<story><title>Apple Unveils The iPhone 5S</title><url>http://techcrunch.com/2013/09/10/apple-unveils-the-iphone-5s/</url></story><parent_chain><item><author>pilif</author><text>Yes. And how exactly do we check this? Why is it that we can still trust Apple? For all we know, the data gets sent directly to the NSA or, if it doesn&amp;#x27;t, there might be some secret backdoor that will make the device send the data at a later point. The last round of leaks was specifically talking about backdoors with all bigger US companies in order to circumvent encryption.&lt;p&gt;That&amp;#x27;s what I means by &amp;quot;we have to consider the iPhones backdoored&amp;quot;. Once you can&amp;#x27;t trust the device any more, all bets are off and thus we can&amp;#x27;t be sure that what Apple says they do with that fingerprint is what they actually are doing.&lt;p&gt;(edit: regarding jailbreaking, I seriously doubt that a sufficiently well-hidden backdoor would be found by a jailbreaker. Or have we found the backdoors in OSX or Windows yet? Since the latest leak, we know they are there)</text></item><item><author>cwilson</author><text>Apple specifically stated that your fingerprint is stored and encrypted only on the A7 chip, and not iCloud or anywhere else.&lt;p&gt;It&amp;#x27;s mentioned in the video as well: &lt;a href=&quot;http://www.apple.com/iphone-5s/videos/#video-touch&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.apple.com&amp;#x2F;iphone-5s&amp;#x2F;videos&amp;#x2F;#video-touch&lt;/a&gt;</text></item><item><author>pilif</author><text>Now that we have to consider the iPhones to be backdoored by the NSA, I wonder whether I really want to give them my fingerprint together with the rest of my data. I&amp;#x27;m also not so sure whether a fingerprint can&amp;#x27;t still be easily faked (like it was possible on that Mythbusters episode for example).&lt;p&gt;Personally, I think I&amp;#x27;d rather stay with my passcode.&lt;p&gt;Did you btw know that you can turn off &amp;quot;simple passcode&amp;quot; and then use a purely numeric longer passcode? In that case the iPhone will still show the big easy-to-hit numeric keyboard allowing you to type in the arbitrary length numeric code.&lt;p&gt;Yes. It&amp;#x27;s not as safe as a long alphanumeric password, but this gets annoying SO quickly, I&amp;#x27;d rather type in my 8 digits.</text></item></parent_chain><comment><author>comex</author><text>This is incorrect - we do not know any particular products which are backdoored.&lt;p&gt;edit: Also, there is a difference between a subtle crypto vulnerability and sending data to a server that, according to the announcement, is designed to be protected in its own enclave and never sent anywhere.  The latter would be far more obvious in the code and easier to spot.</text></comment>
<story><title>Apple Unveils The iPhone 5S</title><url>http://techcrunch.com/2013/09/10/apple-unveils-the-iphone-5s/</url></story><parent_chain><item><author>pilif</author><text>Yes. And how exactly do we check this? Why is it that we can still trust Apple? For all we know, the data gets sent directly to the NSA or, if it doesn&amp;#x27;t, there might be some secret backdoor that will make the device send the data at a later point. The last round of leaks was specifically talking about backdoors with all bigger US companies in order to circumvent encryption.&lt;p&gt;That&amp;#x27;s what I means by &amp;quot;we have to consider the iPhones backdoored&amp;quot;. Once you can&amp;#x27;t trust the device any more, all bets are off and thus we can&amp;#x27;t be sure that what Apple says they do with that fingerprint is what they actually are doing.&lt;p&gt;(edit: regarding jailbreaking, I seriously doubt that a sufficiently well-hidden backdoor would be found by a jailbreaker. Or have we found the backdoors in OSX or Windows yet? Since the latest leak, we know they are there)</text></item><item><author>cwilson</author><text>Apple specifically stated that your fingerprint is stored and encrypted only on the A7 chip, and not iCloud or anywhere else.&lt;p&gt;It&amp;#x27;s mentioned in the video as well: &lt;a href=&quot;http://www.apple.com/iphone-5s/videos/#video-touch&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.apple.com&amp;#x2F;iphone-5s&amp;#x2F;videos&amp;#x2F;#video-touch&lt;/a&gt;</text></item><item><author>pilif</author><text>Now that we have to consider the iPhones to be backdoored by the NSA, I wonder whether I really want to give them my fingerprint together with the rest of my data. I&amp;#x27;m also not so sure whether a fingerprint can&amp;#x27;t still be easily faked (like it was possible on that Mythbusters episode for example).&lt;p&gt;Personally, I think I&amp;#x27;d rather stay with my passcode.&lt;p&gt;Did you btw know that you can turn off &amp;quot;simple passcode&amp;quot; and then use a purely numeric longer passcode? In that case the iPhone will still show the big easy-to-hit numeric keyboard allowing you to type in the arbitrary length numeric code.&lt;p&gt;Yes. It&amp;#x27;s not as safe as a long alphanumeric password, but this gets annoying SO quickly, I&amp;#x27;d rather type in my 8 digits.</text></item></parent_chain><comment><author>drinchev</author><text>I&amp;#x27;m pretty sure, when they jailbreak it the truth will come out. And I doubt Apple would take the risk for lying about that.</text></comment>