Charlie Stross:
Here’s my theory: Apple see their long term future as including a global secure payments infrastructure that takes over the role of Visa and Mastercard’s networks—and ultimately of spawning a retail banking subsidiary to provide financial services directly, backed by some of their cash stockpile.
The FBI thought they were asking for a way to unlock a mobile phone, because the FBI is myopically focussed on past criminal investigations, not the future of the technology industry, and the FBI did not understand that they were actually asking for a way to tracelessly unlock and mess with every ATM and credit card on the planet circa 2030 (if not via Apple, then via the other phone OSs, once the festering security fleapit that is Android wakes up and smells the money).
If the FBI get what they want, then the back door will be installed and the next-generation payments infrastructure will be just as prone to fraud as the last-generation card infrastructure, with its card skimmers and identity theft.
And this is why Tim Cook is willing to go to the mattresses with the US department of justice over iOS security: if nobody trusts their iPhone, nobody will be willing to trust the next-generation Apple Bank, and Apple is going to lose their best option for securing their cash pile as it climbs towards the stratosphere.
This whole thing was a fascinating read.
I disagree with his assessment of Tim Cook’s motives (Cook has just done too many positive things that were unrelated to or, at the very least, not directly motivated by Apple’s cash position), but I do agree that the risk of a back door goes far beyond your email credentials. The more iOS and Apple Pay become part of the world’s payment and credit card infrastructure, the more vital a backdoor-less encryption model becomes.
If I understand correctly, the Apple Pay encryption uses a dedicated chip, so no backdoor that accesses the phone’s data will be able to access that chip.
Also, I’m pretty sure they have server-side access to every purchase made with credit and debit cards. So they can get your location without needing to get into your phone.
Sounds like clickbait to me.
The FBI is not just interested in the now. They want a future where they can exercise their own mayhem without having to worry bout tech innovation. They will try to legislate tech innovation into the dustbin of antiquity so that they can clumsily peek into your underwear drawer whenever the spirit moves them.
Tim Cook is prescient in this regard. He’s a hero.
However, if they have access to your phone and then your bruteforce your passcode via the current proposed backdoor/iOS rewrite, wouldn’t they then have access to your financial data and anything else that was encrypted on your phone? I don’t believe credit card info is shown in full on the settings screens, but once you have unlocked the phone, one could ostensibly change shipping addresses and such to make purchases and send them to the criminal, correct?
I agree with the article’s premise, and sent letters to my representatives telling them something similar: do not kill a nascent secure payments industry and enable a whole host of cybercrime in a shortsighted attempt to get terrorists who already have other means to encrypt anyway.
I’m not sure that you can do that without some sort of authentication. I don’t use Apple Pay, since my card was hacked the day after I added it to my iPhone. I would assume that you need a thumbprint to be able to change things like addresses, etc.
I was wondering about thumbprints/authentication as soon as I hit the post button.
I’ll go look for your writeup on that, Kirk. Interested to know how that happened (if you wrote it up, no need to recount here 🙂 ). I haven’t had issues with the couple of cards I’ve added yet, but I haven’t used it much due to having no money in those accounts.
I have to say I do still feel better about putting the cards in the phone and being able to remote wipe it all if I lose the thing than carrying a ton of cards in my wallet and having to call individual companies to cancel or subscribe to a service to cancel them all. There is always improvement to be made, though.
I think Dave actually linked to the article I wrote about my issue:
http://www.mcelhearn.com/why-did-apple-put-through-a-fraudulent-charge-on-my-credit-card-is-it-related-to-my-apple-support-profile/
One thing here in the UK is that payments are limited to £30, so it’s not very practical. Also, even if you do wipe the cards, you still need to contact your bank, especially if there’s been fraud, in order to file a complaint, and go through the rigamarole of getting a new card.
suck my buthole