William D. Cohan for Fast Company:
The district attorney of Manhattan, Cyrus Vance Jr., and the city’s cybercrime unit have built this electronic prison for a very specific purpose: to try, using brute force algorithms, to extract the data on the phones before their owners try to wipe the contents remotely…
Welcome to ground zero in the encryption battle between state and federal law enforcement officials on one side, and trillion-dollar tech giants Apple and Google on the other. About five years ago, with the introduction of its iOS8 operating system, Apple decided to encrypt all of its mobile devices—protecting both consumers and criminals from prying eyes…
All of the phones are hooked up to two powerful computers that generate random numbers in an attempt to guess the passcode that locked each device… “All of these phones are in various states of being attacked,” explains Steven Moran, the director of the High Technology Analysis Unit. He shows me one phone where 10,000 random sequences have been tried. That would have been enough to crack a four-digit key, which has 10,000 possible combinations. But beginning in 2015, Apple began requiring a six-digit passcode—boosting the total permutations to 1 million.
MacDailyNews Take: This brute force method is precisely why those concerned with security don’t use four-digit passcodes. Instead, use long, alphanumeric passwords and, even if there is a GrayKey box on every corner, your data will remain secure.
Use at least seven characters – even longer is better – and mix numbers, letters, and symbols.
To change your password in iOS:
Settings > Face ID & Passcodes > Change Passcode > Passcode Options: Custom Alphanumeric Code
Guide to iOS estimated passcode cracking times (assumes random decimal passcode + an exploit that breaks SEP throttling):
4 digits: ~13min worst (~6.5avg)
6 digits: ~22.2hrs worst (~11.1avg)
8 digits: ~92.5days worst (~46avg)
10 digits: ~9259days worst (~4629avg)— Matthew Green (@matthew_d_green) April 16, 2018
Apple argues that it is protecting our privacy by ensuring that no one—not even Apple—can gain access to our most intimate personal data. Vance is skeptical that Apple doesn’t have a secret backdoor. “They get into my phone all the time because they upgrade my operating systems and they send me messages,” he says.
MacDailyNews Take: Idiot.
The problem is that criminals also use Apple and Android phones, and the data hidden inside them — GPS coordinates, text conversations, transcripts of voicemails — are often essential for prosecuting them.
MacDailyNews Take: Oh, really? And what did you do before 2007? Or rather the guy who preceded you?
Oh, we know, he did actual police work – instead of lazily wiping his ass with the U.S. Constitution and complaining that it’s too rough.
At the core of the issue is the U.S. Constitution:
AMENDMENT V
No person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a Grand Jury, except in cases arising in the land or naval forces, or in the Militia, when in actual service in time of War or public danger; nor shall any person be subject for the same offence to be twice put in jeopardy of life or limb; nor shall be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation.
Those who would give up essential liberty to purchase a little temporary safety deserve neither liberty nor safety. – Benjamin Franklin, Historical Review of Pennsylvania, 1759
This is not about this phone. This is about the future. And so I do see it as a precedent that should not be done in this country or in any country. This is about civil liberties and is about people’s abilities to protect themselves. If we take encryption away… the only people that would be affected are the good people, not the bad people. Apple doesn’t own encryption. Encryption is readily available in every country in the world, as a matter of fact, the U.S. government sponsors and funds encryption in many cases. And so, if we limit it in some way, the people that we’ll hurt are the good people, not the bad people; they will find it anyway. — Apple CEO Tim Cook, February 2016
Ultimately… the U.S. Supreme Court will likely have to weigh in on this issue. — MacDailyNews, May 4, 2017
Yes, Vance is an idiot. But so is anybody who thinks that police and prosecutors can properly catch and convict criminals when the criminals can hide all the evidence. How did the New York County DA obtain convictions before 2007? By conducting lawful searches that produced readable documentary evidence, obviously. Unless the criminal is stupid, all that evidence is encrypted now. People have died, and will die, as a result of that.
Now I happen to think that the high price is worth paying to avoid the alternative of making every electronic record or communication an open public record, but only an idiot fails to see the costs as well as the benefits of secure encryption.
I realize that most of you have never had to tell a crime victim that their perpetrator is going to get away with it because there isn’t sufficient admissible evidence to convict them. Every prosecutor has had that experience and it makes us furious. So do dumbasses who tell us that we should just try harder… while they vote to cut law enforcement budgets and tell us we are only concerned with encryption because we are jackbooted thugs.
