Apple's "Warrant Canary" Has Died

HughPickens.com writes When Apple published its first Transparency Report on government activity in late 2013, the document contained an important footnote that stated: "Apple has never received an order under Section 215 of the USA Patriot Act. We would expect to challenge such an order if served on us." Now Jeff John Roberts writes at Gigaom that Apple's warrant canary has disappeared. A review of the company's last two Transparency Reports, covering the second half of 2013 and the first six months of 2014, shows that the "canary" language is no longer there suggesting that Apple is now part of FISA or PRISM proceedings.

Warrant canaries are a tool used by companies and publishers to signify to their users that, so far, they have not been subject to a given type of law enforcement request such as a secret subpoena. If the canary disappears, then it is likely the situation has changed — and the company has been subject to such request. This may also give some insight into Apple's recent decision to rework its latest encryption in a way that makes it almost impossible for the company to turn over data from most iPhones or iPads to police.

Comments

There is no "almost impossible"

[Anonymous Coward]

It either can or can't be done.
Almost impossible means it still can be done.

Re:There is no "almost impossible"

[bobbied]

It either can or can't be done. Almost impossible means it still can be done.

Encryption is ALWAYS breakable by brute force. Question is how long does it take? Seconds? Hours? Months? Years? Decades? This is usually determined by key sizes. The longer the key, the longer it takes to brute force. (generally)

Re:There is no "almost impossible"

[Anonymous Coward]

It either can or can't be done.
Almost impossible means it still can be done.

There is no try, only do

Re:There is no "almost impossible"

[confused one]

Any encryption can be broken with enough processor power and time.

Re:There is no "almost impossible"

[geekmux]

It either can or can't be done. Almost impossible means it still can be done.

Encryption is ALWAYS breakable by brute force. Question is how long does it take? Seconds? Hours? Months? Years? Decades? This is usually determined by key sizes. The longer the key, the longer it takes to brute force. (generally)

Decades?

Wow.

You must live pretty damn far away from a big city or something.

Takes me like fifteen minutes to buy a $5 wrench. Tops.

Re: There is no "almost impossible"

[Anonymous Coward]

Ok, so how long to brute force an aes-256 encrypted value? Currently not possible and likely never. You would have to find a weakness in key management or grab the data before it is encrypted. So nothing is fool proof, but you picked the wrong weakness as your example.

Re:There is no "almost impossible"

[dunkindave]

Encryption is ALWAYS breakable by brute force. Question is how long does it take? Seconds? Hours? Months? Years? Decades? This is usually determined by key sizes. The longer the key, the longer it takes to brute force. (generally)

Um, not quite, one time pads are provably impossible to break by brute force since the message can be decoded into any message of the right length.

Re:There is no "almost impossible"

[mi]

Or, if a person knowing the key(s) is in custody, with the application of thermorectal or rubber-hose cryptanalysis methods.

Re:There is no "almost impossible"

[thestuckmud]

"Almost Impossible" can be made very precise. Indeed, modern cryptography is based on the understanding that certain algorithms are "almost impossible" to reverse. Cryptographers prove theorems with wording like "indistinguishable from random by any polynomial time algorithm" when they mean almost impossible. So, Apple may be quite correct in their statement.

My take on this is that Apple likely has received legal orders it can not disclose, and implementing real, strong security to protect user's data.

Re:There is no "almost impossible"

[horm]

Except for one-time pads.

Re:There is no "almost impossible"

[DivineKnight]

And that's why I use throwaway / random passwords...authorize once, throwaway if it needs to reauthenticate. I can't give them what I don't know. ;-)

Re:There is no "almost impossible"

[vux984]

Takes me like fifteen minutes to buy a $5 wrench. Tops.

That requires:
a) you know who to hit with it
b) the person you decide to hit with it knows the password

So if you shoot a "terr'ist" and retreive his encrypted smart phone... what are you going to do exactly with a wrench?

Re:There is no "almost impossible"

[Anonymous Coward]

No. It's impossible to add 2+2 and get 5. It's almost impossible to convince a pedant they're wrong.

Re:There is no "almost impossible"

[FatdogHaiku]

There is no try, only do

Ahh, Yoda's bathroom mantra...

Re:There is no "almost impossible"

[wonkey_monkey]

Don't tell a probability theorist what you think "almost" means.

http://en.wikipedia.org/wiki/A...

Re:There is no "almost impossible"

[EvolutionInAction]

No. You don't know what you're talking about. See, OTPs use a random 'key' the same length as the data you're encrypting. It doesn't matter if there are known fields in the data, because matching those sections tells you nothing about any other section.

OTPs have a trivial proof that they provide perfect encryption as long as the key is never reused. They're just horribly impractical for everyday use.

Re:There is no "almost impossible"

[perpenso]

No. It's impossible to add 2+2 and get 5. It's almost impossible to convince a pedant they're wrong.

You are wrong about 2+2=5 being impossible. Any C++ programmer can accomplish that. :-)

Re:There is no "almost impossible"

[xvan]

No, you can't... because of the "any message", you would have "virtually infinite" amount of messages matching the same patterns you're looking for and having valid data in any other place.

Re:There is no "almost impossible"

[Beardo the Bearded]

I literally don't know the password to my phone. I know of it, and how to type it in, but even at gunpoint / threat of contempt, I couldn't tell you what it is.

Re:There is no "almost impossible"

[khellendros1984]

If the key (the pad) is perfectly random, then there won't be any pattern. If the key was something like the first chapter of Moby Dick, and it's known that the key is an English-language text, and something is known about the contents, then you've got some patterns to work with, and it might be possible to retrieve the plaintext (and the key, simultaneously).

If the key is perfectly random, the plaintext won't be retrievable from the ciphertext, since for any candidate plaintext that you could construct, there would be a corresponding and equally-likely key paired with it. Trial and error can't decrypt a message encrypted via random one time pad.

Re:There is no "almost impossible"

[Anonymous Coward]

No, one time pads cannot be broken. The key and the message have the same length. You xor the key and the message to encrypt, xor again to decrypt. Since the attacker knows neither the key nor the plain text, he cannot break it even if he is an immortal whose only objective is breaking the crypto.
Then why isn't it used everywhere? Because the key needs to be as big as the message, and the key is good for only a single use. That means you cannot send a new key encrypted with the one time pad (well, you can, but it won't help you). Any clever tricks you're thinking would make the crypto weaker.

Re:There is no "almost impossible"

[nedlohs]

That $5 wrench doesn't do anything in making entity A decrypt something that only entity B knows the key for.

Re:There is no "almost impossible"

[PurpleAlien]

Actually, it is not. In reality, a 256 bit key can not be brute forced because of physics - especially the second law of thermodynamics. One of the results of this law is that information needs energy to be represented. In an ideal computer, the representation of one bit requires kT energy, where k is the Boltzman constant and T is the temperature. Let's assume we can operate at the average temperature of 3.2 Kelvin, the average temperature of the universe. The required energy to represent a bit in this case would be around 4.416*10-23 Joule.

The annual amount of energy that our sun emits is about 1.21*10^34 Joule. Dividing this with the per bit-change energy, we could provide power for our ideal computer to perform 2.74*10^56 bit changes. This is just about enough to have a 187-bit counter go through all its states. This does not include the energy needed for the computations to test each key (our counter state in this case) for correctness.

A 256 bit counter would require ~400.000.000.000.000.000.000 stars like our sun just to represent in the counter of our ideal computer.

Or, to say it in the words of Bruce Schneier:
"...brute force attacks against 256-bit keys will be infeasible until computers are built from something other than matter and occupy something other than space".

Note: I am not talking about potential attacks against the algorithms here, etc. only pointing out that encryption is definitely not ALWAYS breakable by brute force.

Re:There is no "almost impossible"

[pushing-robot]

Tighten a loose bolt! I can always use a good wrench.
It's five dollars well spent, in my opinion.

Re:There is no "almost impossible"

[Anonymous Coward]

no, but it may make them wish they knew... that's something, right...?

Re:There is no "almost impossible"

[__aaltlg1547]

Won't last. Someone will forget his passcode about 8 seconds after the iOS 8 goes public. Then comes the flood of unhappy customers locked out of their unbreakably encrypted phones. "Sorry, we can't help you" won't be accepted as an answer.

There will either be a back door or a user revolt.

Re:There is no "almost impossible"

[__aaltlg1547]

1. Police seize iPhone
2. Police arrest owner.
3. Police tell owner to unlock the phone.
4. Owner refuses.
5. Police grab finger, press to button/fingerprint reader.
6. Phone is unlocked.

What encryption?

Re:There is no "almost impossible"

[Anonymous Coward]

One time pads are trivial to break by brute force. The problem is you're never sure when you're done.

Re:There is no "almost impossible"

[Eponymous Coward]

How would a quantum computer change the equations?

Re:There is no "almost impossible"

[Anonymous Coward]

pick the right entity A and B will cave. Much of AQIM's funding comes from European nations paying them to return hostages.

Re:There is no "almost impossible"

[HiThere]

I believe that there are theoretical designs for computers (using reversible computation) that can compute without using any energy in computation. What I'm not sure about is that there's anyway to retrieve the results of the computation. (I've also got no idea of the speed of the computation. It might depend on random motions for all I can remember.)

Whatever, that's merely a theoretical quibble about your point. But then your point itself was a theoretical quibble.

The real weakness of 256 bit keys is poor implementation (of something). And you can't know that everything is properly implemented.

Re:There is no "almost impossible"

[goombah99]

This is one of the most informative and insightful comments I've ever read on slashdot. thanks!

Re:There is no "almost impossible"

[Anonymous Coward]

The reference cartoon is http://xkcd.com/538/

Re:There is no "almost impossible"

[Anonymous Coward]

Beyond a certain point, the size of the key is less important than how random the key is.

If the AES256 key used by iPhones is easily guessed or easily derived using a set of inputs that can be preprogrammed then the true strength of the key may not be 256bits but 56bits (for example.)

