Slashdot Mirror
FBI Telling Congress How It Hacked iPhone (theverge.com)
An anonymous reader quotes a report from The Verge: According to a new report in National Journal, the FBI has already briefed Senator Diane Feinstein (D-CA) on the methods used to break into the iPhone at the center of Apple's recent legal fight. Senator Richard Burr (R-NC) is also scheduled to be briefed on the topic in the days to come. [Feinstein and Burr are both working on a new bill to limit the use of encryption in consumer technology, expected to be made public in the weeks to come.] The disclosures come amid widespread calls for the attack to be made public, particularly from privacy and technology groups. However the FBI's new method works, the ability to unlock an iPhone without knowing its passcode represents a significant break in Apple's security measures, one Apple would surely like to protect against if it hasn't already. Just days after the FBI broke into the terrorist's iPhone, the FBI told law enforcement agencies it would assist them with unlocking phones and other electronic devices. We still do not know how the iPhone was hacked, nor do we know how many iPhones may be able to be unlocked from the hack. The FBI did tell USA Today the hack has not been used in any other case beyond San Bernardino.
The queen of "laws for thee, but not for me."
Guns? Why, those should be illegal! But I'm going to need some armed guards for myself, of course.
Encryption? Consumers can't be allowed to have that! Now how do I configure my secure Senate email account?
What a hypocritical cunt.
so we can't even talk about anything further.
who is going to tell us the honest truth? all we get is the dishonest truth from every 'official' that speaks up about this.
disinformation and even more disinformation. you'd be nuts to take anything on face value, given what's at stake.
--
"It is now safe to switch off your computer."
More alarming than the hack is the following bit in TFS:
The "hack", as I understand, was on an 5C, which is weak by comparison to the 5S and beyond. Non-event.
But the bit I quoted? Really? Limit what encryption consumers can have? I find that more alarming than "old-ass insecure phone got cracked."
I hope this dies a flaming painful death before it goes anywhere.
The "Civilized World" jumped the shark ca. 1973.
Diane Fienstein was born in the wrong country
She fits much more snugly in a fascist state
Muchas Gracias, Señor Edward Snowden !
or are we just believing the FBI said it was?
or wasn't there some law about circumventing security measures on a computer device?
Because Apple helps to fund the FBI, the FBI doesn't help to fund Apple.
What info did the FBI get off the phone? I think it's generally considered that time was a crucial element in getting any meaningful info from the phone, and perhaps days or hours after the event, anything in there would be useless.
I'm not sure anyone has yet to convince me that more encryption = more terrorism.
How many cat videos were found on the terrorist's iPhone?
That this episode of the FBI vs Apple has come to public attention proves that the FBI is grossly incompetent. When the public (and therefor terrorists) no longer believes that phone information is absolutely safe, other means of communication will be used: government loses a powerful tool against its enemies. This is a hideous strategic blunder.
Contribute to civilization: ari.aynrand.org/donate
"Feinstein and Burr are both working on a new bill to limit the use of encryption in consumer technology, expected to be made public in the weeks to come."
Not only is this extremely stupid and utterly unworkable, but fuck these two maggots who think that it's their right to weaken our privacy.
Just cruising through this digital world at 33 1/3 rpm...
Feinstein and Burr are both working on a new bill to limit the use of encryption in consumer technology, expected to be made public in the weeks to come.
When math is outlawed, only mathematicians and those who can read their papers will have math.
They'll get my math when they pry it out of my cold, dead cerebral cortex.
A large agency, such as the NSA, has the necessary resources to get into the phone that was behind all this noise. This is yet another attempt to use fear and misinformation to persuade Americans to sacrifice liberty in the name of 'security.'
Crypto and homebrew don't belong in the same sentence. Even the experts occasionally get it wrong and they have decades of design and implementation experience behind them. This one is best left to the pros, with audits of their work.
"If there was a gay Afro-Puertorican Linux distribution, I'd give it a try" ~lucm
For a very long time I ran Linux on everything- not just my desktops, laptops, laptops, and servers, but also my routers and everything else. Linux is so flexible that it runs 98% of all supercomputers, and also runs fine with 8 MB of RAM. For many purposes, there is a Linux distribution that's the right tool for the job.
In some cases, FreeBSD or OpenBSD is the right tool for the job. Firewalls are a great example, you want your firewall to be secure and reliable ; you don't care if it supports the latest graphics card well. FreeBSD is secure, reliable and very network-centric. There's a great user-friendly storage server system that happens to be BSD based.
