Of Palladium, Bruce Scheier said:

> "There's a lot of good stuff in Pd, and a lot I like about it. There's also a lot I don't like, and am scared of. My fear is that Pd will lead us down a road where our computers are no longer our computers, but are instead owned by a variety of factions and companies all looking for a piece of our wallet. To the extent that Pd facilitates that reality, it's bad for society. I don't mind companies selling, renting, or licensing things to me, but the loss of the power, reach, and flexibility of the computer is too great a price to pay."

I think his fears have come true to some extent in iOS, but knowing what we know now about government surveillance of everybody, it may no longer seem like too great a price to pay. That is, if you trust the vendor. Apple seems to be worthy of that trust. But Microsoft...?

Edit: formatting

We're already paying that price, essentially. An iPhone won't run arbitrary code, a replacement OS, or accept code from arbitrary sources. It's already an exclusively vendor-curated platform. If you're already going to buy into that model, I don't see the point in not going for the greatest amount of protection that you can get. (OK, yes, a dev can compile their own code and push it to their own device. I'm actually not sure why I don't hear about this happening more often as a way to run "unacceptable" programs on iOS devices).

Oh no... it's working...

Edit: a Nexus device bought directly from Google with the right hw may address both points.

Secure Enclave is a variant of TrustZone (http://www.iphoneincanada.ca/iphone-5s/apples-new-secure-enc...).

The major issue with android systems does not seem to be lacking software and hardware, but rather the unwillingnes of providers to push best practices as defaults to all users.

I somewhat agree and somewhat disagree with your analysis of the politics. Their are both advantages and disadvantages of both situations

Why? I'd expect just the opposite.

To many Americans, Apple is the example of American innovation and entrepreneurial spirit, and a proof that the American model works. Apple employs 10s of thousands of Americans directly, and probably provides jobs for 100s of thousands indirectly. Going too aggressive on Apple, e.g. at the level where executives could be charged in court, or products embargoed, would be a decidedly unpopular move with many voters and politicians. Samsung is a much easier target here.

Also as an American company, Apple can legitimately enter the democratic debate, see the calls it makes to congress. Samsung can't really do that. Imagine Samgsung putting out press release quoting the founding fathers or referring to the first amendment. That would not be credible.

Edit: grammar

I'll repost a snippet from a post by merhdada that hints at the root of one of the problems with android security:

"This can happen only because of a design flaw in the security architecture of Android (L). Unlike iOS and like traditional PCs, the disk encryption key is always in memory when the device is booted and nothing is really protected if you get a device in that state. It's an all-or-nothing proposition."

Please read the entire thread, and check the links referenced in that thread, for information on how issues like these are mitigated.

That's only one issue though. There are a few more.

But none of that even matters a lot of times ... you really won't need to hack an android phone... because the data is also on corporate servers. So the FBI could get at it in any case most of the time.

To bad flock does not exist any more, a droping replacement for google sync with end to end crypto. Very nice.

[1] https://www.youtube.com/watch?v=XEVlyP4_11M

Is anyone aware of anything that makes this more than a leap of faith?

Until a few years ago you were perfectly content with keeping an agenda in your pocket and pictures in your living room's drawer. A minimum of privacy is of course needed and welcome; however, unless you're planning a major terror attack, or strategic war plans, or you have incredibly valuable industrial secrets (all cases in which you'll probably be using specialized SW to keep your information) you don't really need incredibly advanced security simply because nobody is going to spend vast amounts of time and resources to uncover your little secrets. The GP is talking about switching phone (spending money) to obtain a level of security that he won't need in a million years.

http://www.nasdaq.com/article/apple-standoff-escalates-local...

http://www.leadertelegram.com/News/Front-Page/2016/02/20/Off...

http://www.argusleader.com/story/news/2016/02/18/sf-police-c...

The NSA did infact try to build backdoors into important hardware and software standards. They did push companies into using worse crypto. The do massiv port scanning and build themself botnets from where thet attack other nation states. And thats just a tiny fraction of what they do.

So yes, I absolutly do need computer hardware and software that even the manufacturer cant break. Low level security for boot and authentification is only the first in many, many steps that we have to take all the way up to imroving usability in end user applications to make it hard to do the wrong thing.

The FBI are not the o ly player, all governments want such control, all governments have things like the NSA. Even private actors are getting better and better.

We do need better security to protect the integrety of all our data, this includes all our communication and even, if possible metadata that we produce.

There is no reasonable argument to be made that people shouldn't have higher quality products when they _don't_ cost more^.

Apple only have to develop "unbreakable" encryption once and then it costs them no more to make it available in every iPhone than to only make it available in some of them. Indeed, it'd be cheaper than maintaining both breakable and "unbreakable" variants.

There are arguments to be made about the secure enclave hardware, since it presumably costs more to make it more tamperproof.

