News for hackers. Stuff that matters.

A comment on Apple Is Said to Be Working on an iPhone Even It Can’t Hack. Parent comment

Re:Apple Is Said to Be Working on an iPhone Even It Can’t Hack by ewzimm on Wednesday February 24, 2016 @09:29PM (#11171966)
From what's been said, it seems like it was made to be updated so that Apple could easily issue security updates. They've already increased the delay between repeated attempts at password entry. Probably they were worried about vulnerabilities or bugs that hadn't been found and wanted to maintain debugging connections to make repairs easier. A tamper-resistant self-destruct mechanism with no possibility of recovery introduces extra points of failure, and it seems that until now, they didn't think it was necessary.

Look at the controversy over the phone not booting with third-party fingerprint reader repairs as an example. People were upset when they found out that having their device worked on could make it unbootable, but Apple was able to easily fix it with a software update. If it had been designed more securely, it might have wiped data when it detected unauthorized modifications, which would have meant even more upset people. Now that this has become a public debate, there will be a very different response to making it more secure.

[ Parent | on HN ]
Re:Apple Is Said to Be Working on an iPhone Even It Can’t Hack by mtgx on Wednesday February 24, 2016 @09:54PM (#11172048)
How much easier? If all they had to do to not have access to it themselves is to ask the user for his password when there's a new update, that's hardly that inconvenient...
[ Parent | on HN ]
Re:Apple Is Said to Be Working on an iPhone Even It Can’t Hack by ewzimm on Wednesday February 24, 2016 @10:21PM (#11172150)
I'm not saying that it was the right thing to do in hindsight, but I get a little nervous even when updating a small web server, so I understand the tendency to leave repair options open on something as big as iPhones. Real hardware-based security is about more than just about asking for a password. It means making the device unreadable if it's been disassembled or tampered with, and that could have unintended side-effects if any mistakes are made or something is overlooked. It's definitely worth pursuing considering the political situation the world is in right now.
[ Parent | on HN ]