What's keeping government agencies from putting keylogging code on the SIM card or baseband processor (whichever has the best access to host cpu/memory) via the carriers to obtain the passcode? Not much I guess.

Has Apple publicly claimed that they will also refuse to push individualized compromising code updates to devices on demand by gov't authorities?

Some very knowledgable iOS security people have told me how hard it is to break iOS. You need quite a few chained exploits to do anything meaningful. Browsers are pretty much the only things with Read/Write/Execute memory.

Security is always a convenience/security trade-off. iOS is about as good as you can get before inconvenience will turn people to less secure devices.

There is the question of vanilla iOS being susceptible to attack from NSA and any other malicious attacker and then there is the question of is the security design sufficient such that even apple could not backdoor your privacy should they desire. The latter is what the original commented was addressing. I think the statements from apple do not clarify this matter and we should assume they can backdoor should be required by warrant. I need to see detailed technical specifications for their claimed security measures before I would trust these statements (if someone has a RTFM link, much appreciated).

>keylogging code on the SIM card or baseband processor

That won't work.

>Has Apple publicly claimed that they will also refuse to push individualized compromising code updates to devices on demand by gov't authorities?

No, and even though I strongly doubt the government would even try to do this and even more strongly doubt Apple would comply, their new tech (apple pay and touch ID use hardware support to even protect against this sort of breach which shows that they are certainly thinking about it). I'm pretty sure Apple won't even have the ability to silently push an OS update (if they did then someone could find out because it would be in the OS and then all hell would break loose) - it would have to be accepted by the target which means there is a reasonably large chance of detection.

Not on the sim card, but on the base band processor it very probably will work, since the base band on many cell phone cores share the memory with the application processor.

Well it certainly doesn't work like that on an iPhone.

Please illuminate me then as to what the iPhones processor architecture looks like, seeing as iPhones also use Qualcomm basebands, same as most Android devices...

The baseband processor has no access to the parts of memory it is not meant to, possibly some of the early iPhones did but currently they are properly isolated.

Please substantiate with a link.

The baseband firmware is cyptographically signed by Apple (and would thus require their complicity in backdooring) and the A7 models have a so-called Secure Enclave, which handles the encryption and decryption of memory contents.

Link: http://www.apple.com/ipad/business/docs/iOS_Security_Feb14.p...

Thank you very much, I'll definitely read through the doc through the course of the day. But a cursory glance still does not mean that rogue software on the baseband cannot compromise your phone, but it is getting more and more difficult to place rogue software on the baseband.

"And would require Apple's complicity" - Or perhaps rather Qualcomms's...

Considering iPhone has their custom processor design, this information is most likely confidential. However, it isn't inconceivable that some sort of memory protection method similar to IOMMU can be added to the internal fabric to prevent baseband processors (or any other peripherals) from accessing arbitrary physical memory.

Thats fine, I just wasn't sure how abrittishguy can state his assertions so absolutely as facts.

Why the downvote?

They still don't have physical keyboards.

The quote is extremely misleading. Sure, it's encrypted by your passcode, and that's great.

It's important to note however that the passcode is just 4 digits long by default, and could be bruteforced by Apple in milliseconds if they wanted to. So to say that "Apple cannot bypass your passcode" is misleading, as guessing it is absurdly easy.

http://www.slideshare.net/alexeytroshichev/icloud-keychain-3...

It's not quite milliseconds. According to https://www.documentcloud.org/documents/1302613-ios-security... they've increased the iteration count somewhat:

“The passcode is entangled with the device’s UID, so brute-force attempts must be performed on the device under attack. A large iteration count is used to make each attempt slower. The iteration count is calibrated so that one attempt takes approximately 80 milliseconds.”

This is still an argument for using a longer length code, however, since a simple 4-digit number would only take 800 seconds to brute force.

This can't be true. If you restore your iCloud backup to a new device, all you need is your passcode. It obviously won't ask you to enter the UID of the device you previously backed up with.

You're not limited to 4 digits. In fact, when you set up Touch ID, the phone prompts you to enter a longer text-based passcode on the basis that you shouldn't have to enter it often.

The government has your fingerprint.

Which doesn't help them much because the fingerprint will only reveal the passcode if they gain physical access to the device's "secure element" and its contents (which is reportedly hard).

It is really surprising how much HN turns a blind eye to / lacks imagination for potential security issues just because it's Apple.

Well, actually it isn't surprising at all.

