Apple can't decrypt your phone

Since it was introduced, Apple has had the ability to decrypt the contents if iPhones and other iOS devices when asked to do so (with a warrant).

Apple recently announced that with iOS 8 Apple will no longer be able to do so. Predictably, there has been a roar of outrage from many in law enforcement. [[Insert my usual rant about how recent trends in technology have been massively in favor of law enforcement here]].

This is really about much more than keeping out law enforcement, and I applaud Apple for (finally) taking this step. They have realized what was for Anonymizer a foundational truth. If data is stored and available, it will get out. If Apple has the ability to decrypt phones, then the keys are available within Apple. They could be taken, compromised, compelled, or simply brute forced by opponents unknown. This is why Anonymizer has never kept data on user activity.

Only by ensuring that they can not do so can Apple provide actual security to it customers against the full range of threats, potentially least of which is US law enforcement.

https://www.youtube.com/watch?v=l236gjtzeTc

Lance Cottrell is the Founder and Chief Scientist of Anonymizer. Follow me onFacebook, Twitter, and Google+.

Social Engineering - The oldest and best trick in the book.

The Washington Post has a good article on social engineering attacks. It is a good treatment of the topic.

Short answer, humans are the weak link, and can be defeated with extremely high probability.

The take away from this whole thing is that we need to be building security systems that don't rely on humans not being tricked into compromising their own security. A lot of security architects take a "blame the victim" stance. User's have other things to worry about than security. We need to make sure security happens even if they are not paying attention to it.