Key strength is of utmost importance in keeping the NSA out.

Re:There is no "almost impossible"

[Anonymous Coward]

This is why we have sig figs. For large enough values of 2, we get 2+2=5.

Re:There is no "almost impossible"

[Opportunist]

Another reason why biometry is great to establish identity but poor for authentication.

Re:There is no "almost impossible"

[Opportunist]

You underestimate the stupidity of your adversary. And their sadism.

Or, in other words, just 'cause you can't confess doesn't mean the torture ends.

Re:There is no "almost impossible"

[Opportunist]

Well, on the other hand, OTPs are the wet dream of our law enforcement.

"And here we have the decoded text, it clearly tells us that he's behind every crime committed in the past 20 years, at least that's what it decrypts to..."

Re:There is no "almost impossible"

[Opportunist]

It's trivially easy to do that. All it takes is a redefinition of the value of numbers. Or have some fun with subclasses.

I know what you're trying to say, but you're dealing with people here who do math for fun. If anything I dare say that you should have someone coming up with at least five ways to prove you wrong before the sun goes up today over California.

Re:There is no "almost impossible"

[fustakrakich]

Is it a European wrench, or an African wrench?

Re:There is no "almost impossible"

[fustakrakich]

It would flip a coin...

Re:There is no "almost impossible"

[Anonymous Coward]

It is an excerpt from Applied Cryptography by Bruce Schneier.

The full section is available on Schneier's personal blog.

Re:There is no "almost impossible"

[houghi]

You could use the data itself as key. Sure, that might make decrypting it a bit harder when you do not have the key, but it is pretty good encryption.

Re:There is no "almost impossible"

[Anonymous Coward]

That requires:
a) you know who to hit with it
b) the person you decide to hit with it knows the password

But you repeate yourself.

Re:There is no "almost impossible"

[Anonymous Coward]

Ever wondered why iOS has no fingerprint & passcode lock ?

Re:There is no "almost impossible"

[Ihlosi]

Encryption is ALWAYS breakable by brute force

Three words: one time pad.

Brute force THIS.

Re: There is no "almost impossible"

[Anonymous Coward]

Exactly. By trying to outsmart them, you only succeed in having them make an example of you. This will discourage the others. Would you antagonize a Mafia boss? I don't think so. Then why would you antagonize the government, who is immensely more powerful and does not fear judicial consequences?

Re:There is no "almost impossible"

[sheemwaza]

>Encryption is ALWAYS breakable by brute force. ...with the exception One Time Pad encryption.

Re:There is no "almost impossible"

[Anonymous Coward]

Meh. If you can type it, then you know it for all practical purposes and you can communicate it, e.g. by typing it for the friendly agents who want you to reveal it.

Re:There is no "almost impossible"

[joh]

That's not the problem. You can always restore the phone from a backup or set it up as new phone. "Unbreakable encrypted" is not the same as "bricked".

Re:There is no "almost impossible"

[sifi]

Errr no it isn't Here is my encrypted password: ABIKLY It is encrypted with a symbol substitution. Enter it incorrectly three times and the data gets wiped.
Good luck cracking that with brute force.

Re:There is no "almost impossible"

[gnasher719]

Encryption is ALWAYS breakable by brute force. Question is how long does it take? Seconds? Hours? Months? Years? Decades? This is usually determined by key sizes. The longer the key, the longer it takes to brute force. (generally)

256 bit = physically impossible, unless some hugely unexpected mathematical breakthrough happens. Plus each file in the file system has its own 256 bit key and needs to be decrypted individually.

So that's the kind of situation where an honest statement says "almost impossible" although it is of course possible that the first of about 100,000 billion billion billion billion billion billion billion billion possible guesses might be right. And that's the situation where idiots say "it's almost possible, therefore the NSA can crack it".

Re:There is no "almost impossible"

[gnasher719]

Won't last. Someone will forget his passcode about 8 seconds after the iOS 8 goes public. Then comes the flood of unhappy customers locked out of their unbreakably encrypted phones. "Sorry, we can't help you" won't be accepted as an answer.

That's the answer they already had to accept. The guy in the Apple Store _never_ could get your passcode. Apple in Cupertino _could_ get your passcode by brute forcing at a rate of one passcode every 80 milliseconds. They would do that if the police hands over a phone together with a search warrant, but not because a customer is too stupid.

(MacOS X uses a clever trick to reduce the number of cases: You turn on full disk encryption. At some point you will have to enter your password for the very first time, proving that you remembered it at least that far. At that point nothing is encrypted yet! Only when you demonstrate that you have actually remembered your password does the encryption start.

Re:There is no "almost impossible"

[Reaper9889]

Actually, you will generally know an upperbound on the length of whatever is encypted given the encrypted text. That is something, so it is not quite perfect (In theory anyway).

Re:There is no "almost impossible"

[Anonymous Coward]

Errr no it isn't

Here is my encrypted password: ABIKLY
It is encrypted with a symbol substitution.
Enter it incorrectly three times and the data gets wiped.

Good luck cracking that with brute force.

Which is why we always work on copies of the data, not the original. Also, why we work in virtual machines and cut the write lines. Sorry to burst your bubble buy 3x and wipe only keeps you from casuals and your self, not us.

Re:There is no "almost impossible"

[N1AK]

Which is different to anything in the past how? If the police in 1920 turned up at a lawyers and threatened to break his knees if he didn't give them all of a client's paperwork they'd have everything in minutes. As long as law enforcement can use force it can get this information.

There is however a big difference between a world in which they can get all that data secretly behind the scenes, and one in which they have to overtly threaten/force people to hand it over in person.

Re:There is no "almost impossible"

[qeveren]

Well, with the exception of a random, message-length one-time pad. Technically even that can be brute-forced, but even then you have no way of telling which result is the original message.

Re:There is no "almost impossible"

[N1AK]

My issue with calling OTPs encryption in this sense, although I accept it is encryption, is that it's really more like giving someone half the message than almost any other type of encryption. If I said I could encrypt the entire Bible to "1" by having a key that contained enough data to produce the contents of the bible then people might take exception to how useful my scheme was.

Re:There is no "almost impossible"

[Anonymous Coward]

It is probably an American spanner.

Re:There is no "almost impossible"

[Anonymous Coward]

Doesn't matter, both use metric. As long as it isn't a British wrench it'll work.

Re:There is no "almost impossible"

[Anonymous Coward]

Note: I am not talking about potential attacks against the algorithms here, etc. only pointing out that encryption is definitely not ALWAYS breakable by brute force.

But that assumes that there are flawless encryption methods. That is about as easy to prove as it is to disprove the second law of thermodynamics.
Perhaps there are theoretical encryption algorithms that are completely flawless and can't be bruteforced, but then the next question is, can it be implemented without using an ideal computer equivalent to the one needed to bruteforce it?

Re:There is no "almost impossible"

[Anonymous Coward]

Let's just hope they won't ask him to type it for them AFTER they've broken his fingers with a $5 wrench...

Re:There is no "almost impossible"

[Anonymous Coward]

It would be interesting to see that tested in court. Is forcing someone's finger onto their iPhone's sensor forcing them to reveal information under duress? You'd have a good chance of making everything on that iPhone (and anything discovered as a result of that information) inadmissable.

Re:There is no "almost impossible"

[dnaumov]

Thankfully, there is no way for this to actually work unless you were tranquilized as well. TouchID requires the finger to be very steady when touching the sensor and I don't see it being particularly feasible to force your finger to be steady unless you were drugged.

Re:There is no "almost impossible"

[dnaumov]

There won't be and never has been a user revolt due to this because Apple has NEVER ever helped users recover from a forgotten security code to an iPhone/iPad. Nothing is changing in this regard.

Re:There is no "almost impossible"

[bombman]

Make a key that is so large that it would be expected to break only if
you use every atom in the observable universe for computation for as
along as the expected age of the sun to crack it.
Sure that would be breakable, but it would not matter in the real wold.

Re:There is no "almost impossible"

[Anonymous Coward]

Well, decrypting may be a bit harder, but on the other hand it compresses extremely well.

Re:There is no "almost impossible"

[gnasher719]

Any encryption can be broken with enough processor power and time.

As explained elsewhere, there is encryption for which "enough processor power and time" doesn't exist in the universe. The limit is (total energy in the universe) divided by (smallest possible amount of energy to make any change, as dictated by quantum physics). That limit isn't anywhere close to 2^256.

Re:There is no "almost impossible"

[Anonymous Coward]

Sever it?

Re:There is no "almost impossible"

[RabidReindeer]

It would flip a coin...

Maybe it should just ask the cat.

Re:There is no "almost impossible"

[Anonymous Coward]

Are you sure about the OS X case?

Because when you turn on full disk encryption, it takes quite some time...and the password it uses is your normal login password, not something new that you enter specifically for the encryption.

Additionally, it gives you a recovery key which looks like a product activation code, so it's impossible to memorize. You can store it in a safe place such as on an encrypted volume on a different, independent computer. I don't go that far; I only use disk encryption on laptops that I travel with.

Anyway, forgetting your password and not having the recovery key isn't disastrous, you can just reinstall. You would've lost the same data if you had a disk failure; you should have backups of anything important anyhow.

Re:There is no "almost impossible"

[St.Creed]

It would flip a coin...

Maybe it should just ask the cat.

You could, but there's an even chance it's dead :)

Re:There is no "almost impossible"

[Bob the Super Hamste]

$5 doesn't get you a good wrench for hitting someone with as they are too small to be worth while. In the $20 to $30 range now you are talking. Personally I would just use a piece of 1/2" re-bar that is a couple of feet long much cheaper.

Re:There is no "almost impossible"

[Anonymous Coward]

256-bit keys are physically impossible to brute force as long as there are no shortcuts. Even 128-bit keys are practically impossible.

But having overly long keys and other overkill measures is useful. Almost every well-studied cipher has minor weaknesses that don't break the encryption but weaken it by a couple of orders of magnitude. Often reduced-rounds variants are effectively broken. So you want to have a naïve brute force cost many orders of magnitude beyond the practically impossible, so longer keys, more rounds beyond the minimum etc. are always warranted.

