No one with the slightest technical background thought the phone was uncrackable, maybe not directly by the FBI but by pretty much any 3rd party contractor that does even basic flash data recovery. The FBI was looking to set a precedent in order to be able to gain easy access to phones that could be also used by law enforcement, a local sheriff's department is less likely to be able to contract it out for every case and even if it would be a commodity it would be price prohibitive at scale. Overall probably even iPhones with a secure enclave are not "immune" to physical attacks, not as easy as doing simple nand-mirroring but if can decap the main CPU without destroying it you should be able to directly probe the secure enclave logic.

Also while NAND mirroring does work, there is a good chance it wasn't used in that case, the current "theory" is that one of the patched USB DMA exploits were used to unlock the phone, NAND mirroring was too "risky" for the FBI to consider at the time, and it wasn't forensically secure IIRC one of the reasons for the very high price was the non-physical attack approach that the 3rd party provider they've selected had in their toolkit.

I think this is provably false. The post to HN was flagged and people told the guy off. It's probably safe to assume several of those people have "slight" technical background.

Can you explain how the "USB DMA exploit" works? Also how would you run this exploit on the phone if you were locked out of it?

Like any other DMA exploit through the USB host or any other DMA enabled data connector/port.

Cellebrite has a few of them I know of a few for MediaTek chipsets that work through the USB host and the camera connector.

This isn't any different than the DMA "skeleton keys" for PCs and Macs that work via firewire/thunderbolt/pcie/expresscard/PCMCIA etc.

That's two of us:

https://news.ycombinator.com/item?id=10906999

Mobile phones aren't secure. Period. Anyone saying otherwise about theirs better provide convincing evidence that they mitigated everything on that non-comprehensive list. Then we talk about what I left off. When FBI said they couldn't get in, I knew they were lying to try to establish a precedent & technical method to increase their convenience. It was also only time Richard Clarke's pronouncement was relieving where he said (paraphrased) "I'd just ask the NSA to break into it." Because they or a contractor could due to risks not mitigated. Obvious.

Honestly not sure if I'll ever trust a tiny, slim smartphone for high-security INFOSEC given the effect of EMSEC on size and hardware POLA on power consumption. If their physical specs are Apple-grade, then they cut corners on INFOSEC and some government hacker has job security.

I'm surprised the post was not unflagged. HN team wanna ring in?

When posts say "flagged", that means they crossed some threshold of user flags. The moderators didn't flag it.

Though it would never happen, would love an investigative piece that followed up on who flagged it, their background, why they flagged it, and what they have to say now.

I'm sure all the "experts" who were so vocal about how wrong you were will speak up now and admit they were wrong. Happens all the time around here. ;)

Can I come along and note that I was in that thread supporting that guy? Because that would be valuable for my self-esteem.

This is because many people don't care and/or switch to autopilot and double-down on their wrong point instead of being able to switch to a position where they can rationalize alternative answers and admit they are wrong. It is quite frustrating to deal with these people[0].

[0] https://youarenotsosmart.com/2011/06/10/the-backfire-effect/