<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Apple said “no” to the FBI - I can’t see how the Australian Agencies would be any different.<div class=""><br class=""></div><div class="">Afaik, doing anything like accessing keys in the SEP is not something Apple will do nor can they do. They keys don’t leave the SEP - it’s use to authorise a process and doesn’t actually expose the keys in question. They’ve talked quite a bit about the architecture in the past and I highly doubt they’ll go and add system/hardware level knobs and levers to work around this.</div><div class=""><br class=""></div><div class="">- Tim</div><div class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 5 Dec 2018, at 10:26 am, Michelle Sullivan <<a href="mailto:michelle@sorbs.net" class="">michelle@sorbs.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="content-type" content="text/html; charset=utf-8" class=""><div dir="auto" class="">I suspect this might be something like Apple issuing an update for a specific phone/user... however... considering that Apple stores keys on its specialized chip one has to question how they would do this..? Capture the user’s key upon access so they can unlock the store later? Capture everything in the store when the user unwittingly unlocks it?<br class=""><br class=""><div dir="ltr" class="">Michelle Sullivan<div class=""><a href="http://www.mhix.org/" class="">http://www.mhix.org/</a></div><div class="">Sent from my iPad</div></div><div dir="ltr" class=""><br class="">On 05 Dec 2018, at 08:33, Nick Stallman <<a href="mailto:nick@agentpoint.com" class="">nick@agentpoint.com</a>> wrote:<br class=""><br class=""></div><blockquote type="cite" class=""><div dir="ltr" class="">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" class=""><p class="">Also does this mean that the custom firmware for one or a handful
of targets is not a systemic weakness, but if (when) the custom
firmware leaks out publicly and can be used criminally, it
suddenly does become a systemic weakness?</p><p class="">So a request can become illegal after it's already been executed?</p><p class="">Note: I say "when" because by it's very nature, a copy of the
firmware must be provided to the targeted criminals.<br class="">
Smart people being targeted could detect and make a copy of it, do
a diff and hey presto they know exactly what's going on.<br class="">
It's like DVD encryption - you encrypt the content and then hand
over the keys so the DVD can be viewed.<br class="">
</p>
<div class="moz-cite-prefix">On 5/12/18 7:12 am, Scott Weeks wrote:<br class="">
</div>
<blockquote type="cite" cite="mid:20181204121209.57FC84F2@m0117566.ppops.net" class="">
<pre class="moz-quote-pre" wrap="">--- <a class="moz-txt-link-abbreviated" href="mailto:me@chrishawker.com.au">me@chrishawker.com.au</a> wrote:
From: Christopher Hawker <a class="moz-txt-link-rfc2396E" href="mailto:me@chrishawker.com.au"><me@chrishawker.com.au></a>
<a class="moz-txt-link-freetext" href="https://apple.news/AOnumlAB9THOmg_8mnMS9DA">https://apple.news/AOnumlAB9THOmg_8mnMS9DA</a>
-------------------------------------------------
"Custom firmware built to address one notice or request
is not a systemic weakness unless it is deployed to
users other than the intended targeted user."
I don't understand. They're going to write encryption
software with a weakness they can exploit and then force
the criminal to put it on his computer? How do they get
this malware only on "the intended targeted user('s)"
computer and no one elses???
"So long as the capability is held in reserve it does
not jeopardise the security of other users and is not
a systemic weakness," the department stated.
Um, it compromises "the security of other users" in
that any computer interacting with the malware infected
computer is compromised by the interaction.