Perhaps if your copy of the Fourth Amendment weren’t smeared with excrement, you could read the part that allows reasonable searches and seizures, including searches conducted pursuant to a lawful warrant. It is intentional obfuscation to rail on about illegal searches when the topic is searches of encrypted devices being conducted after following all the proper procedures and obtaining a judicial warrant.
Actually, the fourth amendment states, in part, “secure from unreasonable searches and seizures”. That is not the same as allowing reasonable searches and seizures. As you likely know there are legaln nuances in the differences between allowing reasonable and being secure from unreasonable.
Additionally, this ties into the fifth amendment, which states in part, “nor shall be compelled in any criminal case to be a witness against himself”.
Where do you draw the line between information that may be in some gray area between the the fourth and the fifth? That discussion is not so simple.
If gray areas exist, this isn’t one of them. Once a person has voluntarily committed their thoughts to an external medium, whether a written diary or an iPhone, there is no longer a question of compelling them to testify. The words, numbers, images or whatever already exist without compulsion. Whether that evidence can be seized or used in court is governed by the Fourth Amendment, not the Fifth.
It’s a waste of time and money if De Blasio just releases all the criminals on the same day.
“Oh, really? And what did you do before 2007? Or rather the guy who preceded you?
Oh, we know, he did actual police work – instead of lazily wiping his ass with the U.S. Constitution and complaining that it’s too rough.”
a) They would confiscate laptops, desktops, PDAs, and subpoena your phone records. They may even tap your phone or bug your house.
b) TxUser is 1000% correct.
Nice to see that the police state apparatus gives tacit endorsement to the iPhone’ top security capability, not to Android whose owners might as well drop their drawers or panties and walk exposed into the mddle of the street because, you know, they have nothing to hide.”Come right in. Thank you for your attention.”
I am going to repeat what I wrote on an earlier article about the hardware limitations Apple has built into modern iOS devices that limit the speed of Greykey and Cellebrite unlocking devices.
The Matthew Green chart from April 2018 is based on the premise that one can simply feed random numbers from a computer at a rate of 12 per second to an iPhone/iPad and have the device use those numbers to make attempts to unlock the device. This rate is what results in the time chart Green Tweeted in April 2018. Real world users of GreyKey and Cellebrite devices report that a 4 digit passcode crack averages around 2 hours, not the theoretical 6.5 minutes Green postulated, and a worst case of almost 3 hours 35 minutes to run all 10,000 possible numbers on newer iPhones/iPads. How can that be.
The answer is that even though GreyKey and Cellebrite had found a way to disable the trial attempt lockout in iOS, Apple was not deterred. On new devices they added a hardware delay of approximately 1.3 seconds inside the processor between attempts that would not be noticed by humans entering unlocking passcode attempts through the devices touch screen, but cannot be bypassed by a computer through the Lightning Port. It is, after all, intended to be a limited human interface, not a computer interface.
10,000 X 1.3 seconds per try = 13,000 seconds / 3,600 per hour = 3.6 hours for all ten thousand possible codes or about half that for an average 4 digit solve.
That comports with what the people using the cracking devices are actually experiencing in the real world, i.e. about two hours with newer iPhones/iPads. A 6 digit passcode which has 1 million possible numeric passcodes would require about 15 days to run all possible passcodes, not Green’s 22 hours, about half that for an average.
Amazingly, a mere six alphanumeric plus symbols passcode using upper and lowercase characters plus 30 symbols, from a limited set of just 90, of the over 223 characters actually available from the virtual keyboard available on an iPhone/iPad, extends the solve time to 21,900 years to try all 531,441,000,000 possible passcodes. To get through half of the possible codes would take 10,950 years for the average solve. It’s likely the data on the device would be moot by then.
Even were we to allow Green his 12 tries per second theoretical maximum, using a computer to feed the attempts, the alphanumeric plus symbols passcodes with 6 characters would require 1,404 years to accomplish trying all possible passcodes, and 702 years for the average solve. Even Inspector Javert would have lost all but academic interest by then.
Though a brute force method may in the end result in unlocking a device in the ‘worst’ case, a reasonably proficient cracker would attempt the ‘obviously bad’ guesses at the end (e.g. all digits being the same, or in close increasing/decreasing sequences) and start with the probable ‘good’ guesses (e.g. possible date sequences). Putting some thought into the psychology of users would on average greatly shorten the time required to find the ‘right’ digital passcode.