The problem is the only ones you can really trust in this case are Apple, just like only Intel has the keys for microcode. Give out software to every police department instead and there'll be a hack out in the public the same week.

Yep, and private keys are never compromised.

Aside from the many, many known cases where they are: http://legacydirs.umiacs.umd.edu/~tdumitra/papers/CCS-2017.p...

As best as I can tell, if you don't trust OS or microcode updates, you can't trust your phone at all unless you airgap it or somesuch.

Very true. Everyone should know their TNO, Trust No One. As far as I can see it's the only way to really operate in the world of computer security that we live in.

Except, since the dawn of the internet, this has never really worked without issues.

I'm willing to bet that Apple can handle a single secure key in low-bandwidth interactions with law enforcement. This is not rocket science; it's not shared, it's not exposed to the web, it's not interacting with complex components. It's just a key.

The technical aspects aren't the problem. The political and social aspects are.

What does Apple do if they have this capability and China puts pressure on them to unencrypt some information on Chinese "dissidents"? China has incredible leverage over Apple, seeing as how all their devices are built there. Would Apple dare resist these requests from Chinese national law enforcement agencies?

Better to not have this ability at all, and thus never be put into this precarious situation.

Interesting that you looked to China foran example of a bad outcome. Ordinary police here in the states already misuse the privileged access they've been given, such as to supposedly private personal details to stalk romantic interests, personal enemies, business competitors, etc.[1]

1-https://apnews.com/699236946e3140659fff8a2362e16f43/ap-acros...

> Better to not have this ability at all, and thus never be put into this precarious situation.

Apple has this ability now, by installing an OS that allows bruteforcing the pin.

Apple cant do this passively/on demand, as upgrading the OS or Secure Enclave requires the user passcode. Of course the new OS/Secure Enclave firmware could remove this restriction, but generally these sorts of requests are reactionary

> The technical aspects aren't the problem. The political and social aspects are.

With this I agree completely.

Just to add. Looking at the current political state surrounding the Russian collusion investigation. It's not a stretch that Trump would not use this against his political enemies or "fake new media". And look at what his supporters have done with FBI agents that had an affair with private text messages. Trump isn't the first of his kind nor will s/he be the last.

Why would they ever want to?

Imagine the conversation if Veedrac was running the show at Apple.

Saudi Police: "We need the key to this user's phone because they are suspected of having a video of their own gay sex and we want to prove it and if they are guilty of gay sex, we will give the user 60 lashes and then execute them and their partner by chopping off their heads with a sword."

Veedrac: "Oh, OK, yes here you go, here is a single secure key on a one time basis so you can get the user's video and kill them."

Do you really think this is a great scenario, that Apple wants to actively enable by spending money and effort on their designs to make it happen?

Well I don't think I've ever been caricatured as homophobic before, that's one for the books.

The comment wasn’t saying that you are homophobic. Just that you were being foolishly naive in advocating a system that would enable evil regimes including, for example, homophobic ones, to more effectively practice some of their most egregious human rights violating behaviors.

And did you actually think about how such a risk might be handled, instead of (as I suspect you did) immediately jumping to strawman and slander the other side? It took me roughly 30 seconds to think of an approach that prevents overreach from foreign powers, I strongly suspect Apple can afford spending 5 minutes.

Foreign powers aren’t the only problem. Leaked keys, domestic powers, small town corrupt sheriffs, corrupt US Presidents, are also problems. You think you have managed in 30 seconds to overturn the thinking of the entire credible security community.

Let’s hear your approach then. Don’t be coy.

I have given a suggestion elsewhere in this thread. This will be my last post here, though.

The suggestion where others already poked holes in it and pointed out the obvious flaws for you... ok then Veedrac.

If only it were that simple, and Apple were the only ones to trust. History shows us that even the best intentioned key sharing is vulnerable.

Except that countries like Russia, China et al can demand that Apple hand over those codes. Much better that Apple is not in the business of being the gatekeeper for hundreds of millions of users.

They can already demand the keys to the kingdom.

It's a lot easier to say no if there are no keys to the kingdom.

Exactly.

And having more mechanisms by which they can access user data is not something that ever should be encouraged.