Timeline for Apple's open letter - they can't or won't backdoor iOS?
Current License: CC BY-SA 3.0
14 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 23, 2017 at 15:40 | history | edited | Matthew | CC BY-SA 3.0 |
Add link to announcement by a company claiming to be able to backdoor these devices.
|
| Feb 24, 2016 at 13:47 | vote | accept | TTT | ||
| Feb 18, 2016 at 7:50 | comment | added | Aleksandr Dubinsky | To clarify, the cracking rate with the brute-force-friendly ROM is 12.5 passwords/sec, which is actually rather great (for the user). However, the default 13- and 20-bit entropy passwords (4 and 6 digit PINs) become too weak (7 minutes and 11 hours to crack). 33 bits is a minimum (10 years). This corresponds to 10 random digits, 7 lowercase letters, 5 ASCII characters, or 3 words. | |
| Feb 17, 2016 at 22:28 | comment | added | Aleksandr Dubinsky | @DietrichEpp Dan Guido has corrected himself--The "Secure Enclave"'s time delay behavior can and has been re-programmed without erasing the key, and this can be used to brute-force newer iPhones. The takeaway, however, is that using a strong, brute-force-resistant alphanumeric password is believed to be a good defense. | |
| Feb 17, 2016 at 19:51 | comment | added | ave | @gnasher729 I wouldn't bother with getting a part of CPU to work elsewhere, but I'm sure that FBI has the manpower and knowledge required to do that. | |
| Feb 17, 2016 at 19:43 | comment | added | gnasher729 | @ardaozkal: Dumping the contents of the drive is no problem. But the encryption key is made from several parts, and one is built into the CPU. Without the CPU in the phone, your only choice is to brute force one 256 bit key per file on the device. | |
| Feb 17, 2016 at 17:58 | comment | added | Matthew | @ttt Very true, but it's a lot better than anything up to an hour between tries! | |
| Feb 17, 2016 at 17:57 | comment | added | TTT | @Matthew - the article suggest that even if Apple complied with the request, at 80ms per password attempt, brute force might still not succeed any time soon, depending on the strength of the password. | |
| Feb 17, 2016 at 17:21 | comment | added | TTT | @Matthew Thanks for the link. That's a fantastic article. | |
| Feb 17, 2016 at 15:40 | comment | added | ave | Don't underestimate NSA's servers :P Jokes aside, I'd guess that FBI tried this already, so much that they got desperate enough to publicly ask Apple to open a backdoor. | |
| Feb 17, 2016 at 15:33 | comment | added | Matthew | @ardaozkal Depends how the internal system works. It's not a distinct unit in the way that laptop hard drives are, but an integrated part of the main board. That means that it's entirely possible that the read and write methods pass through other parts of the device, which might include the encryption parts. In that case, you'd get a copy of the encrypted data, but still couldn't decrypt it - the passcode isn't the whole encryption key, merely one part of it. Brute forcing the whole drive would be virtually impossible. | |
| Feb 17, 2016 at 15:29 | comment | added | ave | Wouldn't apple/FBI/some random person with required hardware be able to dump the hard drive by manually connecting to it? I saw that being done for other devices with JTAG. | |
| Feb 17, 2016 at 15:26 | comment | added | Dietrich Epp | It's also been suggested that firmware updates to the separate hardware module would cause the existing keys to be erased. | |
| Feb 17, 2016 at 14:34 | history | answered | Matthew | CC BY-SA 3.0 |