News for hackers. Stuff that matters.
Re:FBI May Demand iOS Source Code, Signing Key by mikeash on Friday March 11, 2016 @01:36PM (#11268575)
iPhones don't require a four-digit PIN. You can set a nice, long passphrase, which would then make brute forcing completely impossible even with modified OS shenanigans.

The only reason brute forcing is even potentially an option in this case is because the person in question didn't bother to use a secure passphrase.

So, it sure sounds to me like iOS is already doing what you describe. Do you just object to giving the user an insecure option?

Re:FBI May Demand iOS Source Code, Signing Key by bogomipz on Friday March 11, 2016 @06:03PM (#11270183)
Can someone explain how the encryption works on the iPhone? I was under the impression that the 4 digit code is just a screen lock and had nothing to do with the encryption.

Also is there a reason they can't just use this piece of hardware to brute force the phone?

https://www.intego.com/mac-security-blog/iphone-pin-pass-cod...

Re:FBI May Demand iOS Source Code, Signing Key by mikeash on Saturday March 12, 2016 @05:35PM (#11274999)
Lots of info here:

https://www.apple.com/business/docs/iOS_Security_Guide.pdf

The short version is that your passcode (whether four digits, six digits, or a full password) is combined with an encryption key embedded in the device in a way that's supposed to be impossible to extract, and used to derive the encryption key used to protect your data.

The device you linked to relies on a vulnerability in the US, where it would report that a passcode entry failed before recording that failure to nonvolatile storage. Normally, the device starts adding more and more delays to passcode entry after a few failures. By cutting power to the device immediately after it reported failure, it bypasses those escalating delays. As your link mentions, Apple fixed this vulnerability in a subsequent OS update, so that hardware only works on older OSes. This phone's OS is too new.

Re:FBI May Demand iOS Source Code, Signing Key by bogomipz on Saturday March 12, 2016 @09:27PM (#11275845)
Thanks for the clarification. Does anyone know how Android's crypto at rest compares to iOS?