tenly

cnocbui said:

tenly said:

I started off being 100% behind Apple
on this issue, but the longer this conversation goes on, the more clearly I'm able to see both sides.

But - if we resign ourselves to the fact that the government can and will legislate a requirement to provide some type of assistance - what kind of system could they create that would protect individuals from hackers and foreign governments while still complying with a legal requirement to help law enforcement agencies?

The issues about whether the government has the "right" to do this or not and the preservation of the constitutional rights is one for the courts.  I'm glad that Apple is standing up for our rights, but there is only so much that they, as a corporation can and should do.  If actual laws are passed - Apple will be forced to comply with those laws.  Let's hope that  they find a way to do so that continues to protect our rights and ensures that our data remains secure.

If Apple are compelled to do this, have you considered that if they believe security to be a big selling point that they may decide to remove their own technical ability to comply with such orders in the future and either come up with an A series chip where the OS can't compromise it's security or move their iOS development entirely off-shore, possibly into the hands of an autonomous self entity?

Isn't that what they've already tried to do?  I'm not by any means saying that I agree with the government or that I think they have the right to demand these things.  I'm trying to keep the conversation/debate grounded in reality.

If the US Government is successful in passing legislation that requires this - companies that refuse to comply will not be allowed to sell their products in the USA - so Apple could develop the device you describe - but they wouldn't be allowed to sell it in the US.  Depending how aggressive the govt wanted to be - they could take it one step further and make it illegal to even USE a non-compliant device within the US (by making it illegal for the mobile phone companies to provide service to specific devices).

I'm glad to see Apple challenging the governments rights and attempting to protect our privacy and security - but it's not reasonable to expect them to openly defy the law.  If the government creates a law - Apple may challenge the law and appeal it all the way to the Supreme Court - but if they are not successful in having the law declared unconstitutional - they will have 2 choices - either comply with the law - or exit the US.  As a corporation, we can not expect them to openly defy the law - they've already done more than most other companies would do.

If the government declares it legal to search someone's cellphone and the Supreme Court upholds the law against a constitutional challenge - what more can be done about it?

i would think that the initial version of the law might contain language in it that prevents the technology from ever being used against an American citizen - in order to help get it passed initially and force Apple to create the mechanism - but as we all know - once the procedure exists, it will be misused - and law enforcement will keep going back asking for "exceptions".

Perhaps I'm too cynical - but I don't think there's any way to stop this from happening.  The best we can do is slow it down.

This is EXACTLY what I tried to explain to people - repeatedly!  But they were so willing to assume the worst about Apple - or so ignorant about the "proper" security response I was also flamed repeatedly.

All along, *this* was the only thing that made sense.

If Apple detects this vulnerability, they should shut down the computer and force the user to buy a new one!  Anything short of that is a security risk!!!  They could display something on the screen which clearly communicates the issue and the options a user has available to them - something clear and concise - like "Error 54" maybe...

/s

nolamacguy said:

kmarei said:

I wish one of the phone manufacturers would release a phone with a huge battery
imagine an iphone 6s but double the thickness, and triple the battery life
i am quite sure that thing will fly off the shelves
not everyone wants a super sexy, super slim phone
some of us want to be able to use our smart phone for its intended purpose, all day, without having to switch off bluetooth and wifi and dim the screen etc

that the market hasn't produced such a device seems to contradict your claims that it would be a top seller. Id wager they have sales data to show that people lean toward slimmer phones.

its not a problem for me tho -- i already get all-day battery life on all of my iPhones, and i never turn off BT. i keep the brightness below half and set the auto-dimmer to on.

You can't quote market data as proof that nobody wants a phone with a larger battery when such a product has never been available.

From an engineering perspective, it would be extremely easy to produce a high-capacity version of the flagship device - almost as easy as simply inserting a slab a few mm thick which is filled with battery.  

I know why they do thin - and I agree that they need to do thin - but I don't think that they need to do thin EXCLUSIVELY.  The market for a top of the line iPhone with 2-3 days battery life - at a premium price tag and increased thickness - is easily big enough to be profitable and take a chunk of $ out of the external battery pack and power case market.  I don't think that such a model would outsell the thin model, but I do think that the proponents of thin would be very surprised by how well such a product did actually sell!  

External battery packs and power cases do not provide solutions to those of us that want more power - they provide an ugly workaround at best.

Here's hoping that Apple finally listens to us and gives us a choice rather than making that choice for us.

As for the camera bump, it's actually a "feature" for those of us that use cases.  Prior to the bump, many cases would cause issues with the flush mounted camera by affecting the focus or shadowing the images in certain ways.  I had several friends who thought their phone had a defective or low-quality camera because the pictures it took looked horrible.  I told them to take the phone out of their case and try again and they were amazed by the quality difference.  With the bump, the camera lens is clash mounted when the phone is in a case, instead of being recessed and that's a big benefit to those that use a case.  I understand that it's a nuisance to those that don't use a case.  Does anyone know what the stats are regarding case usage?  What % of users use the iPhone without a case?

ericthehalfbee said:

tenly said:

I lied.  I will continue to reply - only to make sure that people aren't left with your misguided and incorrect information.

Again - you are trying to confuse the issue and the conversation by making some weak vehicular analogy.  I'm not going to dispute anything you said about BMW or how their system works - but I will point out that it's a silly comparison to make.  The system you are describing is designed to prevent theft.  The iPhone security system we are discussing is designed to protect your data.  That's a huge difference - and at least now I know why you're thoughts are so far from accurate - you're speaking about what you know - which is vehicle theft protection.  Your mistake is in assuming that the security required to protect data is (or should be) similar.  It's not - and you clearly have no experience or knowledge about those types of systems!

