News for hackers. Stuff that matters.

A comment on San Bernardino County tweets it reset attacker iCloud password at FBI's request. Parent comment

Re:San Bernardino County tweets it reset attacker iCloud pas... by tedhogan on Saturday February 20, 2016 @02:14PM (#11141431)
This is the technical aspect that I think isn't getting nearly enough attention. While I agree with Cook that this will set a precedence where governments, both the US and others, begin making these requests more frequently, it's not actually creating a master key in this case. Apple would have to be compliant in each individual case to apply this software to another device assuming they code in the specification that it's only applicable to this device.

This still leaves them the ability to remove their ability to do so in the future, by requiring the passcode to update the firmware on both the hardware itself and the secure enclave.

[ Parent | on HN ]
Re:San Bernardino County tweets it reset attacker iCloud pas... by a3n on Saturday February 20, 2016 @02:24PM (#11141488)
> it's not actually creating a master key in this case.

The master key is the court order to make it happen, or the NSL that has been made worthwhile after the first existence proof.

[ Parent | on HN ]
Re:San Bernardino County tweets it reset attacker iCloud pas... by a3n on Saturday February 20, 2016 @02:43PM (#11141575)
Someone replied and then deleted (which is fine). IIRC they said something like "a/this court order isn't creating a master key." (my words, summarizing from memory).

Which is technically true. But consider each event a black box, into which you throw a targeted phone, and it comes out unlocked. Whether that was through unique effort for each case, a general capability developed and archived by Apple, or even an actual backdoor/masterkey developed by Apple out of exasperation from the expense of being legally compelled in each individual case and others to come, the effect is the same, the phone is reliably opened.

[ Parent | on HN ]
Re:San Bernardino County tweets it reset attacker iCloud pas... by shkkmo on Saturday February 20, 2016 @05:12PM (#11142204)
FTFY:

"assuming they can code in the specification that it's only applicable to this device."

I think that's a big assumption.

[ Parent | on HN ]