Anyhow, it seems to me that our current ciphers are well beyond good enough. Almost every single known way to break cryptosystems has nothing to do with the algorithms themselves but are possible because they are used in a ridiculously stupid way (WTF WEP?) or there are bugs in the implementation.

For a system without other weaknesses, there is an obvious and much easier channel of attack other than brute forcing the key...brute force and/or dictionary attack against the user password. Your data may be encrypted with 256-bit Ri^H^HAES, but if your password to unlock it is "1ama5tud", how hard is it really for an even semi-dedicated attacker to find?

Re:There is no "almost impossible"

[Bob the Super Hamste]

Just knock them out with a $5 wrench and call it good.

Re:There is no "almost impossible"

[Bob the Super Hamste]

The Brits use metric now it is only those old dodgy whitworth ones you have to be on the lookout for.

Re:There is no "almost impossible"

[Bob the Super Hamste]

I'm not worried about things that happen after the heat death of the universe though. I will be long dead and gone.

Re: There is no "almost impossible"

[Opportunist]

Careful there. A lot of people trying to make an example created a martyr.

Re: There is no "almost impossible"

[Anonymous Coward]

Not the same at all.

OTP allows future messages to be encrypted with a secret shared in the past. It is true encryption, you're spitting hairs that don't even exist.

Re:There is no "almost impossible"

[Anonymous Coward]

If the phone is locked, you can have it require a passcode.

Re:There is no "almost impossible"

[TheCarp]

However in practice it is trivial to use key sizes, and we do, which bump those time frames up into the utterly impractical to the point that even trying can't be justified. If it takes decades to crack one key, nobody is going to waste the resources on one key to find out if it was worth it. Its just silly. If it takes hundred of years, it was already silly at decades.

This is exactly why they go after service providers and end nodes....specifically because attacking the encryption by brute force or any method that doesn't start with the key or some other leak of information, is worthless.

Re:There is no "almost impossible"

[Aaden42]

There are two things you as a soon-to-be defendant can do:

1) Power down your phone if you believe you are about to be detained. On power-up, the device requires your passcode to unlock. TouchID doesn’t work after reboot until the passcode is entered once. You can do this without unlocking the device by holding the power & home button for 10 seconds.

2) Either before arrest while you can still surreptitiously access your phone or after when they’re trying to get your finger on the screen, use the wrong finger (one you haven’t enrolled in TouchID) or move your finger enough to smudge and get a bad read. You only get five attempts before the phone stops accepting TouchID, and you need to provide your passphrase again. If successful, the screen will say, “Touch ID does not recognize your fingerprint,” so it’s detectable to someone who knows what they’re doing, but also confirmation to you that it worked. As far as I know, there’s no timeout to this status. You will not be able to use TouchID until the passcode is entered.

Either way, TouchID is disabled and they need to get your passcode out of you. Assuming you’re still in ordinary LEO territory, a $5 wrench isn’t going to work out when it comes to admissibility. If you’re already in TLA non-citizen territory, you’re done for anyways. Your call if “making it easier on yourself” is a good play or not...

Re:There is no "almost impossible"

[Gibgezr]

Best laugh of the day. Thank you, Anonymous Coward.

Re:There is no "almost impossible"

[Anonymous Coward]

Authentication is all about identity. "Who are you?" is all that authentication cares about. For this, biometry is a perfect fit.

"What are you allowed to do?" is an entirely different question, and falls into the category of authorization.

Authentication and authorization go hand-in-hand, but they are not equivalent.

Re:There is no "almost impossible"

[Anonymous Coward]

You need to understand the problem better. A quantum computer doesn't change the equations, it changes what is being searched, and the class of problem you are searching for.

WIthout being great with QM, I can tell you that quantum computers can definitely solve the class of NP Complete problems easier, but probably can't solve the set of NP Hard problems. Maybe.

Given the presence of a quantum computer and a 256 bit key, the question becomes one of "can we recognize a solution when we see it?" based upon the ability to simultaneously test all 256 bits in parallel. Depending upon the class of encryption used, the answer might be "No"

256 Bits "obviously" refers to symmetric ciphers. And more specifically these days, probably a class of them known as feistel networks, which probably aren't ...very quantum computable, although they are (often) engineered to be hardware friendly.

If it was 2048 or 4096 or more bits, it's probably referring to asymetric keys -- e.g. RSA. The factoring of numbers -- is very quantum friendly (hence you see a push to DSA algorithms). You'll never see a 256 bit RSA key (I hope) though, because even my desktop can factor something in that size pretty quickly given a sieve.

The short of it is...

"a quantum computer probably isn't interesting for a 256 bit key, because it's not the type of problem they know how to recognize" (today, at least).

If you want to exploit quantum computation, you need a way to recognize a solution immediately when you test it.

Re:There is no "almost impossible"

[Anonymous Coward]

I believe you missed step 4.5 where the police shoot and/or taze you.

Re:There is no "almost impossible"

[Sobrique]

I think you then get into an interesting conversation about how easy you want to make it for a clever criminal to avoid getting caught.

Re:There is no "almost impossible"

[Sobrique]

The single use part is inconvenient, but the killer is the key exchange. You need to have a new 'pad' for each person you need to communicate with, and you need to get it to them in the first place, without it being compromised. And you need very high quality randomness, which is surprisingly difficult to generate.

Re:There is no "almost impossible"

[Sobrique]

Just make sure you encrypt the backup... oh wait...

Re:There is no "almost impossible"

[CauseBy]

Do you mean to say that you encrypt important data using passwords that you can't remember? That doesn't make sense to me.

Re:There is no "almost impossible"

[CauseBy]

cf/authentication/authorization/g

You are authenticated by your fingerprint but that might not be good enough for reliable authorization.

Re:There is no "almost impossible"

[bobbied]

Encryption is ALWAYS breakable by brute force. Question is how long does it take? Seconds? Hours? Months? Years? Decades? This is usually determined by key sizes. The longer the key, the longer it takes to brute force. (generally)

Um, not quite, one time pads are provably impossible to break by brute force since the message can be decoded into any message of the right length.

One Time Pads are incredibly difficult to implement because you have to securely distribute the pads AND you have to make sure your pads are indeed random. So, for use on any kind of digital device, nobody can usually afford to use a One Time Pad for encrypting their phone.

I had assumed that the context ruled out the One Use Pad, so I didn't put an exception in for that. Sorry.

Re:There is no "almost impossible"

[CauseBy]

I've tried to use this logic when explaining "solving chess" and "replacing IPv6".

I had a too-long argument with a coworker about whether it is possible to "solve chess". I said no, because the computer memory required has more bits than there are photons in the universe. He wasn't convinced so I modified my argument: "It's not that solving chess is impossible, but that it is impossible in this universe." Give me a different universe and then we'll reconsider.

Same thing with IPv6. I've heard educated people say "It'll be a few more years until we just run out of address space there, too." I say, no. We have enough addresses to individually address every atom in the solar system, with spare addresses. Once we start addressing atoms in other star systems then we'll reconsider.

Re:There is no "almost impossible"

[bobbied]

Actually, it is not. In reality, a 256 bit key can not be brute forced because of physics - especially the second law of thermodynamics. One of the results of this law is that information needs energy to be represented. In an ideal computer, the representation of one bit requires kT energy, where k is the Boltzman constant and T is the temperature. Let's assume we can operate at the average temperature of 3.2 Kelvin, the average temperature of the universe. The required energy to represent a bit in this case would be around 4.416*10-23 Joule. The annual amount of energy that our sun emits is about 1.21*10^34 Joule. Dividing this with the per bit-change energy, we could provide power for our ideal computer to perform 2.74*10^56 bit changes. This is just about enough to have a 187-bit counter go through all its states. This does not include the energy needed for the computations to test each key (our counter state in this case) for correctness. A 256 bit counter would require ~400.000.000.000.000.000.000 stars like our sun just to represent in the counter of our ideal computer. Or, to say it in the words of Bruce Schneier: "...brute force attacks against 256-bit keys will be infeasible until computers are built from something other than matter and occupy something other than space". Note: I am not talking about potential attacks against the algorithms here, etc. only pointing out that encryption is definitely not ALWAYS breakable by brute force.

I have no clue what all the above really means.... If you are saying that 256 bit keys are hard to break, I would concur. If you are saying that it would take a long time, I would again agree. However, if you look at "possible" it is totally possible to brute force a 256 bit key, it just takes TIME to do, LOTS of time OR lots of computers. Either way, it is perfectly possible... Now it may take a LOT of computers (more than are physically possible) or it may take a LONG time (more than we likely have before the sun destroys the earth) but that is all about being practical and not about being possible.

Re:There is no "almost impossible"

[bobbied]

Ok.. One time pads... So you going to remember that to unlock your phone?

Practical encryption is ALWAYS crackable. (OTP usually CAN be hacked by attacking the pad generation and distribution process, but if you do that right, not crackable. It's just that it is REALLY hard to do it right.)

Re:There is no "almost impossible"

[bobbied]

>Encryption is ALWAYS breakable by brute force. ...with the exception One Time Pad encryption.

Granted.... AND it's a TOTALLY unusable technique in most cases... It's REALLY HARD to do in the real world which is why I didn't put in an exception to my statement.

Re:There is no "almost impossible"

[HornWumpus]

Your shopping at the wrong places. $5 will get you a pipe wrench at Harbor Freight. Useless for plumbing, but great for braining someone.

Re:There is no "almost impossible"

[Just Some Guy]

Same thing with IPv6. I've heard educated people say "It'll be a few more years until we just run out of address space there, too."

Careful there. By design, the IPv6 address space is very sparse. For instance, my house has a /48 netblock allocated to it. If that were the universal rule, the effective address space would be 2^48 networks, not 2^128 hosts. That's also assuming that all of the /48 space is allocated perfectly and densely, and not like a /16 per ISP which would mean that we'd never be able to have more than 66,000 ISPs.

