For example if this is a lock screen bypass (and not a bypass of say the start up process before the key is entered), maybe some memory corruption issue allows you to bypass the password check. Or another example, many people use short numeric pins to encrypt their phones. Apple then does a lot of complex stuff to take that and turn it into a high entropy key. Maybe this is an exploit in that part, allowing for a bruteforce attack.
These are all just wild gueses, i have no idea what these capabilities are or for that matter, i dont really know very much about how iphone FDE works.
However, without that key an attacker is stuck trying to brute force Apples high entropy key, which causes some confusion.
* The hdd in a phone that is not powered off is mounted. It takes an exploit in OS to pass the Lock Screen or read the RAM.
* The vast majority of people don’t have long alphanumerical passwords. The short pins can be broken.
* Some manufacturing companies don’t handle encryption keys properly. Synology NAS stores the keys next to the encrypted data for automatic access upon boot (unless you change the default and store the keys on an encrypted USB or enter keys manually upon boot).
* There are sometimes bugs in algorithm implementations, especially if a company roles its own crypto with closed source software.
* Sometimes encryption keys are not properly generated. Bad RNGs were a thing for a long time.
* And of course there could be back doors for law enforcement.
I wouldn't say an HSM such as a Yubikey is secure against a government agency. But apart from that, you can take out the hard drive and deal directly with random blubs, bypassing software limits.
Of course these measures are effective against the majority of the attackers, but we are talking about FBI here.
Do you know how long is enough? Of course 64 chars would be dope but I'm not good at memorizing things. I know it's trainable but I'm lazy too :)
My current password is a bit longer than 10 chars and I wonder if I should upgrade it.
Personally I started doing this ~2000. I still remember my first one that I gave up meanwhile because I told it to my GF at the time and we broke up meanwhile.
You can easily top 100 characters this way. Though this is not something you want to do on a touchscreen device, it's a pain there with fat fingers.
A 10-word diceware passphrase is often recommended.
If you choose a password rather than a passphrase, the bare minimum is 15 (90 bits) to 22 (128 bits) characters, upper and lower case and numbers.
Either way, purely random is key here.
Thats my guess at least.
https://twitter.com/matthew_d_green/status/13417461712205373...
[1] https://twitter.com/matthew_d_green/status/13417461712205373...
So what type of thing is most likely happening? Are hardware vendors secretly installing back doors? is there some sort of software encryption standard that's compromised? Or some kind of secret breakthrough in computation theory that easily "solves" encryption? Or maybe, bolstered by NSA surveillance, they just know passwords and unlock codes to devices?
Again, I understand that that is the exact mystery here, but I would appreciate knowing if one or more of the possibilities is conceptually more likely than the others.