Got an FOI response almost three years late... a short thread
I got one on November 20, 2020, having forgotten all about it
More from Crime
My students @maxzks and Tushar Jois spent most of the summer going through every piece of public documentation, forensics report, and legal document we could find to figure out how police were “breaking phone encryption”. 1/
This was prompted by a claim from someone knowledgeable, who claimed that forensics companies no longer had the ability to break the Apple Secure Enclave Processor, which would make it very hard to crack the password of a locked, recent iPhone. 2/
We wrote an enormous report about what we found, which we’ll release after the holidays. The TL;DR is kind of depressing:
Authorities don’t need to break phone encryption in most cases, because modern phone encryption sort of sucks. 3/
I’ll focus on Apple here but Android is very similar. The top-level is that, to break encryption on an Apple phone you need to get the encryption keys. Since these are derived from the user’s passcode, you either need to guess that — or you need the user to have entered it. 4/
Guessing the password is hard on recent iPhones because there’s (at most) a 10-guess limit enforced by the Secure Enclave Processor (SEP). There’s good evidence that at one point in 2018 a company called GrayKey had a SEP exploit that did this for the X. See photo. 5/
ACLU is suing the FBI over its efforts to break into encrypted devices. https://t.co/TN8X0Slmnf
— Zack Whittaker (@zackwhittaker) December 22, 2020
This was prompted by a claim from someone knowledgeable, who claimed that forensics companies no longer had the ability to break the Apple Secure Enclave Processor, which would make it very hard to crack the password of a locked, recent iPhone. 2/
We wrote an enormous report about what we found, which we’ll release after the holidays. The TL;DR is kind of depressing:
Authorities don’t need to break phone encryption in most cases, because modern phone encryption sort of sucks. 3/
I’ll focus on Apple here but Android is very similar. The top-level is that, to break encryption on an Apple phone you need to get the encryption keys. Since these are derived from the user’s passcode, you either need to guess that — or you need the user to have entered it. 4/
Guessing the password is hard on recent iPhones because there’s (at most) a 10-guess limit enforced by the Secure Enclave Processor (SEP). There’s good evidence that at one point in 2018 a company called GrayKey had a SEP exploit that did this for the X. See photo. 5/
You May Also Like
To people who are under the impression that you can get rich quickly by working on an app, here are the stats for https://t.co/az8F12pf02
📈 ~12000 vistis
☑️ 109 transactions
💰 353€ profit (285 after tax)
I have spent 1.5 months on this app. You can make more $ in 2 days.
🤷♂️
I'm still happy that I launched a paid app bcs it involved extra work:
- backend for processing payments (+ permissions, webhooks, etc)
- integration with payment processor
- UI for license activation in Electron
- machine activation limit
- autoupdates
- mailgun emails
etc.
These things seemed super scary at first. I always thought it was way too much work and something would break. But I'm glad I persisted. So far the only problem I have is that mailgun is not delivering the license keys to certain domains like https://t.co/6Bqn0FUYXo etc. 👌
omg I just realized that me . com is an Apple domain, of course something wouldn't work with these dicks
📈 ~12000 vistis
☑️ 109 transactions
💰 353€ profit (285 after tax)
I have spent 1.5 months on this app. You can make more $ in 2 days.
🤷♂️
I'm still happy that I launched a paid app bcs it involved extra work:
- backend for processing payments (+ permissions, webhooks, etc)
- integration with payment processor
- UI for license activation in Electron
- machine activation limit
- autoupdates
- mailgun emails
etc.
These things seemed super scary at first. I always thought it was way too much work and something would break. But I'm glad I persisted. So far the only problem I have is that mailgun is not delivering the license keys to certain domains like https://t.co/6Bqn0FUYXo etc. 👌
omg I just realized that me . com is an Apple domain, of course something wouldn't work with these dicks
1/ Some initial thoughts on personal moats:
Like company moats, your personal moat should be a competitive advantage that is not only durable—it should also compound over time.
Characteristics of a personal moat below:
2/ Like a company moat, you want to build career capital while you sleep.
As Andrew Chen noted:
3/ You don’t want to build a competitive advantage that is fleeting or that will get commoditized
Things that might get commoditized over time (some longer than
4/ Before the arrival of recorded music, what used to be scarce was the actual music itself — required an in-person artist.
After recorded music, the music itself became abundant and what became scarce was curation, distribution, and self space.
5/ Similarly, in careers, what used to be (more) scarce were things like ideas, money, and exclusive relationships.
In the internet economy, what has become scarce are things like specific knowledge, rare & valuable skills, and great reputations.
Like company moats, your personal moat should be a competitive advantage that is not only durable—it should also compound over time.
Characteristics of a personal moat below:
I'm increasingly interested in the idea of "personal moats" in the context of careers.
— Erik Torenberg (@eriktorenberg) November 22, 2018
Moats should be:
- Hard to learn and hard to do (but perhaps easier for you)
- Skills that are rare and valuable
- Legible
- Compounding over time
- Unique to your own talents & interests https://t.co/bB3k1YcH5b
2/ Like a company moat, you want to build career capital while you sleep.
As Andrew Chen noted:
People talk about \u201cpassive income\u201d a lot but not about \u201cpassive social capital\u201d or \u201cpassive networking\u201d or \u201cpassive knowledge gaining\u201d but that\u2019s what you can architect if you have a thing and it grows over time without intensive constant effort to sustain it
— Andrew Chen (@andrewchen) November 22, 2018
3/ You don’t want to build a competitive advantage that is fleeting or that will get commoditized
Things that might get commoditized over time (some longer than
Things that look like moats but likely aren\u2019t or may fade:
— Erik Torenberg (@eriktorenberg) November 22, 2018
- Proprietary networks
- Being something other than one of the best at any tournament style-game
- Many "awards"
- Twitter followers or general reach without "respect"
- Anything that depends on information asymmetry https://t.co/abjxesVIh9
4/ Before the arrival of recorded music, what used to be scarce was the actual music itself — required an in-person artist.
After recorded music, the music itself became abundant and what became scarce was curation, distribution, and self space.
5/ Similarly, in careers, what used to be (more) scarce were things like ideas, money, and exclusive relationships.
In the internet economy, what has become scarce are things like specific knowledge, rare & valuable skills, and great reputations.