IPv6 will not feasibly support 2^128 hosts because it was never meant for each host to be consecutively numbered. While your coworker is incorrect, your standpoint isn't exactly right, either.

Re:There is no "almost impossible"

[Anonymous Coward]

Using Grover's algorithm, you can cut down the required time from something on the order of 2^256 to 2^128. This is also a good reason to use 256bit keys at all, rather than 128bit keys, for which the time would be reduced to 2^64.

Re:There is no "almost impossible"

[vux984]

. Is forcing someone's finger onto their iPhone's sensor forcing them to reveal information under duress?

It would be no different then forcing a suspect to provide fingerprints or dna samples. They'd need a warrant for it, but they could absolutely do it.

I agree if they just forced you without a warrant, that you'd probably get it all ruled inadmissible.

Re:There is no "almost impossible"

[flargleblarg]

I have no clue what all the above really means.... If you are saying that 256 bit keys are hard to break, I would concur. If you are saying that it would take a long time, I would again agree. However, if you look at "possible" it is totally possible to brute force a 256 bit key, it just takes TIME to do, LOTS of time OR lots of computers. Either way, it is perfectly possible... Now it may take a LOT of computers (more than are physically possible) or it may take a LONG time (more than we likely have before the sun destroys the earth) but that is all about being practical and not about being possible.

It's mathematically possible. It's humanly impossible. No human will ever build a machine using normal matter that is capable of it.

Re:There is no "almost impossible"

[flargleblarg]

Encryption is ALWAYS breakable by brute force. Question is how long does it take? Seconds? Hours? Months? Years? Decades? This is usually determined by key sizes. The longer the key, the longer it takes to brute force. (generally)

Chuck Norris can brute force a 256-bit key in the time it takes to blink his eyes.

Re:There is no "almost impossible"

[Anonymous Coward]

That's called an autokey cypher, and there are fairly standard methods for breaking them.

Re:There is no "almost impossible"

[Ihlosi]

Chuck Norris can brute force a 256-bit key in the time it takes to blink his eyes.

Chuck Norris never blinks. Never.

Re: There is no "almost impossible"

[N1AK]

It's exactly the same, just an especially pointless variation. You need to get these OTP to someone in a way that is completely secure from interception (which begs the question why not send the message itself that way). Most people aren't going to take up an encryption mechanism which means sharing USB pens loaded with OTPs to everyone they communicate with.

Besides which, talking of splitting hairs, given that I said "I accept it is encryption" how exactly was I claiming it wasn't?

A change in the law?

[Dupple]

Here's an interesting follow up from Ars

http://arstechnica.com/tech-po...

Not completely gone

[whoever57]

Apparently (I haven't read the source docs myself), there is some similar language -- suggesting that some type of order has been served on Apple, so the canary is perhaps not dead yet -- just pining for the fjords [yes, I know, not really the correct use of this phrase].

To date, Apple has not received any orders for bulk data

What's missing is a specific reference to Section 215, suggesting that a limited Section 215 order has been served on Apple.

Re:Not completely gone

[Anonymous Coward]

One has wonder if there is some sort of pecking order in issuing these warrants.

Re:Not completely gone

[AmiMoJo]

The language is very specific. Maybe they didn't get a request for bulk data, maybe they just had to provide a back door into everything so that law enforcement could serve itself. Then again, maybe not, we have no way of knowing, which makes all American company's claims that they resist the government worthless.

Re:Not completely gone

[dbraden]

Exactly. Or, maybe they received a bulk of requests, each for a specific piece of data.

Re:Not completely gone

[Daniel_Staal]

From the Ars story on the article: Apparently there's some newish law that would keep them from commenting specifically on Section 215 - If they want to do aggregate disclosure they have to group it with disclosures under another law. (Section 702 - which we know they have received orders under, since it was in the Snowden files.) (They also have the option of doing non-aggregate disclosures, but they couldn't do it immediately.)

Re:Not completely gone

[thunderclap]

Apparently (I haven't read the source docs myself), there is some similar language -- suggesting that some type of order has been served on Apple, so the canary is perhaps not dead yet -- just pining for the fjords [yes, I know, not really the correct use of this phrase].

To date, Apple has not received any orders for bulk data

What's missing is a specific reference to Section 215, suggesting that a limited Section 215 order has been served on Apple.

If its pining for the fjords then it is in fact dead. 'E's not pinin'! 'E's passed on! This canary is no more! He has ceased to be! 'E's expired and gone to meet 'is maker! 'E's a stiff! Bereft of life, 'e rests in peace! 'E's be pushing up the daisies! 'Is metabolic processes are now 'istory! 'E's off the twig! 'E's kicked the bucket, 'e's shuffled off 'is mortal coil, run down the curtain and joined the bleedin' choir invisible!! He's f*ckin' snuffed it!..... THIS IS AN EX CANARY!!

Re:Not completely gone

[Anonymous Coward]

Apparently (I haven't read the source docs myself), there is some similar language -- suggesting that some type of order has been served on Apple, so the canary is perhaps not dead yet -- just pining for the fjords [yes, I know, not really the correct use of this phrase].

To date, Apple has not received any orders for bulk data

What's missing is a specific reference to Section 215, suggesting that a limited Section 215 order has been served on Apple.

Warrant canaries are a tool used by companies and publishers to signify to their users that, so far, they have not been subject to a given type of law enforcement request such as a secret subpoena.

Really? These companies can and will be saying this crap to protect their money, and power. I'm not buying any of A**holes bullshit, nor any of the other companies saying they were unwilling or forcibly told to give up information or data. However I'm not convinced they weren't! Laughable how many people just buy into what a company says.

Re:Not completely gone

[gl4ss]

well cook already made a public canary announcement or a lie, about them not being able to read your mail while at the same time it's obvious for anyone that they can change your apple credentials with or without your consent(giving access to your mail).

Re:Not completely gone

[gnasher719]

well cook already made a public canary announcement or a lie, about them not being able to read your mail while at the same time it's obvious for anyone that they can change your apple credentials with or without your consent(giving access to your mail).

Except the only source for the "not being able to read your mail" is the summary of a slashdot article, which managed to incorrectly quote the article that it summarized. And the source of the statement is openly available (a 1 hour interview with Tim Cook) and he clearly doesn't say anything like what you claim.

Re:Not completely gone

[Paradise Pete]

I don't think he said that. It wouldn't make any sense, given how email works. With their own Messges platform the encryption is already done on the device before Apple transports the message. With email that is obviously not the case.
Incoming email is normally unencrypted, so there's no way Apple could then encrypt it in a way they couldn't read. And they can't as a matter of course encrypt outgoing email because the receiver wouldn't necessarily be able to decrypt it. So email remains, as it always has been, not a good place at all to hide secrets.

fortress on foundations of sand.

[Anonymous Coward]

untill, and unless the issue of baseband firmware/hardware is addressed- all this security marking hype is meaningless and shameful. The phone company/government has more authority/control over a phone then the phones owner. It doesn't matter if the OS is a perfect impenitrable fortress of security- when the baseband processor can simply give out all the secrets/keys. Every phone is Backdoored from the factory... - Would love to be proven wrong, slashdot commenters. Is there phone with FOSS baseband- or at least not in a master/slave shared resorce configuration with the user side of the phone?

Re:fortress on foundations of sand.

[ColdWetDog]

Nope. Not for everything. Perhaps every phone conversation, but I don't necessary use my smart phone for talking. If I, for example, work in 1Password which encrypts the data while synching, the NSA can listen in on that conversation and presuming they haven't broken my password or the companies algorithms, that conversation is not understandable.

If it goes into the modem encrypted, having the keys to the modem isn't going to help all that much.

And you're an idiot if you're doing anything remotely illegal on a cell phone system anyway.

Re:fortress on foundations of sand.

[Anonymous Coward]

The baseband has access to your phones main ram- (on all phones as far as I'm aware). any active encryption keys are kept in ram (unencrypted- as everything in ram is). So, there's no need to 'break' encryption- baseband has access below the encyrption level via hardware- anything in ram can potentially be dumped through the cell radio. There is no reason the hardware needs to be designed this way- I'd be shocked if it wasn't intentional.

I'd love to be revealed as ignorant on this subject- if you or anyone has the technical knowlege to show my theory as such, please, by all means.

What really confuses me, is even on /. (which imo is one of, if not the, best tech sites on the internet, especially for comments) all this "phony security" gets headlines and comments as if it matters. All the ranting and raving about the fancy new locks and bars on the windows- but the house is missing an exterior wall in the back of a dark closet. Seams like more people should know better, and say something about it. There is a fundemental and fatal security flaw in cell phone archicatecture- no one seams to care, much less talk of fixing it.

Even if one is so warped to think that it fine for the phone manufacturer, the telco, and the gov have more authority over their device then they themselves have- the fact is if those people can do it, so can the tech adapt crooks, theives, and scammers.

Re:Naughty Obama wants to see you naked.

[DivineKnight]

I'm sure he does, but like everyone else, if he wants to see tits, he has to pay (am I am not talking about the people lending him the binoculars).

Better title

[smittyoneeach]

"Apple Warranty Canary Caught Working in a Coal Mine"

Re:Better title

[Patent Lover]

I like the Devo version, but the original sounds pretty good too https://www.youtube.com/watch?...

Re:Better title

[smittyoneeach]

Nice. Speaking of covers, how about Soundgarden doing Devo?

impossibilium nulla obligatio

[Drishmung]

It may also be to a company's financial advantage to guard their customers' data in this way, and I don't mean that it will get them more customers.

The cost of complying with requests for this sort of data is not zero, and may in fact be considerable. The Agencies may do it at their own cost, but you can bet they really want the cost out of their own budgets and into someone else's.

If a company really has no way to deliver the information, impossibilium nulla obligatio (no legal obligation to do the impossible), they have no compliance costs.

