[camillomiller]

> This makes no sense. Sure: someone can make their device less secure if they want. I absolutely support you doing that.

Well yeah, I guessed so. People in Cupertino probably think that's basically your mission :D (I don't, though). What I wanted to say is that building a security platform that completely locks you out of the device you're building is 1) Hard 2) full of political and legal implications. Even then, Apple is the only manufacturer with such a clear roadmap in that. Why are they the only one to be held so strongly accountable for building this king of security while Google Android phone can be snooped upon in an extremely easy way? When they're less secure by design?

That was my objection.

[saurik]

> People in Cupertino probably think that's basically your mission :D (I don't, though).

Good, because anyone who thinks that even casually is either completely uninformed or an idiot :/. (I vaguely apologize for the bluntness, but this is an insinuated attack even with the statement that you don't believe it, at which point one would question why you brought it up in the first place.)

> Why are they the only one to be held so strongly accountable for building this king of security while Google Android phone can be snooped upon in an extremely easy way?

You clearly have never been to one of my talks; I outright told an entire audience of people at DragonCon, most of whom used Android devices, that they should not use an Android device if they even remotely cared about security, and sat there and took it as they boo'd me: I am extremely vocal about the flaws in Android devices.

Only today, we are talking about Apple. And today, Apple is being disingenuous: they are making it sound like it would be some herculean effort to build some massive crowbar to defeat their otherwise impenetrable device, when in fact what the FBI wants can be accomplished by Apple in a matter of hours, and that the underlying security of this device comes down to something Apple would rather people believe is a good thing--that they have more access to the hardware you own than you do--than ever even momentarily consider to be a flaw.

[camillomiller]

I'm a non-native speaker Jay, don't imply insinuations, because I'm usually not so subtle with my language. That was just a bad joke.

Believe me, I do think your work is phenomenal. Period. I'm sorry I've never been to one of your talks. If you'll ever do one in Berlin in the future I won't certainly miss it. :)

That said, I understand your point but I don't really agree. You're saying Apple is doing all this while basically lying for what? Sheer publicity? Do they really think that this kind of unusual marketing would be good for them?

It's the implications (legal, not technical ones) that are at stake here. Three hours of Apple engineers' time spent working for the government, by the way, would already account as an unreasonable burden, in my book. Especially after they already complied with the FBI requests just to find out they messed up the iCloud password...

Is iOS much more secure that any other mobile platform? Isn't Apple saying just that? And don't you believe it's true? Apparently yes, you do! They do are working towards what you advocate for here (making the users' data completely unaccessible to them). Just look at the evolution of security from iOS 7 to iOS 9. We're still not there, yet. Maybe that's what's brewing for iOS 10, who knows...

By the way, since we're here and you're clearly the best person to ask... I'm curious about how Apple stores and keeps their private signing key for iOS secure. How do they do that? Has anybody ever tried to steal that? That's something nobody's talking about, but I'm really curious about the physical implications of keeping something like that safe.

[pfg]

I would imagine the firmware signing key is stored on a Hardware Security Module (HSM). Devices like that are tamper resistant (for example, they might be configured to delete the key if someone is messing with the device).

HSMs generally support signing operations, so it's likely the key doesn't leave the device at all. They might be using a configuration with shared secrets (smart card + PIN, etc.) where at least n shares need to be present to operate the HSM. Those secrets are probably held by a small number of high-level Apple employees.

It's probably similar to the DNSSEC Root Signing Ceremony[1]. Well, hopefully slightly less insane.

[1]: https://www.cloudflare.com/dnssec/root-signing-ceremony/

[camillomiller]

@saurik:

https://news.ycombinator.com/item?id=11171131

:)