I'm inclined to reverse that. Whenever Apple tells the world about a way they're attempting to protect their users' privacy above and beyond what any other for-profit technology company of comparable size and scope has done, HN immediately tries to deconstruct it--which is by and large good, since we need to remember that no security model is perfect. But a small but vocal subset always demonstrates a remarkable level of imagination in presenting scenarios in which Apple can actively conspire against their users while remaining within the letter of their guarantee. I'm not positive this happens jut because it's Apple, but I have my suspicions.

You've got a lot of reasonable responses above.

I am certainly not "HN". If you want to argue/discuss, do so. I'm well aware that a "secure element" is never 100% unbreakable. But in the usecase the GP mentioned (government broadly gathers data), hiding the data in a separate hardware compartment will at least help.

I think it's just PR bullshit. Apple has been known to abuse the law. I'm sure some government gave them the green light to lie about this and have another backdoor.

My government doesn't have my fingerprint, but the US government does...

If you grew up in the US, they already have it. Every elementary school kid in the US gets fingerprinted.

EDIT: It appears I was wrong, this was only in LA county.

Uh, what? Neither I nor my children have had such an experience in public school.

Not the point. The point is that they've done enough to legally respond to government requests by saying "we don't have a way to access the data". Hacking customers' phones, regardless of how easy it might be, is far beyond the scope of anything that a US court can order a private party to do.

> is far beyond the scope of anything that a US court can order a private party to do.

They could order Apple to disclose signing keys so that the government can install spyware themselves. See http://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_orde... for a case where they have done something similar before.

>the government can install spyware themselves

It would have to be an OS update since applications don't have access to that stuff, even if signed with an apple key.

That's probably not quite true. Take an app that the user is already likely to have given access to their photos, like Facebook. Create a malicious app with the same app identifiers, sign, and push to the user. At that point, the phone thinks it's Facebook, and should allow access.

That said, it'd be kind of unsubtle, and they'd probably get caught.

Ahh yes, I assumed we were talking about messages.

I assumed it was primarily the review process ensuring that the proper sandbox configuration was included in the bundle and applied to apps at runtime, checking for private API use automatically etc, and that Apple could probably ignore their own restrictions if they chose to, especially those private APIs.

iOS won't let even the most permissively configured, "unreviewed" app do things that apps aren't supposed to be able to do?

But its something the NSA is more than capable of accomplishing

It is only protected with just the passcode when on the physical device - Apple cannot bruteforce it because they don't have the capability to access it remotely (they can only wipe it).

Is this still the case in iOS 8? I know it was the case previously, but has anything changed in iOS 8 to prevent apple from just brute forcing the 9999 combinations with a mounted flash drive?

There is a "self destruct" option to wipe the iPhone after 10 failed pass code attempts. It's not bulletproof against a bruit-force but it's something

Yet the page says "less than 0.00385% of customers had data disclosed due to government information requests."

So they ARE giving data to the government at their request...

BTW, that percentage of say, 100 million customers (which I'm sure Apple has, probably more) is 3850 people, not an insignificant number...

Anyhow, I personally wouldn't trust anyone anyway. Google, MS and Apple are all American corporations, and need to comply with US law, no matter how asinine.

Their detailed report[0] is pretty clear, and defines what they mean for the categories they're reporting. According to that document, they had 20221 device data requests, and they provided data for 12146 of those requests (some of those requests have many individual devices). For account data, they received requests for data from 2803 accounts, and provided some data for 1333 accounts.

0: https://www.apple.com/privacy/docs/government-information-re...

Unless I’m doing the math wrong, 0.00385% of 10 million is 385.

Not to mention that Apple has sold over 800 million iOS devices.

Yeah, my math was bad, too early in the morning (that was pre-coffee). Anyhow, they have way more than 10 million customers (likely more than 100 million too).

I am aware of once incidence of an Australian state police forensics unit being unable to circumvent a non-simple passcode lock on iOS 6.1.3 with physical access to the device (iPhone 4s), set to wipe all user data after 10 unsuccessful attempts. Seems secure to me.

I am a bit surprised that there is no explicit declaration that they don't have user's passcode.

It should be obvious, but I think it should also be stated in a way that makes it a lie if it's later discovered that left some way to access or keep the passcodes.

Aren't all these data backed up to iCloud? Is it also protected with a passcode?

This seems like the flaw in the argument, yeah. iCloud isn't mandatory, of course, but most people do use it, so peoples' photos and things will be in The Cloud, anyway. Possibly several The Clouds; Google+ on iOS keeps badgering me to enable automatic photo uploading.

Hmmm.. Isn't it way easier for the feds to peek into the cloud for my data without even me knowing so that I'll keep giving them the data then to confiscate my phone and investigate it?