Wouldn't it be amusing

[dbIII]

Wouldn't it be amusing if the current batch of private celebrity photos actually came from an "intelligence community" leak after a pile of Apple data was seized.
An interesting thing that Snowden has show us is that there is a vast sprawling web of people extending deep into private enterprise that have access to "secret" information. Imagine someone with a few of those photos, they can make serious dollars - it's not as if they are compromising their values of national security and they are already working for profit instead of duty.

Re:Wouldn't it be amusing

[Anonymous Coward]

That does pre-suppose those people who get the nude celebrity photos can find time to leave the house ;-)

What do Terrorists use?

[NotQuiteReal]

Obviously they are not hipster enough for Apple products, ironic beards not withstanding.

Android products are too "free", and therefore would encourage infidel proclivities.

They kill all their own intellectuals who could create a new phone, so... they must use WINDOWS!!!!

Re:What do Terrorists use?

[Rakarra]

Obviously they are not hipster enough for Apple products, ironic beards not withstanding.

I don't think they're going for -irony- with those beards.

You would be correct though in stating that both hipsters and terrorists try to make statements with their beards.

besides...

[Anonymous Coward]

It can't be Apple - they download WESTERN music to your phone, without your permission, which could GET YOU KILLED.

Re:besides...

[mrxak]

I'm not sure if you should be modded Funny or Insightful.

Re:besides...

[rossdee]

"It can't be Apple - they download WESTERN music to your phone, without your permission"

Huh? U2 is not Western music - it isn't even Country..

Re:besides...

[thunderclap]

It can't be Apple - they download WESTERN music to your phone, without your permission, which could GET YOU KILLED.

Only if you are playing in the middle east or another area with similar values. Besides how did you get a phone and account there anyway?

Re:besides...

[Anonymous Coward]

context, man. culturally western as in "western medicine".

Re:besides...

[Anonymous Coward]

In fact it's debatable whether it's even music...

How many warrant canaries are allowed?

[arobatino]

One warrant canary conveys 1 bit of data. How many are allowed? Has anyone gotten away with using more than one?

Re:How many warrant canaries are allowed?

[thunderclap]

One warrant canary conveys 1 bit of data. How many are allowed? Has anyone gotten away with using more than one?

1.5 x 10 to the 10th power

Re:How many warrant canaries are allowed?

[91degrees]

I'm guessing they could demand you also remove mention of whether or not X has been done

Coincidence?

[PopeRatzo]

It's interesting that this story hits Slashdot the same day as the story about Apple double-pinky swearing that they'll never, unh-uh, not ever unlock your iPhone for law enforcement any more.

I don't believe a fucking word. They'd throw a baby off a bridge for a $2 bump in their stock price. It's the same with any corporation, but they're closed ecosystem just means there's no way to protect yourself.

All this "canary" bullshit begs the question why, if Apple really cared one little bit about their customers, don't they just come out and say what they have to say. Apple may be one of a very small handful of corporations that actually could stand up to the surveillance regime. As far as I'm concerned, tacit complicity is worse than loud complicity. Especially when your selling yourself as someone who can be trusted with peoples' mobile payments and personal information and when you pretend you "Think Different". Remember the famous 1984 Apple ad? They are now part of the problem.

Re:Coincidence?

[Paradise Pete]

if Apple really cared one little bit about their customers

Apple does some odd things, but I can't imagine anyone could watch the Charlie Rose interview of Tim Cook and come away with the impression that he and Apple don't care about their customers. To hold that position you'd have to believe he was a pathological liar and just plain evil.

Re:Coincidence?

[Bogtha]

I don't believe a fucking word. They'd throw a baby off a bridge for a $2 bump in their stock price.

How would providing data to the USA government raise their stock prices? If anything, it would lower them.

You don't really have to trust Apple to do the right thing here. If - as you say - they are only motivated by profit, then look at what is more profitable for them. Their business model doesn't depend on access to their customers' personal data and habits. Google, on the other hand, makes use of their users' personal data and habits, however benignly you choose to judge that.

Basically, privacy is a competitive advantage Apple have against their biggest rival in the mobile market. If you think they are only motivated by profit, then the reasonable conclusion is that they will act to preserve their customers' privacy rather than disclose it.

Re:Coincidence?

[PopeRatzo]

How would providing data to the USA government raise their stock prices? If anything, it would lower them.

Maybe you don't get the full picture. They cooperate with the US gov't, and the gov't looks the other way when they try to claim that 80% of their profits come from outside the US when it's tax time. Apple has so many sweetheart deals with the US gov that it's not funny, mostly in the area of non-compliance with tax code or outright tax evasion.

This increases the bottom line and that increases stock price.

Just the fact that Apple is allowed to flaunt the anti-trust laws is a good example of why Apple (and shareholders) benefit from spying.

[Full disclosure: Apple stock bought in the '80s and throughout the '90s paid for my daughter's undergraduate and graduate education. Plus a couple of new cars (though modest ones, not the Gallardo I had hoped. You know, Mazdas and like that. I cashed out around $650.)

Re:Coincidence?

[Bogtha]

Apple has so many sweetheart deals with the US gov that it's not funny, mostly in the area of non-compliance with tax code or outright tax evasion.

Can you substantiate this? Every time somebody has said this to me and they've gone into specifics, it's been bullshit.

Just the fact that Apple is allowed to flaunt the anti-trust laws is a good example of why Apple (and shareholders) benefit from spying.

Same here. Which anti-trust laws? Be specific.

Re:Coincidence?

[PopeRatzo]

Apple does some odd things, but I can't imagine anyone could watch the Charlie Rose interview of Tim Cook and come away with the impression that he and Apple don't care about their customers. To hold that position you'd have to believe he was a pathological liar and just plain evil.

Well, there is a very high potential benefit to having a CEO who is a pathological liar. So high, in fact, that it would be incredible if someone rose to that position without being a pathological liar. And didn't Steve Jobs set the precedent?

And you do understand the reason Tim Cook goes on Charlie Rose, right? It's not because they're old friends having a nice chat. It's a very carefully planned and controlled public relations effort. They're trying to "shape the narrative" which is pretty much the definition of pathological lying. Celebrity CEOs are all about image, and image exists to fool people.

Re:Coincidence?

[PopeRatzo]

Can you substantiate this? Every time somebody has said this to me and they've gone into specifics, it's been bullshit.

You know, it's good that you come to me instead of the morons you've been talking to you, because I can definitely substantiate this:

http://www.nytimes.com/interac...

http://www.nytimes.com/2012/04...

http://arstechnica.com/busines...

See, the reason "Silicon Valley" (meaning the tech industry) is allowed to play this game is because they're willing to let the NSA upskirt your private information and communications. And since they've already got their hand up your dress, they're going to cop a little feel for themselves, you know? So the US Government is happy, the corporations get to make a shitload of money from your private information and communications, and they get to keep playing their little tax game.

If you had a government worth a damn (like during the trust-busting era), they wouldn't allow companies like Apple to perpetrate their little willful fraud.

Now, the next time somebody tells you about Apple and the government playing footsie to protect Apple's tax advantage, I hope you won't continue to say it's bullshit.

Same here. Which anti-trust laws? Be specific.

Same here. Now when somebody asks you "Which anti-trust laws is Apple violating?" you'll be able to tell them:

https://en.wikipedia.org/wiki/....

http://www.jstor.org/discover/...

See, the problem is "vertical integration". You can't control both the product, the store that sells the product, the insurance that covers the product, the consumables (media) that plays on the product and on and on down the distribution chain. Even making both the hardware and the software is arguably a violation of anti-trust. But when you start to also own the only store that sells software for the product and have a vested interest in every bit of software that runs on the product you've crossed so many lines that Apple should have been broken up into several companies long ago. Same with Microsoft and many others. They're not just over the line, they're WAY over the line. The technical term is an oligopoly. They are anti-competitive and they destroy entire markets. Oligopolies are what happen in fascist countries.

I hope you appreciate the time and energy I spend disabusing you of your notion that "it's bullshit". And I hope you enjoyed edification as much as I enjoyed providing it.

Goddamn Liars

[PopeRatzo]

Apple's recent decision to rework its latest encryption in a way that makes it almost impossible for the company to turn over data from most iPhones or iPads to police.

"Almost impossible".

They really think you're stupid.

See Apple's privacy site for details

[Camembert]

FYI Apple's privacy site is here: http://www.apple.com/privacy/p...

Of course there will be plenty of cynism here but I think it is in general a good & commendable effort for transparency. Interesting is the section on government information request:

National Security Orders from the U.S. government.

A tiny percentage of our millions of accounts is affected by national security-related requests. In the first six months of 2014, we received 250 or fewer of these requests. Though we would like to be more specific, by law this is the most precise information we are currently allowed to disclose.

No warrant canary required, it is here in the open.
So what could be the kind of thing asked taken into account the other the other privacy information on the site?

Re:See Apple's privacy site for details

[Prune]

No, it is not "here in the open", because "250 and fewer" includes zero as an option. As per the Ars article someone already posted early on in this /. discussion, http://arstechnica.com/tech-po..., the 0-250 range is a reflection of new guidelines from the department of justice. A canary almost becomes unworkable for companies now because saying you have not received such a warrant in the given time period is equivalent to saying you have received 0 orders, which is more specific than the smallest allowable range of 0-250.

Re:See Apple's privacy site for details

[Paradise Pete]

That's a good point. It was in effect being too specific under those "guidelines." So perhaps they were told to remove it, or maybe even some agency issued a throwaway request simply to make it untrue, and thus remove it that way.

I for one am happy that Apple's new strategy to fight this is to continue to minimize the amount of personal information they receive.

Re: See Apple's privacy site for details

[Camembert]

Fair enough, but is it a problem? Any company could get secret requests for 0-250 accounts.

Re: See Apple's privacy site for details

[gnasher719]

Fair enough, but is it a problem? Any company could get secret requests for 0-250 accounts.

I'm not a company, and I'm not even in the USA, and I tell you, I also got secret requests for 0 to 250 accounts.