For a corporate desktop, in an environment with Active Directory, ldap, etc, and little tolerance for downtime and "fiddling" wjth your computer to make it work, sometimes you still want a UNIX box rather than Windows. OS X fits that role nicely, in my opinion. Note OS X is a completely different beast than iOS. Nobody that I know uses the damn app store for OS X. It's simply a well built UNIX which will run all of your favorite FOSS software, reliably without fiddling with sysctl and X graphics drivers, while integrating pretty seamlessly into the Windows-centric corporate environment.
I could have said that more concisely as:
--
My last two employers needed me to use Outlook and Photoshop.
My personal workflow uses bash, perl, grep, awk, and make.
All of those required tools work great on my Mac, even after I've dropped it on the concrete.
---
Mac is full-fledged certified UNIX, and it's corporate helpdesk approved. Where else are you going find that combination ?
My MacBook Pro does run Linux, Windows, and FreeBSD virtual machines all the time too, though. I click whichever OS is suited to the moment. Last week, in 18 hours, we found thousands of vulnerabilities in 14 machines running those operating systems plus Cisco, so I know none are bulletproof, but I also know some are much more secure than others. (Out full vulnerability report for 14 targets was over 1600 pages long - for the exposures we found in 18 hours).
Do privacy concerns come before finding the bomb before it detonates?
Yes, they do...
If you don't have principles to stand on, then you stand for nothing and will fall, sooner or later.
As with most theoretical ethics problems, it only seems as if there is a conflict because the proposed scenario is too vague. This is why I find philosophy irritating sometimes, once you define enough details (as you would have in a real world scenario) you'll often find that the "right" thing to do is less ambiguous than it seems.
How do we know there is a nuke that is about to go off at all, if we don't know where it is? How did we locate the person who delivered the bomb in the first place? We were tracking them closely enough to know that they planted the bomb, but not closely enough to know where? How do we know that the location and the disarming codes are on the iPhone at all? What kind of guarantees do we have that if we do get into the iPhone we can stop the bomb going off in time anyway?
If we have a 100%, no bones about it, guarantee that gaining access to this one particular iPhone will prevent a nuke going off somewhere, then by all means, break into this particular iPhone. But you'll never have that kind of guarantee, so people will always argue that we need to be able to get into all the iPhones just in case.
This is always the problem with this kind of reasoning, it leads inexorably to mass surveillance: "We have to watch everybody because somebody, somewhere, at some time will do something dangerous, and this is the only way to stop them." How about: most people are good, so let them be free.
I'd rather die in a nuclear blast in a free country, than live a long life in a police state. The real fight is not to prevent deaths due to terrorism, the real fight is to prevent terrorists from changing who we are. They can only win that fight if we let them.
Only crack the nuts that crack. You don't put the ones that don't crack in the sack.
Most people are "cut you off in traffic" assholes, not "plant a nuclear bomb in downtown Manhattan" assholes. Most people are good in that they're not violent criminals, even if they are uncourteous (and Americans are not even close to being the most uncourteous people in the world).
If you want a vision of the future, imagine a youtube comments section scrolling - forever.
I'll more directly answer your post. You posed the question of whether concerns that the government can lean on big companies and thereby get access to your computer should override other benefits of using a particular operating system. "Is it really worth it?", you asked.
In my opinion, it IS worth that risk of government finding a way to access my employee email etc, particularly if they have the laptop in custody and a warrant, like the San Bernardino case, when the alternative is that -I- don't have proper access to my work email, calendar, etc. If the FBI seizes my employer's computers, they'll have 16 ways to read the email regardless of which OS I use on my laptop. It's stored on the Exchange server. The source code I write is in our git, cvs, and hg repos, unencrypted and ready for the FBI to seize. So trying to use a non-standard OS on my work laptop wouldn't even INCONVENIENCE the FBI, but it sure would inconvenience me and my co-workers. In this instance, there is nothing to be gained from trying to keep the FBI out of my laptop.
At my last employer, I also had three Macs. All of the information on a those computers was property of my employer, a government agency. Most of it was and is available, free, to the public. Does it make any sense to try to prevent the FBI from reading the course material for security courses that we provide free online? Are they going to use it to cheat on the test? Are we protecting the GPL source code of the online campus we used to deliver the training? They can get that at Moodle.org. If they want to specifically look at the code I wrote, they can look in the Moodle git repository, which is open to the public.
So for those jobs, the right tool for the job doesn't need to be FBI proof.
If I was going to pull a Snowden, obviously the requirements change. I might care about making certain data not readable by the feds. Even for my own personal laptop I prefer Linux.