To me, it seems like this passcode thing is a good way to keep my data safe from thieves but from the govt.? don't think so.

This. In the coming years it will be increasingly convenient and perhaps mandatory to have your data on iCloud - if you want to backup, restore or find your devices. The latest iCloud upgrade allows for 1TB of data - it's easy to imagine having your entire laptop, phone, ipad up there in the near future. So physically preventing access to a single device is not nearly as important as protecting your entire digital life in the cloud. This announcement by Apple is a good sign, but it feels like the real battle for privacy from govt snooping will be in the cloud.

Yes; if this is something you're worried about, you probably shouldn't use cloud services. It's not like they're mandatory.

>"On devices running iOS 8, your personal data such as photos, messages (including attachments), email, contacts, call history, iTunes content, notes, and reminders is placed under the protection of your passcode. Unlike our competitors, Apple cannot bypass your passcode and therefore cannot access this data"

Too bad they (and other phone manufacturers) don't protect phone calls with some kind of end-to-end encryption.

There's not much one company can do about the standards. [1] They can only control their own output.

Apple asserts that Facetime and Facetime Audio are end-to-end encrypted. And Google claims Hangouts are encrypted as well.

I don't know whether there are caveats (or how many) to either of those claims. But that's about as much as one could hope for in the current climate. [2]

[1] Particularly upstart computer companies dealing with the telecom oligopoly. Long cozy with governments and law-enforcement, if not an explicit part of government.

[2] It's a serious bummer that FaceTime never developed into the open standard they claimed at introduction. I've been curious about where that fell apart. (Competitor disinterest, patent liability, carrier terms, etc)

I heard a rumor that the FaceTime open spec never happened due to complicated patent issues, possibly related to this one: http://www.bbc.com/news/technology-20236114

All of this is a damn shame because in my experience the competing standards don't have the usability and quality that FaceTime provides.

Yet there's no way to be sure of that...

No way to be sure - but, the profit motive is pretty good. Apple is going all in on Privacy as the basis for their $500B+ business model.

All it takes is one secret court order to force them to leak the key to NSA.

They control the OS, they DO have access to everything.

Not if they designed it properly. That's like saying that all makers of encryption software can, if they really want to, access all data encrypted with their software.

Of course they can. All you have to do is leak passwords/private keys.

An OS is actually much more powerful, it controls everything, it has direct access to memory. If a user can see his photo, the OS can.

> Not if they designed it properly.

You can (and always should) design encryption code without having a single root key. Entirely open sourcing that code should not make any difference to the security of the encrypted data.

And then NSA forces Apple I to issue the OS update that breaks all your efforts.

That sort of order is out of scope of anything a US court can order, and I believe that an Apple employee would leak it before they complied with such an order.

> That sort of order is out of scope of anything a US court can order

How do you know that? Secret court orders are secret. "National security" trumps everything these days.

LavaBit chose to shut down rather to insert a backdoor that was forced on them. I doubt Apple will shut down over that.

And thanks to Snowden we know Apple's products have been backdoored already.

http://www.spiegel.de/international/world/catalog-reveals-ns...

http://www.infoworld.com/article/2609310/hacking/apple--cisc...

They don't need to create a special backdoor for the government, Apple has it's own backdoor that it can share with the government if needed... (they have full control of your device already when you are online)

But the laws that makes them legal are not secret.

The laws? I'm pretty sure mass surveillance is unconstitutional, that didn't stop them.

Are you saying it's outside of scope for NSA to forcefully install a backdoor or request encryption keys?

How do you explain LavaBit?

How do explain NSA's hardware in data centers?

How do you explain NSA's hardware in cell phone providers centers?

How do you explain NSA's backdoors in Microsoft's products?

How is that out of scope? Haven't they been doing exactly this for at least five years? Miscrosoft backdoors et al?

And I think an Apple employee is that last person that would leak anything. They work for Apple after all, starting to work there surely takes some abandonment of principle.

In the end, why would anybody feel assured by what someone believes someone else would do?

Edit: Why is imaginenore downvoted so heavily? His concerns seem rather rudimentary.

not quite, on the platform I am on you cannot extract passwords at all, they simply are not stored. encryption at the hardware level may have a backdoor but os level is similar.

lets be honest, if they want your data your the weakest link. if you want to be paranoid enough to go the route your thinking its far cheaper for them to take you to a back room and employ a hammer to you.

Doesn't matter if they are stored or not. If a user can access his files, so can the OS he is using.