Re: The morality of operating system security

From	Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm>
Newsgroups	alt.os.development
Subject	Re: The morality of operating system security
Date	2016-03-29 17:39 -0400
Organization	Aioe.org NNTP Server
Message-ID	<20160329173929.65060450@_> (permalink)
References	<nde25k$bkn$1@dont-email.me>

Show all headers | View raw

On Tue, 29 Mar 2016 15:09:35 +0100
James Harris <james.harris.1@gmail.com> wrote:

> Recently the US government wanted to extract data from an Apple phone 
> that had belonged to a terrorist because that information might help
> the government prevent further terrorist attacks.
> 
> Apple did not want to produce any software or system that could do
> this because they wanted to sell phones which were known to keep
> users' data private from anyone and everyone.

Yes, even though bypassing the password lockout was
probably only a two to three byte memory/code patch
to a branch, or the equivalent of a NOP on a memory
load instruction for the variable with the lockout
count, or a change to a hard coded lockout value.
I seriously doubt that this required any serious
coding to modify.  No encryption or complex processes
is involved with this aspect.

> AIUI some bright spark had an idea of how to break Apple's security
> and took it to the US security people. And that person was proven
> right. As a result, the US security services have got access to the
> data on that phone.

U.S. media here are saying that the rumors are it was
an Israeli forensic data recovery firm known as Cellebrite.
Supposedly, they copied out the contents of the NAND
flash memory chips, much like copying a hard drive or
floppy disk or the contents of an EEPROM.  AIR, the phones
also had some type of chip with a unique serial number
or encryption key which was speculated would pose a problem.

> Consequentially, Apple have been somewhat embarrassed that their 
> security has been broken.

I don't know if they're embarrassed, yet.  Apple got what
they wanted, not to be forced to do something by the courts
and FBI.  Apple didn't have to spend any money on the FBI's
demands.  The FBI had to pay a company to solve their problem.
If Apple was forced by warrant or court order to comply, the
FBI would have got what they wanted for free and maybe the
FBI would've set a new legal precedent too.

If the technique used required hardware modification, i.e.,
un-soldering the memory chips to copy their contents, then
this is a side-channel attack, which means it didn't attack
the encryption itself.  So, the software/hardware encryption
may still be secure.  It's just that the phone isn't.  At the
moment, Apple is suing to find out what technique was used.
I don't see them as having any legal standing to find out.

> They will almost certainly change their phone security now to
> try to make future phones unbreakable. This will lead to the
> same moral issues again.

As I said once before, criminals and terrorists use whatever
is available.  If you make everything 100% private, they'll
use that privacy to hide their crimes.  If you make everything
100% open, they'll use that openness to find more victims.
Compare the openness of entry used by terrorists in the Brussels
attack versus the issue of privacy used by terrorists with
Apple's phones.  That's a complete dichotomy.  Society can't
have things both ways.  They can't have both privacy and total
safety.  Society must make a tough choice as to which one is
more beneficial over the long-term.  Privacy has the benefit
of preventing people from becoming victims in the first place.
Governments want openness, so that you can't hide from taxation.

> So, what are your views on this kind of issue with
> operating system security?

Personally, I know that any backdoor will be used by
both governments and criminals.  It may take criminals
a bit longer to discover backdoors than the governments,
but they eventually find out about anything that the
government knows about. I also know that governments
don't always have their citizen's best interest at heart
and shouldn't be trusted.  But, they are more beneficial
than the criminals and terrorists. I happen to not like
giving up freedoms in the name of safety or security.
I would rather accept the rare risk, than give up my freedom.
IMO, most willingly gave up their freedom in exchange for
perceived safety from rather rare events.

> Where is the line to be drawn between users' privacy
> and people's safety? Any thoughts?

The U.S. is founded upon the idea that the rights of the
majority must defer to the rights of the individual.  We
call it "freedom" and "individualism."  If the majority doesn't
defer, then you have suppression and oppression.  However,
given recent terrorist events and a large increase in school
attacks, the latter of which have plagued America from the
start, much of America has come to accept some limits on their
modern freedoms, albeit begrudgingly and reticently.  Most of
them were trivial, but some are harsh, unnecessary, and were
forced upon the people by the U.S. government, e.g., TSA.
Many who accepted this were convinced by others that this
state of affairs was a temporary arrangement, and are still
angry over the fact that it seems that it was not temporary,
but permanent change.  Many, many Americans want their lost
or forfeited rights back.  America is experiencing a conundrum
of sorts.  Certain rights are shifting toward the group while
others that were historically in favor of the group are
shifting towards individuals.

Rod Pemberton

Thread

The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-03-29 15:09 +0100
  Re: The morality of operating system security JJ <jj4public@vfemail.net> - 2016-03-30 00:03 +0700
    Re: The morality of operating system security "wolfgang kern" <nowhere@never.at> - 2016-03-29 19:39 +0200
    Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-03-30 23:54 +0100
      Re: The morality of operating system security JJ <jj4public@vfemail.net> - 2016-03-31 06:16 +0700
  Re: The morality of operating system security "wolfgang kern" <nowhere@never.at> - 2016-03-29 20:01 +0200
    Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-03-30 23:59 +0100
      Re: The morality of operating system security Bernhard Schornak <schornak@web.de> - 2016-03-31 17:47 +0200
        Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-01 08:11 +0100
          Re: The morality of operating system security Bernhard Schornak <schornak@web.de> - 2016-04-01 18:25 +0200
            Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-01 23:10 +0100
              Re: The morality of operating system security Bernhard Schornak <schornak@web.de> - 2016-04-02 14:18 +0200
      Re: The morality of operating system security "wolfgang kern" <nowhere@never.at> - 2016-04-01 09:58 +0200
        Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-01 10:06 +0100
  Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-03-29 17:39 -0400
    Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-03-31 00:13 +0100
      Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-03-30 23:18 -0400
        Re: The morality of operating system security "Alexei A. Frounze" <alexfrunews@gmail.com> - 2016-03-31 00:31 -0700
          Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-03-31 16:57 -0400
        Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-01 09:22 +0100
          Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-04-01 20:24 -0400
            Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-09 18:25 +0100
              Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-04-09 18:57 -0400
                Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-26 09:07 +0100
                Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-04-26 23:58 -0400
                Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-27 07:01 +0100
                Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-04-27 05:42 -0400
                Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-05-03 00:05 +0100
                Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-05-03 16:55 -0400
                Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-05-04 09:00 +0100
                Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-05-04 17:22 -0400
                Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-05-05 17:02 +0100
                Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-05-05 17:55 -0400
                Re: The morality of operating system security "Kerr Mudd-John" <admin@127.0.0.1> - 2016-05-09 14:58 +0100
                Re: The morality of operating system security Rod Pemberton <NoHaveNotOne@bcczxcfre.cmm> - 2016-05-12 17:46 -0400
                Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-05-15 00:11 +0100
                Re: The morality of operating system security James Harris <james.harris.1@gmail.com> - 2016-04-27 07:44 +0100

csiph-web