That doesn't matter! Apple's entire argument, which I completely agree with, is that if they make this firmware, then it exists. It doesn't matter that they were only instructed to put it on one phone, once it's out there, there's almost no way they can make sure that firmware doesn't get picked up by other people, and placed on other phones, without users consent, without court orders.

There's no such thing as one-off and then it disappears in the world of software. Once it exists in the world it's only a matter of time before everyone has it.

But it exists already! The fact that Apple can write a backdoor means there already is a back door. Apple is just refusing to open it, which I'm not sure they have a legal standing to do.

The fact that they would have to write some software or whatever is irrelevant. It's no different than if they already had a button they could press to make the phone hackable.

Does the potential existence of a backdoor justify its use against users?

Having to write software is very different than using existing software. Apple developed their software precisely to prevent situations like this---the backdoor is _undoing_ those developments.

And you are equally as wrong there.

China could steal Apple's key, but it doesn't immediately get them anything. They would also have to build up a completely parallel OS. That would be really expensive.

However, once Apple builds the malicious software, NOW you now have two very clear, very desirable targets.

Do you really think that China, Russia, etc. wouldn't bribe, steal, threaten, kidnap or blackmail their way to getting a copy of those?

Do you really think it would be that hard to modify the iOS software to make a phone hackable (by brute force, like the FBI plans) without the source? It's definitely doable. If China had Apple's keys, they could trivially do it.

>They would also have to build up a completely parallel OS. That would be really expensive. However, once Apple builds the malicious software, NOW you now have two very clear, very desirable targets.

The same applies to the source code and key now.

The actual software can be locked to the specific phone, so having it wouldn't help. Only having the source code would help, but having the source of iOS would also be very easy to turn into a backdoored version for anyone with the resources to steal it.

Do you not think China etc are capable of modifying source code?

Edit: sure, modifying source code to change the phone ID is a bit simpler than changing source code to not erase the phone on an incorrect password. But the difference seems orders of magnitude smaller than the "getting source code and Apple private keys" difficulty level.

How? How does the software get locked to a specific phone?

And while it's certainly possible that someone could figure out what Apple's signing keys are, it's incredibly unlikely given how big the numbers we're dealing with are. Which means, sure, somebody else could modify the source code, but getting it on to devices is an entirely different question.

Based on what I've read of what you've written, it seems like you genuinely believe that software is some magic cure-all that can do anything and everything you want, regardless of the practicality and effort required, and actual known constraints.

>How? How does the software get locked to a specific phone?

They take the udid of the phone, and refuse to run if it doesn't match the udid of the iPhone 5C in question. This was specifically mentioned in the court order.

>And while it's certainly possible that someone could figure out what Apple's signing keys are, it's incredibly unlikely given how big the numbers we're dealing with are. Which means, sure, somebody else could modify the source code, but getting it on to devices is an entirely different question.

You seem to have misunderstood. The threat model is not someone figuring out the key, the threat model is someone stealing the key. And, as I've been saying all along, the attacker needs to steal the key regardless of whether Apple complies with the court order or not. Modifying the source is not enough.

>Based on what I've read of what you've written, it seems like you genuinely believe that software is some magic cure-all that can do anything and everything you want, regardless of the practicality and effort required, and actual known constraints.

I'm not sure what I've written that gives that impression. Which specific known constraint have I suggested software can get around? https://blog.trailofbits.com/2016/02/17/apple-can-comply-wit... makes it sound that it would not be difficult for Apple to comply.