However, securing iPhones against this particular "attack" appears to be a software issue: iOS should never apply updates without an authenticated user approving them first.

^ For the avoidance of doubt, this includes externalized costs.

If you're using a breakable crypto , you're not protected at any given time.

If you're using a watch that's waterproof up to 100m, you're safe up to 100 meters.

To be pedantic, that's not exactly what is meant by 100m Water Resistant, but your point is valid.

https://en.wikipedia.org/wiki/Water_Resistant_mark

Although no watch can be absolutely waterproof, not even at a given depth, there are levels of risk one can accept. A watch you can use at 100m for several hours a day is effectively waterproof if that's the harshest treatment the watch will receive.

Similarly, although no cryptographic system is absolutely unbreakable^, there are levels of risk one can accept. And, unlike with watches, we can design cryptographic systems which, except in the face of unforeseen mathematical breakthroughs, or bugs (or backdoors) in their implementation, cannot be broken in the next few hundred years even by a nation state-level attacker.

I think is it reasonable to describe a cryptographic system that can't be broken within the lifetime of anyone alive today as "unbreakable".

^ Except maybe one-time-pads, depending upon how "unbreakable" is defined.

Now, is a cryptography that can't be broken by anyone except maybe (that hasn't even happened yet) through a specific court order signed by a judge, reasonably secure? I think it qualifies as such. If you need even more security, I'm sure you can use specialized software to achieve it - I'm not saying you shouldn't be allowed to.

Assuming I agree that a security system that can be turned off remotely by its vendor is reasonably secure, it is only a specific court order now. If Apple are successfully compelled to produce a version of iOS that bypasses PIN security, it will be much easier for the FBI to request that it be deployed on phones in the future - after all, that version of iOS will already exist then.

If Apple do make it, I am certain there will quickly be a slew of court orders regarding other iDevices that the authorities have in their possession, all of which are likely to be harder to defeat than the court order they would just have failed to defeat.

However, I don't agree that a security system that can be turned off remotely by its vendor is reasonably secure, anyway. There is nothing technically requiring Apple to wait for a court order: the phone will accept their new software whether or not it comes with a court order. Apple could decide to make PIN cracking available to anyone who can prove they own a given iPhone. Given their attitude, they probably won't, but the actual security mechanism is reliant on their goodwill for it to remain unbroken. I don't consider that reasonable.

this would seem a rather scary precedent of forced, unwilling labor. i wonder if it could be construed as "involuntary servitude".

It depends, how many meters does it have to claim before I can make sudden movements and god forbid press the buttons underwater?

only because they weren't (thought to be) subject to casual perusal by unknown entities. this is a silly thing to even mention.

> unless you're planning a major terror attack

ah, the "if you don't have anything to hide" rhetoric. do you really buy that?

> a level of security that he won't need

unless there is some nontrivial cost or burden associated, it's a red herring to belabor whether it's "too strong" or "more than needed".

This morning I was having a conversation with my fiancee, who said "if the US government gets a warrant they can open your mail, they can tap your phone calls, they can come into your house and search -- why should your phone be some sort of zone they cannot search even with a warrant?"

I happen not to agree but this is not some wacko view.

As to why they disagree: HN's audience is not representative of the general citizenry. We're better informed about technical security matters (or we like to think we are, at least). I suspect that correlates with being less willing to trust security to the goodwill of third parties.

"If you aren't doing anything wrong, what do you have to fear."

"If you do want something private then you must be doing something wrong, ARE YOU A TERRORIST!?!?!?!"

Do i really need a quad core smartphone with a dedicated GPU 3GB of ram a higher pixel density than i can possibly distinguish, etc etc?

Why would i settle for shitty crypto just because the information isnt a state secret?

And whats the difference to me between 452 ppi or 532 ppi? I'll never be able to enjoy the difference between the two, yet i would still go for the higher ppi all else being equal.

Of course there is always an appeal in the numbers. I'd go for a 40MP camera instead of a 20MP one - who cares if the quality of the lens is such that there is no difference beyond 10MP. It's marketing. It's curious how people so wary of being observed or exploited make themselves so prone to basic manipulation by entities who want to get their money.

I agree there may be other reasons the user switched, but maybe they switched to android because they believed it to be more secure? Or maybe the user wants to vote with their wallet for the company they see as most in support of security/privacy.

I do agree though, switching for a feature you are unlikely to use is silly, but i think there are definitely reasons enough to make a switch like that from a 'voting with your wallet' type standpoint

In both cases, when was the last time you drove it at its maximum speed all the time? Or ensured that you were using maximum torque at all times and always sitting in the maximum power band for the engine?

If you find that you haven't done these things, you probably should ask yourself why you have a car, right? After all, you're never going to drive the full speed of the car, so why have the car in the first place?