Imagine a lock company creating a lock that cannot be picked without great effort, disables itself after too many failed attempts to open, and cannot have a master key created without information that is specifically held by them.
This company does not allow master keys and has never created one, as the whole point of their product is that it is to be secure. They believe (correctly) that the existence of a master key, even if it's locked in the company safe, is an additional point of insecurity that makes their product less effective.
If the police want to get into an apartment that is locked with one of these special locks, then what? The government can potentially brute force it, with great difficulty. They can force the manufacturer to make a master key, but that also puts at risk every other customer who bought a lock, none of whom have been accused of a crime.
Honestly, if the government does make Apple go through with this they should just go back to outlawing hard encryption. Because that's essentially the state that we'd be in, it would simply be that the poorly informed would think that their data was protected by encryption when actually it was not.
It's a good question, I'd guess that the answer is "not very long".
Depends whether they've got someone inside Apple. They might never get it, it might be a few hours after the code compiles.
I think as with most cryptographic things, the mere existence of a vulnerability or an attack that is significantly more effective than brute force is enough to cause concern. We accept the risk of rubber hose cryptanalysis because you can never avoid the vulnerability of the user, but any other sort of vulnerability should be treated with care.
We know that the NSA has been pushing for years to have backdoors put into cryptosystems, basically since publically available crypto was invented. Companies actually putting backdoors into their encryption systems is scary because then you're relying on security through obscurity.
If I may speak generally for a moment, at this point we can see that the iPhone has a vulnerability. But to exploit it you would need:
1) A programmer that knows the software and hardware well enough to write a hack version of the OS. It's possible that no single person can actually bypass all the security systems, it might need the knowledge of a group. Either way, there's likely not many of them.
2) Apple's master key to compile it so that it will be accepted by the hardwarem which is likely held by a few or only one person, and not the same person that can write the OS.
3) Free access to the phone.
Those first two are pretty hard to get through, as seen by the trouble the FBI is having. If the software existed, those two steps then devolve to "get a copy of the hack OS", which has a number of solutions that are way easier than getting two people to give information of their own free will. At worst, it becomes "how good is Apple's physical security?"
That's the problem. At the moment, the easiest attack that doesn't involve torturing the user for his code needs to go through several people at Apple who have a vested interest in
not damaging the security of the device of any user who hasn't been accused of a crime. That's pretty good. If the hack OS gets made, the easiest attack is still hard but way, way easier than it was.
I think you can try 5 times, let it sit; try again...wait. Repeat until successful.
I'm probably wrong about this. Maybe I'll do this with an old iPhone and see what happens.
It's a good thought, but the phone is a 5C. Check out points two and three for a description of why this is infeasible.
http://www.abc.net.au/news/2016-02-24/why-cant-the-fbi-unlock-an-iphone-apple-vs-farook-case/7194842
Basically, assuming that the setting that destroys data after ten wrong attempts isn't on (in which case they'd be straight up boned), they only get one password attempt an hour. It'd take them ~9 months to crack a 4 digit code, or a few years for a 6 digit, and that's with a lackey sitting there putting in numbers 24/7. Any data they might get would probably be useless by then.
