back door into their system which is unlikely.
        Reply | Mark as read | Parent | Best of... | Permalink  
        • Posted by $ WilliamShipley 8 years, 2 months ago
          Interestingly, I thought about that. I believe the number of likely passwords is manageable - the default being a 4 digit number. One can certainly brute force a 10,000 number universe. Using up a phone, real or virtual, every 10 tries makes this a tedious and expensive proposition.

          I'm pretty sure it's not the password itself they want to disable, just the automatic delete.
          Reply | Mark as read | Parent | Best of... | Permalink  
          • Posted by ProfChuck 8 years, 2 months ago
            The password to the phone is 4 digits, unless he uses the fingerprint scanner, the password to an encrypted file can be up to 24 alphanumeric plus special characters. That's a lot more difficult. Decoding a mirror file would not self destruct after 10 tries.
            Reply | Mark as read | Parent | Best of... | Permalink  
          • Posted by slfisher 8 years, 2 months ago
            There are three factors the FBI wants Apple to circumvent:
            The automatic delete
            The limitation on entering the password only through the screen, not through a device
            The automatic pause between password attempts.
            Reply | Mark as read | Parent | Best of... | Permalink  
        • Posted by $ blarman 8 years, 2 months ago
          That's because they use public-key encryption. It basically requires two encryption keys (think really long passwords) to decode anything. One of the keys gets transmitted to the user or is maintained by Apple, but they are unique to each phone. That one Apple could ostensibly get a hold of. The other, however, is unique to the phone itself and of such a binary length that hacking it is impractical to say the least. If you are not the user of the device with the proper key, you can run cracking algorithms against copies of the device literally for decades on an array of supercomputers and still not get anywhere.
          Reply | Mark as read | Parent | Best of... | Permalink  
  • Posted by davidmcnab 8 years, 2 months ago
    Be it known, Ladies and Gentlemen, that there exists a class of encryption technology which by its essence will stop agencies like the FBI in its tracks, and will even disarm their legal powers.

    It's called Plausible Deniability Encryption, and was invented by a small team of people led by software developer, WikiLeaks founder and political fugitive Julian Assange.

    How Plausible Deniability Encryption works is by letting the user set as many different passwords as they like. Each password, if entered, reveals different areas of data. Unless a password is entered, there is no technical or mathematical proof that an area of data even exists. Government agents, when inspecting a Plausible Deniability data store, will just see random gibberish. They will have no idea whether there are zero, one, two or even 30 separate data areas. The only way to prove a data area actually exists is to first posses the password which unlocks it.

    If a suspect is being detained and pressured to disclose "the decryption password", they can provide one or two passwords to unlock a couple of the data areas, but only ones of low to medium sensitivity. For instance, a political activist may choose to unlock a semi-sensitive area that will expose them to a month in prison, but the feds won't be able to prove that more sensitive data - the 20 years in supermax kind - even exists.

    I'm not sure how many Plausible Deniability Encryption products there are out in the wild - fairly few if any at the moment I'm guessing.

    I wrote a working proof-of-concept prototype for one, inspired by aspects of Assange's first version, but mothballed the project due to lack of funds. At the time, it got a good write-up in the tech blogs, so it was sad to let it go. What are your thoughts about the commercial viability of such a project, were I to resurrect it and fundraise for it?
    Reply | Mark as read | Best of... | Permalink  
    • Posted by $ WilliamShipley 8 years, 2 months ago
      Interesting. Aside from the practical issue of having to remember a lot of passwords there is the issue of hiding the existence of files from someone who can do a binary dump of the storage medium.

      Presuming you use a standard operating system data structure to manage your disk files the existence of a file must be in the directory or at the very least it has to be ruled out of new allocations. I suppose you could go the 'superfile route' but there is still the ability to compare the data present and not present and detect that you are holding out.
      Reply | Mark as read | Parent | Best of... | Permalink  
      • Posted by davidmcnab 8 years, 2 months ago
        Good point, William, and deserving of a prompt answer.

        How this is addressed is by the Plausible Deniability Encryption (PDE) software pre-creating a large file of random gibberish, feeding for entropy from user mouse movements, keyboard, plus other system PRNG sources. The user declares their maximum requirement for data storage, and the system allocates an entropy file 3-10 times bigger (though the user can change this), and allocates the user's chosen partitions within it. The data used by the partitions is non-contiguous, and the partitions and chaff are all AES256 encrypted, with separate keys.

        Then, when a partition is used, its directory structure is AES256 encrypted using a hash of the user's password. The use of separate symmetrical keys, plus the rolling cipher, offers protection against birthday attacks,

        This means there is tremendous cost of discerning AES-encrypted white noise from AES-encrypted plaintext. This cost can be raised further by random download and utilisation of text in the user's native language as a source of 'chaff', similarly encrypted but with yet another key.