Re:See Apple's privacy site for details

[Anonymous Coward]

No, it is not "here in the open", because "250 and fewer" includes zero as an option.

no it doesn't. it also doesn't include negative numbers as an option. if i want to say i have zero apples in my hand, i don't use language like "250 or fewer apples".

The Other Stupid

[SuperKendall]

They really think you're stupid.

No, the rest of us that understand encryption think you are.

Re:The Other Stupid

[Anonymous Coward]

Because there's no possible way to circumvent the mechanism that handles the encryption, right?

Re:The Other Stupid

[PopeRatzo]

Because when it comes to security, "almost" is "not at all".

Not Coincidence, it's the point

[SuperKendall]

Apple double-pinky swearing that they'll never, unh-uh, not ever unlock your iPhone

That's not what they said - they said the've altered it so they CANNOT unlock your iPhone, even if they want to.

Given how the technology works, that is a quite reasonable assertion. iOS devices have had full device encryption for some time, without that key you have nothing.

All this "canary" bullshit begs the question why, if Apple really cared one little bit about their customers, don't they just come out and say what they have to say.

That just shows a misunderstanding of what companies are legally ALLOWED to say. Once you get the order you CANNOT talk about it, thus the device of the canary.

Re:Not Coincidence, it's the point

[Anonymous Coward]

FALSE. The First Amendment to the Constitution of the United States says that you can *say* whatever you want.
There is no higher law than the Constitution.
Therefore Apple and everyone else is *legally allowed* to say whatever they want.
Thus, Apple et al either are afraid to assert their rights and speak, or they have something to hide.
Either way, until they speak, they lose respect.

Re:Not Coincidence, it's the point

[Anonymous Coward]

FALSE. The First Amendment to the Constitution of the United States says that you can *say* whatever you want.
There is no higher law than the Constitution.
Therefore Apple and everyone else is *legally allowed* to say whatever they want.
Thus, Apple et al either are afraid to assert their rights and speak, or they have something to hide.
Either way, until they speak, they lose respect.

Do any of your points apply... if you replace "Apple" with "Snowden?"
Still don't get the point? It's not that they can't say it. One of them did say his piece. And he's been on the run ever since. But a megacompany cannot escape the USA and still make money in it. Its assets would be frozen, the money confiscated, redistributed, etc. People would ACTUALLY go to jail, which is something that we can't say about the implementors of the NSA laws and collection system. And speaking of conspiracies... who is to say that people are keeping quiet? What if the media and other (megacompanies) who also cannot flee these oppressors, are being silenced?

Re:Not Coincidence, it's the point

[Anonymous Coward]

Note that this doesn't mean somebody else would be incapable of unlocking your secrets. All Apple needs to do is encrypt the pass key with some (law-enforcement agency's) public key and stash that token away someplace. The agency may then recover your data, but not Apple. In effect, Apple has wiped their hands and removed themselves from the loop.

Re:Not Coincidence, it's the point

[Anonymous Coward]

Yea... so, you have absolutely no fucking clue what you're talking about, and are missing the main reason why people are currently upset with the US Government.

http://lavabit.com

Re:Not Coincidence, it's the point

[AmiMoJo]

I think the GP has a point. Of Apple defied the order what would happen? Tim Cook in handcuffs? There would be hipster riots up and down the country, not to mention investors and friends of the government getting very upset as their stock price crashed.

It would be risky but if they really stand by their principals like they say they do...

Re:Not Coincidence, it's the point

[qbast]

Problem of important people getting upset could be solved by quiet warning to short the stock. As for hipster riots? I would pay to see this - it would be pure comedy gold.

Re:Not Coincidence, it's the point

[gnasher719]

I think the GP has a point. Of Apple defied the order what would happen? Tim Cook in handcuffs? There would be hipster riots up and down the country, not to mention investors and friends of the government getting very upset as their stock price crashed.

Tim Cook in handcuffs? Maybe. You as an unknown Slashdot poster can of course easily demand heroics on his part. It's a lot harder if your name is Tim Cook. Complaints about the stock price crashing? Well, that would be directly due to Cook's actions, so he'd probably lose his job about it.

But more importantly, it is easy for you to ask him to act illegally. I suppose he doesn't want to do anything illegal. For example, unlike a Samsung CEO who gets convicted and pardoned, I wouldn't expect any conviction of Tim Cook for breaking the law would go away. Would governement agencies be allowed to buy from a company whose CEO is a convicted criminal?

What Apple _does_ is exactly what they should do: They make information about the horrible laws public as much as they can. They do whatever they can to get the laws changed.

Re:Not Coincidence, it's the point

[Anonymous Coward]

But Apple could update the operating system on your phone with a malicious patch just for you and then proceed to decrypt the data that way.

As long as you have automatic updates on, you will always be at the mercy of your operating system provider. Even if you do check the updates before applying them, it's quite possible that it's actually legal for law enforcement to force the update to appear inconspicuous.

Re:Not Coincidence, it's the point

[Anonymous Coward]

If they are technically unable to do what the court requests, how is it defying the order?

The court could insist that all encryption products must have back doors, but that would be a HUGE issue in and of itself, going far beyond Apple.

Re:Not Coincidence, it's the point

[Anonymous Coward]

If the hipsters riot, who will pour my coffee?

Re:Not Coincidence, it's the point

[Anonymous Coward]

When the law itself is illegal, breaking it is the only legal thing to do.

"Congress shall make no law... abridging the freedom of speech". A law, passed by Congress, stating that you may not say when the government has requested evidence from you is invalid and unconstitutional.

Law enforcement officers may arrest you for violating that law, but the courts must acquit you and nullify the law. To fail to do so is to verify that the entire system of government is invalid and is no longer in force. That means the constitution has failed and is also no longer in force. Without the constitution, all three branches of the government cease to exist and the people that make up those branches of government are 1) unemployed, and 2) not protected by sovereign law against overthrow or violence.

This sort of bullshit law should scare the holy living pants out of every government employee, from top to bottom, since it puts them all at risk.

Re:Not Coincidence, it's the point

[Anonymous Coward]

Given how the technology works, that is a quite reasonable assertion.

Why is it reasonable to assume iOS devices don't automatically generate a recovery key and upload it to Apple?

Re:Not Coincidence, it's the point

[Anonymous Coward]

That just shows a misunderstanding of what companies are legally ALLOWED to say. Once you get the order you CANNOT talk about it, thus the device of the canary.

I think you are misunderstanding "the law". It is not a law of physics. You can actually break it.

Re:Not Coincidence, it's the point

[Rakarra]

I think the GP has a point. Of Apple defied the order what would happen? Tim Cook in handcuffs?

There's no reason to be so heavy handed. They would just get a bad reputation on the federal level as a company which refused to cooperate with investigators on terrorism manners. Contracts would start to dry up. Departments that used macs would start to switch to Linux. iphones would be replaced with Android or something more custom.

Congress passed the "National Minimum Drinking Age Act," a matter which constitutionally they should have little authority over. When some states showed little interest in raising the drinking age to 21, the ATF didn't go in with guns and demand the state legislature to change their mind. Instead, they said "look, the act authorizes us to cut the amount of federal highway funds that go to your state. That's what will happen if you don't raise the minimum legal drinking age." Lo and behold, within a few years, all 50 states and the District of Columbia had "voluntarily raised" the drinking age to 21. That's how things get done: not with the stick, but that they legally offer a lot of carrots that states can't afford to turn down, and then attach strings to those carrots to get states to do things that Congress shouldn't have authority over.

It would be risky but if they really stand by their principals like they say they do...

What would happen if they stood by their principals is little more than an extremely large entity giving its business to their competitors. Very little would happen that could give those in charge direct bad press.

Re:Not Coincidence, it's the point

[Ihlosi]

That's how things get done: not with the stick, but that they legally offer a lot of carrots that states can't afford to turn down, and then attach strings to those carrots to get states to do things that Congress shouldn't have authority over.

I wonder how much extra tax money from alcohol sales a state could make if it lowered the drinking age to 18 ...

Re:There is no

[AHuxley]

With a gov/mil buying spy software thats ready for average consumer phone products?
The running process and modules are looked at to ensure different drop/inject methods will get around any antivirus products found.
With your average consumer OS and devices, seconds after you enter your pw :)
Its like the 1950's and been given Western encryption hardware. The code works and the message will not be broken as sent.
Its just that using TEMPEST every plaintext keystroke in and print out is readable near the hardware.
That same fun idea has never left signals intelligence, get the world fixated on encryption, company branding, while a input layer just offers up all plaintext.

Any country's...

[Anonymous Coward]

If that really is your position, it's true for any damn country on the planet. Don't you dare imply this supposed issue could only be American.

Be honest.

Re:Any country's...

[Anonymous Coward]

Well, obviously it isn't exclusively American (the USA isn't the only retarded country in the world), but that doesn't mean it applies to everyone either.

fortress on foundations of sand.

[AHuxley]

Thats why govs use number stations and one time pads. The data around any encryption use found is just so useful.
Every product sold that can be connected and used with a telco has to conform tech thats wide open to "Communications Assistance for Law Enforcement Act"
https://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act

They should increase the number of 'canaries'

[mysidia]

Instead of providing just one global canary.... more canaries, so the identity of which canaries were withdrawn, could be used to help ascertain the nature of the request(s) received.

They should also provide each user their own 'custom' canary.

For example: an option to receive every month, every quarter, every week, or every day, a personalized canary statement that "Apple has never received an order under Section 215 of the USA Patriot Act which included information related to your account records. We would expect to challenge such an order if served on us."

Re:They should increase the number of 'canaries'

[Anonymous Coward]

Killing thousands of canaries? Don't upset PETA :P

Re:They should increase the number of 'canaries'

[Opportunist]

Why not? Upsetting fanatics is a great pastime.

Re:They should increase the number of 'canaries'

[N1AK]

They should also provide each user their own 'custom' canary.