If you want to pull out credentials, sure - let's play!  I have a Masters in Computer Science and have worked as a consultant in the IT industry for more than 20 years including 6 years of architecting, engineering and implementing secure systems.  Sorry, I've never worked on automotive security systems.

So - rather than comparing cars to smartphones, why don't you look at the exact items in question and then point out to all of us exactly where and how the phone with the uninitialized Touch ID sensor is more vulnerable to unauthorized data access or unauthorized use than the system which has Touch ID disabled via the settings app.  And remember, we want to compare Apples to Apples here - so for the devices we're going to compare - the ONLY difference between the 2 devices should be that one has all of the original parts and the other has an aftermarket Touch ID sensor that is not able to communicate with the secure enclave.

My assertion is that if Apple (iOS) detects that the Touch ID sensor cannot communicate with the secure enclave, the "Use Touch ID" setting should be turned off and grayed out - and the phone should operate as if it had never been activated in the first place.

Your claim is that by doing so, some portion of the users data would potentially be exposed and the only "secure" thing to do is to temporarily brick the phone - yet you offer no explanation as to how this could possibly happen.

By now, I'm sure you can see where you went wrong.  Whether you misunderstood the proposed alternative to bricking, whether you honestly believed that "securing a vehicle from theft" and "securing access to private data on a computing device" were the same thing and should be treated the same way - or whether you are just an Apple apologist and blindly defend Apple and assume that if they do something a particular way, it's the best way (or the only way)...

Anyhow - no matter why you initially disputed the assertion, I'm certain that you now see that you were wrong.  I'm also equally certain that you'll never admit it.  You've slung too many names and insults to back down and apologize at this point.  I'm quite sure that you will go to your grave still claiming to be right - even if Apple releases an update that makes the system work EXACTLY as I've described - which I see as a *very* likely possibility...!

Playing the "argument from authority" card are we? Funny that someone with a masters in comp sci is unable to explain how security in iOS works and uses vague terms while expecting us to just believe what you say. I'm still WAITING for any technical explanation from you why Apple should go ahead and allow the iPhone to work when a critical security component has been compromised. Why are you afraid to do so? Why do you continue to speak in vague terms? Go on, explain it to me like I also have my Masters (instead of assuming I'm nothing more than a Best Buy alarm installer). Don't worry, I'm pretty sure I can understand all the big words you decide to use. 

My BMW analogy is correct. Why? Because when BMW detects tampering with a hardware component in the vehicle they operate under the assumption the vehicle is either stolen, or that someone is trying to "assemble" a working vehicle using parts from several stolen or suspect vehicles.

While this occasionally causes problems for customers (if a related module malfunctions the car still "bricks" and requires a visit to the dealer), the benefits for the majority of users outweigh the inconvenience for a few.

Apple is doing the exact same thing here. A key component in the security of the iPhone has been tampered with and Apple is playing it safe by assuming it's an attempt at gaining access to a customers device.

Sigh.  Here we go again.  I'm starting to lose interest in this discussion because I think most people already understand my point - and you either already do as well - or never will.  Are you going to apologize in a week or two if/when Apple makes it clear that their intention all along was for it to work the way I described?  Or will you claim at that point that *they* are now wrong also?

There is absolutely no need to use bigger words or more complex descriptions of the security systems in this discussion.  Doing so is not necessary to explain how things should work.  You can't even seem to grasp the simple explanation -  so why would I add detail and complexity when it's not necessary.  It would just add confusion, make it harder for you to understand and it would exclude a lot of readers from following the conversation.  If it was necessary to convey my point, I'd use the minimum required - but it's not so it's actually kind a of a dumb request.

Here's where your argument goes off the tracks:  "why should apple go ahead and allow the iPhone to work when a critical security component has been compromised?" - They shouldn't!  But the fingerprint sensor is NOT "a critical security component" in my analogy!  It's ONLY a critical component when it is being used to validate and grant access to the device!  If you disable that function, it is no longer "a CRITICAL security component".  How can you not understand that?  

Every device that can be unlocked with Touch ID can also be unlocked with a password.  Even if Touch ID is enabled, you can ignore it and log in with just your password.  How is it "a critical component" if you can disable the feature, or you can enable it but choose to ignore it and not use it?

Forget about everything else - because the whole discussion centers around this one thing.  If Apple disables Touch ID because a sensor was not installed properly, but leaves everything else active....WHERE IS THE NEW VULNERABILITY???  Where?  Tell me where?

There isn't one.

The only argument you have is that the new Touch ID sensor being installed *could* represent an intrusion attempt.  Somebody might be trying to hack into your phone.  So what?  The same could be said about a failed fingerprint read - or a failed password entry - or connecting an unrecognized lightning device or adapter - yet none of those other actions will trigger the phone to go into lockdown mode.

So let's say that it IS definitely a hack attempt - if the hacker messes with the fingerprint sensor - tell us why disabling Touch ID is not a sufficient response.  Why does the phone have to go into lockdown mode?  Why doesn't it allow me, as the owner to specify the action that I want to happen on a Touch ID intrusion attempt?  It does for the password.  I can say wipe all my personal data after 10 failed attempts.  Why do I get a choice for bad passwords, yet for a touch if intrusion attempt, the only thing "safe" is turning it into a brick?

LOL!  Okay.  Forget the apology.  Keep your pride.  You can acknowledge that you finally understand simply by NOT replying to this message.  I promise I won't call you out on it....but seriously.... After I've explained it so many times, and so clearly (the house analogy works!)....How can you still NOT get it???  In other topics you post in, you don't come across as stupid - so it must be a pride thing on this one.  Nothing else explains why you still pretend not to get it.

Here's hoping that I don't see a reply to this message!