        Once the one big monolithic file is created, it should never grow or shrink in size and, ideally, should not be hosted on magnetic media. SSDs are fine. This eliminates the risk of extracting deltas from residual magnetic charge on disk sectors.
        Reply | Mark as read | Parent | Best of... | Permalink  
        • Posted by $ WilliamShipley 8 years, 2 months ago
          So you went the 'superfile route'. I can see that would work. Clearly the partition structure itself must be encrypted since the goal of plausible deniability is to hide the very existence of data. The person doing the cracking must not be able to determine the size of the actual data.
          Reply | Mark as read | Parent | Best of... | Permalink  
  • Posted by johnpe1 8 years, 2 months ago
    IF apple has given its source code to china, then
    the FBI should have it by now. . or else, they are
    falling behind in the international spy race. -- j

    p.s. whatever happened to the world in which
    the FBI worked inside the u.s. and the CIA
    worked outside?
    .
    Reply | Mark as read | Best of... | Permalink  
  • Posted by Herb7734 8 years, 2 months ago
    The two key words of the article are "if true."
    Did Apple give the info to China? Are the Apple people so greedy that they'd break their own business rules in order to acquire a market? If so, to hell with them. If on the other hand, they have maintained their security protocols to everyone, we can say hurray for them, and the government has no right to the information under any form of law congruent with the Constitution. One thing that hasn't been explored in the article is how badly China wants iPhones. Are they willing to give up the use of them and the commerce they will bring over what they know is a highly unlikely situation? For now, I'm with Apple.
    Reply | Mark as read | Best of... | Permalink  
  • Posted by davidmcnab 8 years, 2 months ago
    It's good this scenario has come up. It will help the mobile vendors raise the bar with personal security, especially since there's a clear market demand for it.
    So what next? Banning the sale of uncrackable mobile devices?
    Reply | Mark as read | Best of... | Permalink  
  • Posted by $ Olduglycarl 8 years, 2 months ago
    Different country, different rules, no power, no protection and a government that would not hesitate to hag your butt?

    Would pulling out of china been a option or was it more important to keep the population of a communist country connected to the rest of the world?
    Not that I think Apple thinks this way, rather I'd hope that at least someone brought up that thought.
    Reply | Mark as read | Best of... | Permalink  
  • Comment hidden by post owner or admin, or due to low comment or member score. View Comment
  • Posted by ut91t05 8 years, 2 months ago
    Apple should make their decisions based on what is in the best interest of Apple. If they make the wrong decision the marketplace will point out the error of their ways
    Reply | Mark as read | Best of... | Permalink  
    • Posted by $ 8 years, 2 months ago
      I agree except to the extent that Apple has provided this service at the request of the government 70 times and that this instance was for a 100% certifiable terrorist who killed Americans on American soil. Of all those instances, why choose this one to deny? There could be leads, evidence, or potential plots on that cell phone that are time critical. Logically, it makes no sense unless 1) the gov didn't follow procedure or 2) Apple has something to hide in this case.
      Reply | Mark as read | Parent | Best of... | Permalink  
      • Posted by johnpe1 8 years, 2 months ago
        the "service at the request of the govt" -- hacking their
        own equipment and providing the information?
        that is the service which I wish the FBI would
        accept, in this case. -- j
        .
        Reply | Mark as read | Parent | Best of... | Permalink  
        • Posted by $ 8 years, 2 months ago
          its not a hack if Apple makes their own backdoor for their own use to provide needed information when the government lawfully requests it.
          Reply | Mark as read | Parent | Best of... | Permalink  
          • Posted by johnpe1 8 years, 2 months ago
            understand. . I heard 2 new things tonight, about
            this. . one is that Apple told the feds not to try to
            change the password, and they tried anyway. . the
            second is that the feds have only asked Apple to
            retrieve the information from the phone, and Apple
            has said that they cannot. . the first was from a
            major cybersecurity expert on Fox News, and the
            second was from their former CIA guy Mike Baker.
            there is definitely more to this than the lawyers
            on TV are telling us. -- j
            .
            Reply | Mark as read | Parent | Best of... | Permalink  
  • Posted by $ sjatkins 8 years, 2 months ago
    Apple has no real leverage in China. It does is a supposedly free country that it is home that is supposed to obey the 4th Amendment. There are many things I don't like so much about Apple. But in this case they are taking an admirable ethical stance and I am deeply grateful that they are.
    Reply | Mark as read | Best of... | Permalink  
  • Posted by $ jlc 8 years, 2 months ago
    I have been trying to keep track of this issue, and for me it now boils down to, "The owner of the phone has asked that it be unlocked." so the Feds asking Apple to help access the contents of the phone is akin to the cops coming to my home and calling a locksmith to open my front door when I have accidentally locked myself out:
    'I' as the owner, have requested access to something that is 'mine' and, in this case, the gov is working with 'me' (aka County of San Bernadino) to accomplish that.

    Insofar as China is concerned, the article offered suppositions but no proof. I think that it is going to do more damage to socialism in China for people to have iphones even if their gov has one more way of keeping track of their people. Do you know about the codes that the Chinese people are spontaneously developing to keep from being tagged by trigger word searches? https://www.youtube.com/watch?v=yrcaH...

    Those river-mud-horses are not able to keep the lid on the Chinese people.

    Jan
    Reply | Mark as read | Best of... | Permalink  
    • Posted by slfisher 8 years, 2 months ago
      It's like that, except it's like the locksmith from then on having a master key to every door like yours, and there's millions of them, and the government can then demand that the locksmith hand over the key to any door it chooses, or the key can be stolen from the locksmith.
      Reply | Mark as read | Parent | Best of... | Permalink  
      • Posted by $ jlc 8 years, 2 months ago
        I agree that that is what we must prevent. If Apple could hack the phone, enter a new password and then remove the OS change before handing the phone back to the gov, then the FBI would have access to the material in the phone but not to the master key.

        Jan
        Reply | Mark as read | Parent | Best of... | Permalink  

FORMATTING HELP

  • Comment hidden. Undo