Unfortunately that's entirely impossible in the current situation. The canaries that are currently use, or used recently, have to be very carefully constructed to avoid removing it breaching the laws regarding the secrecy of the orders. Apple's view, at least until recently, was that disclosing that they hadn't received any, for anyone, was generic enough as to not breach secrecy. Doing it for individual users would be about as legally sound as phoning the user up and warning him that the Feds are after him.

Re:There is no

[Anonymous Coward]

You didn't specify that both sides use the same units. 2 groups of 1 and a quarter somethings + 2 more such groups = 5 somethings

Re:There is no

[Anonymous Coward]

You might be able to brute force the possible states of the input to the key generator though. We have seen some pretty bad entropy harvesters around.

How many warrant canaries are allowed?

[Anonymous Coward]

We haven't done X, Y, or Z.

We haven't done X.

Obama is but a puppet

[Taco Cowboy]

The huge machinery behind the NSA / CIA / FBI and all those alphabet agencies wants total control, and it has the enthusiastic support of private companies such as Google, Microsoft, Apple, Cisco, amongst others

Obama? That one is but a puppet

When the term of this puppet ends, by 2016 they will have another puppet installed. But of course, they will give us an "illusive election", whereby no matter who we vote for, it will be their puppet who will be installed inside the Casa Blanca!

Viva la Maquinaria !!

Re:Obama is but a puppet

[Concerned Onlooker]

"The huge machinery behind the NSA / CIA / FBI and all those alphabet agencies wants total control, and it has the enthusiastic support of private companies such as Google, Microsoft, Apple, Cisco, amongst others"

While I admit that we have a de facto oligarchy here in the US I have to wonder that if the above were true then why have a warrant canary at all?

Re:Obama is but a puppet

[Anonymous Coward]

if the above were true then why have a warrant canary at all?

Haven't you seen the PR? They're trying to differentiate themselves from MS etc by claiming to think differently about privacy.

Tim Cook says "Apple aims to sell great products, not collect user information", and that's repeated ad nauseum by all their Social Media Managers flocking here.

It's their one big selling point.

Re:Obama is but a puppet

[hairyfeet]

I simply think they know what is coming, we are about to hit (if we haven't already) the singularity, that moment in history where the world is completely changed forever, like the invention of the engine and the airplane but the coming one? Its NOT gonna be nice if the "Ayn Randiates" in the halls of power have their way.

So what is the new singularity? Simple its the day when human labor is no longer needed to maintain and advance the world. Its the day when everything from picking beans to paving roads can all be done by machines that never get paid, never ask for days off, its the corporate idea of heaven!Its the dark reality of John Henry, that no matter how hard you work, even if you work yourself to death, the machine will just keep on working and will run you down without a bit of remorse.

When that day comes there is really only 3 paths, one of which we partially do now which is 1.- "make work" where you pay somebody for doing a pointless "job". We do that now at fast food joints, if you raised the minimum wage to a living wage and quit letting the corps hand out "how to get government handout" videos to new employees? You'd find within a year all the fast food workers replaced with an automated system that not only wouldn't get paid but would probably have a better track record than the underpaid overworked employees do know when it comes to getting orders correct.

The second option would be the "Star Trek Socialist paradise" which would be the most humane of the three, basically give everyone a basic wage and let them do what they will with their free time while giving extra benefits and credits to those that choose to "serve the greater good" by devoting themselves to science and medical research. It sounds now but sadly too many greedy bastards at the top would rather burn the forest down than share the trees which brings us to #3 which is what I think all the 3 letter agencies are ramping up for..

A fascist dictatorship where the elite rule with an iron boot using fear and violence where those at the top commit systematic genocide by forcing the "useless people" to live in ever worsening squalor, probably while claiming they are just "lazy" because they can't compete with the Asian slaves building our electronics. You would need the 3 letter agencies for several jobs in such a shift, to inspire fear and paranoia, to monitor and allow you to remove anybody that could possibly lead the peasants in an uprising, and to get enough dirt on those with weaker stomachs to insure they "get with the program".

Considering how much we have been seeing the mask fall off when it comes to those in power, how they just ignore any and all promises without fear of punishment and how many in power seem to get almost sadistic glee at the thought of stomping on the poor? Sadly I have a feeling its gonna be the third option. They'll use a major false flag to excuse "extraordinary measures" that will simply never end and get worse...war on terror anyone?

Re: Obama is but a puppet

[Anonymous Coward]

Show me any US president who was not a puppet since that speech Eisenhower gave as his farewell address. Either they are already men of the industrial military complex or they fall in line or they get assassinated.

https://www.youtube.com/watch?v=CWiIYW_fBfY, skip to around 6:50 mins.

Re: Obama is but a puppet

[Anonymous Coward]

If that's a consolation the brutality will last a couple of generations at maximum, which is the time needed to cull the 99.99% and eventually exterminate them, leaving the world as a garden of delight for the Ruling Elite. Machines have made us redundant and ultimately detrimental to the well-being and the safety of the Chosen Few, so the final solution is around the corner.

Re:Obama is but a puppet

[Ihlosi]

Its the day when everything from picking beans to paving roads can all be done by machines that never get paid, never ask for days off, its the corporate idea of heaven!I

Not really. At that point, money becomes pointless. Shortly thereafter, corporations (and highly-paid CxOs) become pointless.

You'd find within a year all the fast food workers replaced with an automated system that not only wouldn't get paid but would probably have a better track record than the underpaid overworked employees do know when it comes to getting orders correct.

You'd also find that since most people aren't employed and therefore have no money, your fast food joint would go out of business due to lack of customers.

The second option would be the "Star Trek Socialist paradise" which would be the most humane of the three,

Or something along the lines of "The Culture".

Re: Obama is but a puppet

[qbast]

I think you are overly optimistic. Even after you cull 'undesirables', remaining population will again divide into 1% rich and 99% everybody else, just with different baseline. It is like stack ranking in MS - no matter how many people get fired, there are *always* bottom 10% destined for next cut.

Re:Obama is but a puppet

[Anonymous Coward]

They just outlawed the warrant canary ...

Re:Obama is but a puppet

[WhatHump]

You are assuming that capitalism would survive and there would still be "rich" and "poor" people. At some point the economy will start to shrink because there are not enough people earning enough money to buy more than just essentials (e.g., cars, trips, consumer electronics). Once automation displaces enough workers, discretionary spending would plummet, taking with it any company that depends upon it. That would lead to more unemployment and even less discretionary spending, reducing corporate earnings and dividends/capital gains for the upper class. The economy craters, much like the Great Depression, throwing millions out on to the street, including members of the middle class whose taxes support the state. Where is the state going to find money to run these three letter agencies if no one is paying taxes? The rich? They would have abandoned the state long before that, forming their own feudal territories in an attempt to protect themselves from the roaming hoard of hungry and desperate peasants. I believe society will have to find some alternate approach to capitalism. I'm not sure what that is, but I do believe it is coming in our children's lifetime.

Re:Obama is but a puppet

[Wootery]

We do that now at fast food joints

Nope. McDonalds is for-profit. If their employees didn't earn their keep, they wouldn't be kept around.

if you raised the minimum wage to a living wage and quit letting the corps hand out "how to get government handout" videos to new employees? You'd find within a year all the fast food workers replaced with an automated system that not only wouldn't get paid but would probably have a better track record than the underpaid overworked employees do know when it comes to getting orders correct.

Nope. Firstly, McDonalds exists in all sorts of countries, including those with the highest minimum-wage rates in the world (Norway, the Netherlands, etc).

Secondly, if such automation is practical and within reach, why aren't they pursuing it already?

Re:Obama is but a puppet

[MTEK]

Puppet? That's better than dictator, I suppose. Or wherever you're from, "freedom fighter", if you prefer. People just need to realize that the U.S. gov't is huge and its relationships with organizations (domestic, multinational -- and not just the corporate types) has produced a web of complexity that is difficult to overcome and get anything meaningful done.

Re:Obama is but a puppet

[Anonymous Coward]

>Its NOT gonna be nice if the "Ayn Randiates" in the halls of power have their way.

I'm glad you put it in quotes, because based on what you wrote, you don't really have any clue about Ayn Rand. I'll leave it at the basics that you don't even understand her most read work is set upon the foundation that someone quit doing work because they weren't paid for it and encouraged others to do so as well. You're welcome to disagree with the philosophy, but come on, your entire post is about *not* working... ...the entire basis of the novel.

Re:Obama is but a puppet

[Somebody Is Using My]

If robots do all the work and leave everybody but the 1% out of a job who is going to buy all those things the robots are making? And if nobody buys the goods, how do the wealthy stay wealthy? And if the only people who can buy anything can pay millions of dollars, won't that pretty much insure that inflation raises prices to the point where the 1%'s billions are practically worthless?

You can't have a cornocopia economy /and/ have economic stratification.They work against one another.

Mind you, the transitionary periods between the two are a real bitch.

Re:Obama is but a puppet

[Dr_Barnowl]

Like many others have stated when confronted with this topic - I'd love to see them make a dramatization of the in-between years of Star Trek - the time between the present (or the near future), going through to the time of Zefram Cochrane and the subsequent ascent into the civilization that birthed Starfleet and the Federation.

Of course, the real "secret sauce" there is presumably that FTL travel means that previously scarce resources become much more readily available, as starships can visit locations where they are abundant and bring them back. This presumably ushers in an era of post-scarcity economics.

If you believe that these technologies can be achieved with mere Earthly resources, then perhaps we may even live to see it...

Re:Obama is but a puppet

[Sobrique]

Citizens wage as a social policy is gaining some traction. It seems counter intuitive, but just handing out money to everyone actually just works. There are very few people who are 'true scroungers' content to do nothing at all. Most of these are gaming the benefit system or taking to a life of crime as their 'profession' anyway. But if you give everyone the basic amount they need to live, you don't change much anyway. After all, that's sort of the point of tax brackets anyway.
Some people go and earn more, others do socially useful things like care for ailing relatives, or voluntary work.
And it still doesn't cost that much when you compare it to the overhead of a complex social security system.