scott
</pre>
<blockquote type="cite" class="">
<blockquote type="cite" class="">
<blockquote type="cite" class="">
<pre class="moz-quote-pre" wrap="">_______________________________________________
AusNOG mailing list
<a class="moz-txt-link-abbreviated" href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><a class="moz-txt-link-rfc2396E" href="mailto:AusNOG@lists.ausnog.net"><mailto:AusNOG@lists.ausnog.net></a>
<a class="moz-txt-link-freetext" href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</a>
</pre>
</blockquote>
</blockquote>
<pre class="moz-quote-pre" wrap="">_______________________________________________
AusNOG mailing list
<a class="moz-txt-link-abbreviated" href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><a class="moz-txt-link-rfc2396E" href="mailto:AusNOG@lists.ausnog.net"><mailto:AusNOG@lists.ausnog.net></a>
<a class="moz-txt-link-freetext" href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</a>
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">_______________________________________________
AusNOG mailing list
<a class="moz-txt-link-abbreviated" href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><a class="moz-txt-link-rfc2396E" href="mailto:AusNOG@lists.ausnog.net"><mailto:AusNOG@lists.ausnog.net></a>
<a class="moz-txt-link-freetext" href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</a>
_______________________________________________
AusNOG mailing list
<a class="moz-txt-link-abbreviated" href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a>
<a class="moz-txt-link-freetext" href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</a>
_______________________________________________
AusNOG mailing list
<a class="moz-txt-link-abbreviated" href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a>
<a class="moz-txt-link-freetext" href="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</a>
</pre>
</blockquote>
<div class="moz-signature">-- <br class="">
<table style="width:100%; font-family:Arial, Helvetica,
sans-serif; font-size:9pt; color:#666;" cellspacing="0" cellpadding="0" class="">
<tbody class="">
<tr class="">
<td style="font-size:12pt; font-weight:bold; color:#00ccff;" class="">Nick
Stallman</td>
</tr>
<tr class="">
<td style="padding:5pt 0 8pt; font-weight:bold;" class="">TECNICAL
DIRECTOR</td>
</tr>
<tr class="">
<td style="padding:7pt 0 10pt; border-top:1px solid
#eaeaea;" class="">
<table style="font-family:Arial, Helvetica, sans-serif;
font-size:9pt;" cellspacing="0" cellpadding="0" class="">
<tbody class="">
<tr class="">
<td style="padding-right:5pt;" class=""><img style="display:block;" src="https://www.agentpoint.com.au/wp-content/uploads/2016/12/e_icon_email.png" alt="Email" width="16" height="auto" class=""></td>
<td class=""><a style="color:#9a9a9a; text-decoration:none;" href="mailto:nick@agentpoint.com" title="nick@agentpoint.com" class="">nick@agentpoint.com</a></td>
</tr>
<tr class="">
<td style="padding-right:5pt;" class=""><img style="display:block;" src="https://www.agentpoint.com.au/wp-content/uploads/2016/12/e_icon_globe.png" alt="Website" width="16" height="auto" class=""></td>
<td class=""><a style="color:#9a9a9a; text-decoration:none;" href="https://www.agentpoint.com.au/" title="Agentpoint" target="_blank" class="">www.agentpoint.com.au</a></td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr class="">
<td style="padding:5pt; background:#66CCFF;" class="">
<table style="width:100%; vertical-align:middle" cellspacing="0" cellpadding="0" class="">
<tbody class="">
<tr class="">
<td align="left" class=""><a href="https://www.agentpoint.com.au/" title="Agentpoint" class=""><img style="display:block;" src="https://www.agentpoint.com.au/wp-content/uploads/2016/12/e_logo_agentpoint_white.png" alt="Agentpoint" width="100" height="auto" border="0" class=""></a></td>
<td align="right" class=""> <a href="https://www.instagram.com/Agentpoint/" title="Instagram" target="_blank" class=""><img src="https://www.agentpoint.com.au/wp-content/uploads/2016/12/e_icon_instagram.png" alt="Instagram" border="0" class=""></a> <a href="https://twitter.com/agentpoint" title="Twitter" target="_blank" class=""><img src="https://www.agentpoint.com.au/wp-content/uploads/2016/12/e_icon_twitter.png" alt="Twitter" border="0" class=""></a> <a href="https://www.facebook.com/agentpoint/" title="Facebook" target="_blank" class=""><img src="https://www.agentpoint.com.au/wp-content/uploads/2016/12/e_icon_facebook.png" alt="Facebook" border="0" class=""></a> </td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
</div></blockquote><blockquote type="cite" class=""><div dir="ltr" class=""><span class="">_______________________________________________</span><br class=""><span class="">AusNOG mailing list</span><br class=""><span class=""><a href="mailto:AusNOG@lists.ausnog.net" class="">AusNOG@lists.ausnog.net</a></span><br class=""><span class=""><a href="http://lists.ausnog.net/mailman/listinfo/ausnog" class="">http://lists.ausnog.net/mailman/listinfo/ausnog</a></span><br class=""></div></blockquote></div>_______________________________________________<br class="">AusNOG mailing list<br class=""><a href="mailto:AusNOG@lists.ausnog.net" class="">AusNOG@lists.ausnog.net</a><br class="">http://lists.ausnog.net/mailman/listinfo/ausnog<br class=""></div></blockquote></div><br class=""></div></body></html>