‹ BackHN Continuity

Thread

Cops Can Bypass iPhone's Automatic Reboot to Get into Locked Phones

287 points · 226 comments · speckx

  1. delichon · · focus · HN ↗
    I keep all of my most sensitive personal documents on my phone, as an emergency backup, but in an encrypted (Cryptomator) volume that requires a separate password. Given the routine news of such exploits this seems like due diligence.

    As I understand it this encryption is a significant additional barrier to technical or legal access to those files. If someone knows otherwise, please let me know. Being wrong could cost me my home and life savings.

    1. Cider9986 · · focus · HN ↗
      It would seem wise to at least keep a backup in an E2EE cloud [1]. This could possibly allow you to not give access even if legally compelled.

      >As I understand it this encryption is a significant additional barrier to technical or legal access to those files. If someone knows otherwise, please let me know. Being wrong could cost me my home and life savings.

      Yes, it seems that way in the US: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=49922513">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=49922513

      If your threat model includes someone using violence to coerce you, an option could be to use a cloud storage account entirely over Tor from the browser (preferably download the app because of web cryptography risks) with the login memorized. That way you can access it on any computer even if yours is lost and you can remove traces of it from your phone.

      [1] <a href="https:&#x2F;&#x2F;www.privacyguides.org&#x2F;en&#x2F;cloud&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.privacyguides.org&#x2F;en&#x2F;cloud&#x2F;

      1. 0x262d · · focus · HN ↗
        Yeah, getting all your sensitive stuff off your phone onto a secure cloud service seems like the obvious approach here right? They can still escalate what they try to coerce you to do, but they don&#x27;t have physical access to your data just by taking your phone, and you can also leave the phone with them and only lose the device if needed. In my likely scenario - innocent traveler, they aren&#x27;t looking for anything specific, but I still don&#x27;t want them to look through my files and photos just because I happen to travel internationally - that seems like it puts it out of reach (and out of obvious view) for now.
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.