Security from bruteforce

Nuttso

Hathaway_Noa Make sure your phone has auto-reboot and turns your phone in BFU state every now and then. (though BFU wont wont help protecting from injecting malicious code during fastboot mode)

This is also a myth. By law, such action must be explained in court to the last detail. This is not encrochat or Sky ecc where they can ship around the rule of law. In targeted operations like this, they have to explain exactly how. Which in turn explains the hack still in the trial technically accurate. The reason for this is that there was no data manipulation during it and the data has integrity.

Nuttso

Nuttso of you you have fact based evidence like court files or just a number and a name from a lawyer with such a case provide it pls.

Hathaway_Noa

Nuttso Cellebrite explicitly announced bruteforce capabilities within BFU mode for locked pixel phones, they announced this to their own customers and this will only be available for Cellebrite Premium and NOT ufed4pc! BIG DIFFERENCE! If you believe cellebrite is lying against their customers be my guest, but I'd rather give people this information to be taken into consideration. A lot of people take the titan-m security for granted and use short numeric passwords, this can bite them one day. Bootloader exploits are always a thing and have always been a thing, for both pixel phones and android phones.

Nuttso

Hathaway_Noa I know I follow them closely. I also know people that are licensing their products. And no they can't do what they claim. You're overestimating them. They do this quite often. And again. In targeted operations they have to proof unaltered data. This means it must be in the court files how they do it not just that they can do it.

Nuttso

The real problematic adversaries are pegasus and other unknown companies that are hording vulnerabilities.

Hathaway_Noa

Nuttso You may believe that.

Nuttso

Hathaway_Noa im not believing anything. I'm working on this topic together with a lot of lawyers after encro and sky

Nuttso

A judge at the district court will of course be able to convict without the raw data, but the Federal Supreme Court will overturn the verdict. Because in Germany, the Constitutional Court has ruled that the defendant must have the right to see all methods and raw data. This is mandatory. Encro and Sky is something else. There they have pulled off a clever move. The shipped around German law. With the current law and a targeted operation it's impossible to pull such a hack and not explain absolutely every detail how u did it in court. Same goes for NL.

Nuttso

My phone is in the asarvate chamber in Berlin and is a 3xl with the order so to open it as soon as technically possible. Nothing happens so far

Nuttso

And relying on Titan is off wrong. People should know what they do.

L8437

What's the story behind the injection into fast boot?

Nuttso

L8437 here is a complete misunderstanding how the secure enclave works. This isn't possible like he is describing it.

Nuttso

To end this discussion.

In BFU the data isn't accessible if you have a very strong password. 128 bit of random entropy.

In AFU mode nobody knows what company will pull out some sort of magic.

So if you want to be really secure against forensic use the phone only when you are sure that YOU will have the possibility to reboot it yourself. Where and how to pull it off like this is up to you. Simple as that

L8437

Nuttso to be honest the conversation is good to read, i don't want a heated debate to happen but it's still interesting.

What is 128 bit or random entropy? Are you referring to a type of password? If so can you give an example

Messi2023

Nuttso how can I pass you a SIG number

Nuttso

Messi2023 get a random signal number on the net install signal and share It here I'll msg u

Blastoidea

For me, a rather unsophisticated user, this thread has been very confusing.

How does one reconcile “Yes they can.” and “No they can’t!” In the same thread?

Nuttso

Blastoidea you have to reread. I explained very precise why such claims like the one with Cellebrite and the dutch law enforcement simply aren't facts till they end up in court. Research for yourself

[deleted]

Am I missing something or this thread is leading nowhere?

Nuttso

[deleted] the initial question was answered.

Nobody can give an 100% correct answer on what can be done against pixel in AFU mode. Because it can change right now.

The only 100% correct answer is make sure to always have control of the state the device is in. Use it only in AFU mode when you can make sure you are the one that can change it into BFU.

BFU with 128 bit of random entropy pass isn't possible to decrypt without the password.

Nuttso

L8437

https://www.kicksecure.com/wiki/Passwords
https://auth0.com/blog/creating-great-passwords/

Nuttso

L8437

Daniel recommends 90 bit = slinging massive kiwi penholder closable wolverine roundish

I recommended 128 bit = managing stoppable covenant silenced small harness recolor curvature friend veto

96 bit should be enough

https://diceware.rempe.us/#eff

« Previous Page Next Page »