Re:Obama is but a puppet

[Sobrique]

Actually, I'm just not sure the Culture could actually ever work - if you look at it, the culture is more like a benevolent dictatorship, run by the Minds. Humans are pretty much all irrelevant. At best pets in a zoo, given the illusion of freedom by permitting them to take on tasks drones would take care of anyway.

Re:Obama is but a puppet

[WrongMonkey]

The wealthy can sell stuff to each other. Take the wealthy 1% of the world: that's 70 million people right now. That's 210 million meals that need to be produced each day. That's 70 million luxury cars (or more) that can be built, sold and discarded each year. 70 million villas (or more) that need to be maintained. Etc. Etc. That's more than enough consumption to sustain an internal economy.

Re:Obama is but a puppet

[CauseBy]

Presidents aren't puppets insofar as they aren't preselected stooges.

My guess is that each President, on the day of his first PDB, physically shits his pants when he sees laid out in front of him the ugly facts of the security world. After getting new pants, the President starts rethinking his political positions.

I thought maybe Obama would be a little less prone to that than previous Presidents, but it turns out not. Watching it happen to Rand Paul would be the only good thing about electing him.

Re:Obama is but a puppet

[Anonymous Coward]

Secondly, if such automation is practical and within reach, why aren't they pursuing it already?

McDonalds demonstrated it was technically feasible roughly eleven years ago.

Others have since made a few improvements.

Re:Obama is but a puppet

[romons]

http://money.cnn.com/2014/05/2...

Re: Obama is but a puppet

[HornWumpus]

And just as the we will never win the 'war on poverty'. They will just redefine poverty, again.

Re:Obama is but a puppet

[spectrumlogic]

and this is what power really means...control of the transition.

Re:Obama is but a puppet

[Anonymous Coward]

I'd love to see them make a dramatization of the in-between years of Star Trek - the time between the present (or the near future), going through to the time of Zefram Cochrane and the subsequent ascent into the civilization that birthed Starfleet and the Federation.

There was a DS9 episode which provided a glimpse of this, though I don't recall it as being one of the better ones. I do remember that the premise was particularly weak.

- T

Re:Obama is but a puppet

[lucien86]

The Star Trek version does require a global nuclear war first, and then a hundred years of crawling back from the ruins. And then you get Khan. ...

Cook Is New NSA Bitch

[Anonymous Coward]

Cooks sucks a very big DICK. And the DICK is NSA.

Re:There is no

[Anonymous Coward]

You're basically right, IIRC - with the caveat that proper key management is used. Repeated use of the same key will render the messages vulnerable to brute force attacks. See the Venona project for an example.

Re:There is no

[Anonymous Coward]

biometry doesn't even work well for establishing identity.
You will need a guard who understands the biometry system inside and out, and then physically examine the person who is going to be identified (checking for replacement fingerprints, contact lenses, pouches with blood, plastic surgery).

Re:There is no

[Anonymous Coward]

OTP is actually the encryption used in quantum key exchange system. A shared random number is generated by the system, that share random number is used to encrypt the data using OTP.

In a QKE system the shared secret is generated much like how diffie-hellman generated a shared secret, except instead of using a mathematical problem it generates a string of random bits using a quantum process.

Re:There is no

[Anonymous Coward]

It would flip a coin in all the parallel universes, and in our universe it most likely lands on the correct side.

Impeccable IOS 8 Security

[ChadSmith4920]

But IOS 8 has advanced privacy features and not even Apple can access your device's data.

"Privacy" and "unbreakable" are different things

[joh]

Really. When the NSA is able to dissect an iPhone to read out the encryption key right from the chip or can brute-force their way in with huge efforts this is still useless for mass surveillance. You can expect to be able to buy a consumer product that is secure against this kind of effort about as much as you can expect to buy a consumer car that is secure against an attack with nukes.

But this does not mean that this kind of encryption doesn't help with guarding your privacy. Very much as a car not being secure against nukes does not mean it is "unsafe".

It's a fairly practical approach to make breaking the thing so expensive and bothersome that it will only be used with very good reasons just for reasons of time and cost. Making effortless mass-surveillance harder is a good thing.

There is one impossible

[aepervius]

Encryption is ALWAYS breakable by brute force.

 
If by brute force you mean a wrench , this is true. If by brute force you mean going over all possible key , this is false. One Time pad actually are not reversible by brute force, since essentially you do not know the key length , youa re going thru building by brute force *all* possible string of byte of a specific length which will contain all the text of the world of that length. OTP of unknown length are not breakable by force.

Re:There is no

[aaaaaaargh!]

Your reply is an excellent confirmation of his second point, though ...

Bullshit

[Anonymous Coward]

Does anyone actually believe that bullshit "Apple's recent decision to rework its latest encryption in a way that makes it almost impossible for the company to turn over data from most iPhones or iPads to police." is anything at all other than smoke and mirrors to keep selling devices while the government can secretly continue siphoning the data?

Joe Biden for 2016

[Anonymous Coward]

Joe Biden is a square shooter. Joe Biden for 2016

Have I missed something?

[nimid]

I've possibly not understood how a National Security Letter works but if the government can compel you to not tell anyone about the letter, can't it compel you to not indicate that you've received a letter too?

Some language like "You may not disclose or in any way indicate you've received this letter (including but not limited to altering/amending/removing any warranty canaries)"?

Is the feeling that this would be the line that the government wouldn't cross to protect national security or is the warranty canary simply unreliable?

Re:Have I missed something?

[Ihlosi]

Some language like "You may not disclose or in any way indicate you've received this letter (including but not limited to altering/amending/removing any warranty canaries)"?

A real warrant canary contains a date. You show that the canary is dead by not updating it at regular intervals.

Re:Have I missed something?

[nimid]

Then let's say language like this:

"You may not disclose or in any way indicate you've received this letter (including but not limited to maintaining the existing statuses of any warranty canaries)"

What I'm saying is that if it's legal and binding to compel a company or person not to reveal a security letter, I'm sure the language can be arranged to cover canaries too. I can't see a government body going "Yeah, you got us - there's no way for us to get round this loophole of yours".

Re:Naughty Obama wants to see you naked.

[Bob the Super Hamste]

if he wants to see tits, he has to pay

No he doesn't all he would have to do would be to go sit in on a session of congress.

Re:There is no

[Opportunist]

Ok, ok. But it's usually enough outside the world of 24.

Way to connect those dots...

[Brannon]

Apple removed a sentence from their quarterly filings and obviously this is a sign of imminent fascist genocide.

Smart people are some of the stupidest people I've ever met.

You don't understand security. At all.

[Brannon]

It has nothing to do with perfection at any level and never has in the history of mankind, ever.

Darth NSA

[mu51c10rd]

I have altered the agreement...pray I do not alter it further...

Schrodinger's Canary

[MondoGordo]

Is it dead or not ? is debatable ... https://www.techdirt.com/artic...

For something completely different or D'Oh!

[paulo.ortolan]

That seems to me this is when The Simpsons meets Monty Python's Dead Canary sketch! http://img1.wikia.nocookie.net...

Re:There is no

[Anonymous Coward]

Another reason why biometry is great to establish identity but poor for authentication.

You just confused authentication with authorization.

Re:Obama is but a puppet // A Little Reality

[lucien86]

I work in this field and there is something about these machines that you are missing. Firstly your human replacement robot worker is going to cost about $300,000 to build then maybe up to $40,000 to $50,000 per year in maintenance. How will humans compete with that? (Don't expect those prices to fall much with mass production either.)

In fact robots might not reduce the actual workforce that much because each will require the equivalent of roughly one permanent human worker to keep it running and that worker will need to be a highly trained engineer. People seem to have some kind of mental comparison that puts these machines as somehow equivalent to cars - in reality they are far more complicated - like say jet helicopters - or maybe spacecraft - they are actually probably more complicated than either.
These machines are immensely complicated, they have thousands of moving parts, tens of thousands of tiny wires and connectors and circuits, all packed into tiny difficult fiddly spaces. Even the software cores of these machine will require regular monitoring and maintenance - and this will be a complex, hyper specialised job.

The other special problem is that in 'normal' operation robot workers will constantly suffer wear and tear and frequent or near constant damage. Your human manual worker takes constant knocks and minor abuses to their body everyday in their job, these just heal. For every one the robot has to call out maintenance.

Actually the best real apps for Strong AI look like office work, large scale management, writing software, creative work, brain surgeons, monitoring CCTV systems, 'home' systems, autonomous cars. Its more likely to replace people like CEO's and executives than fast food workers or farmers or the guy carrying the mail. In certain kinds of maths and science work Strong AI's will really excel - especially things like DNA and genetic analysis and comprehension.
The main manual jobs AI's are actually likely to threaten are things like truck drivers, pilots, taxi drivers - and even in these jobs they will probably still need humans watching the machines.

interesting discrimination

[rewindustry]

this would appear to mean that apple users, up to now, have not been "interesting" to the U/NSA...

Nice copypasta!

[garote]

... But your "new singularity" has been tried and abandoned by most cultures. (It's more familiar name is "slavery")

was re: if we ever make a robot that's better at everything than humans, and then fail to recognize its civil rights, we will simply be repeating history. I can quote you some nice scifi books that workshop this premise if you like.

Re:Nice copypasta!

[hairyfeet]

Really? I thought we lived in America where slavery in all forms was alive and well, we just call them illegals. After al you can work them like dogs, give them unsafe work conditions the "freemen" won't touch, and if they get injured its even better than slavery because you aren't out the large investment of buying a slave, you can just kick 'em out in front of an ER and grab another off the street corner easy peasy.

Oh and thanks to the joke of a border according to my friends in law enforcement old fashioned slavery is alive and well too, they say you can buy a girl from the coyotes for as little as $5k in cash, $10k and they'll deliver.

Re:Nice copypasta!

[garote]

Um, okay. That does not appear to have anything to do with what I just said.