21 ms·

iPhones 'disabled' if Apple detects third-party repairs

438 points by noobie 11y ago

jdsnape 11y ago
The way they've reported on this seems a bit misleading. Isn't it just that the third-party repairers haven't reset the security mechanism after replacing the home button?
- jacquesm 11y ago
  Should it matter?
- DiabloD3 11y ago
  The problem is, Apple refuses to reset the security mechanism after such repairs have happened. Ergo, Apple is bricking phones as some sort of misplaced revenge-like behavior.
  - zepto 11y ago
    This doesn't follow. Apple refuses to reset the security mechanism because it can't verify the integrity of the repair. Call it revenge like behavior is just you attacking Apple. It's certainly incompetent or unanticipated and poorly handled, but it's an attempt to maintain their security promises.
- MartinMond 11y ago
  If third-party repairers can reset the security mechanism, then the security mechanism won't protect against actual attackers.
- stuaxo 11y ago
  The phone is still useful without the finger print reader, it should just degrade. I don't know anyone who uses the fingerprint reader or the purchasing functionality.
jacquesm 11y ago
It's totally dumb that a functioning phone is bricked by an update because of repairs done in the past. Imagine the same thing happening to your car. "Sorry sir, the software update done to your car has now disabled the vehicle because in the past someone not related to x (insert name of car company here) has repaired it, your car is now junk (you can't even resell it) and you'll have to buy a new one". It's just petty revenge because you had to temerity to go to another party other than apple to get your phone repaired and maybe even saved some money in the process. So now, in retaliation we'll destroy your phone in software. I'm sure this will go down well with the various EU courts.
- KhalilK 11y ago
  >Imagine the same thing happening to your car. Given that apple is working on an iCar, it's just a matter of time I presume.
- Loic 11y ago
  It may even be against the law in Europe because the phone was working perfectly after the repair and only the later update locked the phone without the ability to unlock it. To keep with the care maker example, in Germany, the car makers used to void the 10 years guarantee on the painting of the car if the regular checks were done by an independent car shop. This was then declared as illegal. I suppose Apple will soon release an update and declare that this was "a bug".
  - yulaow 11y ago
    How will affected users get the "new update" if their phone is already broken by the previous? I mean, I hope that, in the case of already broken phone caused by their own update, apple _at_least_ give them a new iphone for free, else they are gonna get rape-sued here in EU
  - tajen 11y ago
    It would be definitely illegal in France which has a law against planned obsolescence - but EU doesn't have it yet. https://en.m.wikipedia.org/wiki/Planned_obsolescence#Regulation https://en.m.wikipedia.org/wiki/Planned_obsolescence#Regulat...
tsmarsh 11y ago
It is frustrating the the language of MA 'right to repair' doesn't extend to devices. https://en.m.wikipedia.org/wiki/Massachusetts_Right_to_Repair_Initiative https://en.m.wikipedia.org/wiki/Massachusetts_Right_to_Repai...
tsmarsh 11y ago
It is frustrating the the language of MA 'right to repair' doesn't extend to devices. https://en.m.wikipedia.org/wiki/Massachusetts_Right_to_Repair_Initiative https://en.m.wikipedia.org/wiki/Massachusetts_Right_to_Repai...
minikites 11y ago
>retarded Don't say this.
- jacquesm 11y ago
  What would you suggest instead and why?
  - minikites 11y ago
    Call it what it actually is: short sighted, greedy, foolish, etc. Don't use a word that puts down people with disabilities.
    - jacquesm 11y ago
      I'm sorry, I did not mean to offend anybody but my reading of the word is that it has two meanings, one of which is 'stupid or dumb'. I'll update the comment.
      - Anderkent 11y ago
        Your reading is correct. But there's always going to be people complaining about word choice even if your meaning is perfectly clear and inoffensive.
        jacquesm 11y ago
        That may be true but it does not cost me anything at all to change the text so that it does not offend and in that sense it is an improvement. At the same time I see HN slide towards reddit just one little bit more with all the 'you insensitive clod' comments lately and that is sad too.
        minikites 11y ago
        It's less about HN vs. reddit and more about society at large. What sorts of rude and derogatory words do you feel the need to say where you can't pick a synonym?
KhalilK 11y ago
Albeit necessary to check the authenticity of components such as the TouchID sensor for security reasons, bricking the phones seems extreme. Why not simply disable Touch ID? This is them asking for a lawsuit.
- tedmiston 11y ago
  I wonder if it's really bricked -- could a downgrade to the previous OS version help? (Admittedly, it's not that straightforward for normal consumers.)
  - deleted 11y ago
    [deleted]
david_mitchell 11y ago
I don't see why people are upset or surprised about this. Apple is a pioneer in making electronics difficult to open up and play with. It has always been their approach to control every interaction that every customer has with every part of their business and every product produced by it. Accept it or use something else.
- everyone 11y ago
  Yeah, Apple are evil geniuses. They are prodigies at making money and expanding their business, at the expense of their users. It also seems like a majority of people on this site have some kind of Stockholm syndrome with regard to Apple. I guess making people reliant and locked in to their system is part of their genius. Of course people in that situation will find ingenious logical contortions to go through to justify their continued faith. Also, mass downvoting of this comment in 3. 2. 1 ...
  - matthewmacleod 11y ago
    https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html Please don't bait other users by inviting them to downvote you or announce that you expect to get downvoted. You will, of course, be down voted – because of your childish insistence that anybody who thinks differently from you is suffering from some kind of illness.
- stinos 11y ago
  upset or surprised suprised maybe not so much, but it seems pretty obvious one would get upset if his/hers go-to device is suddenly rendered practically useless?
  - david_mitchell 11y ago
    I accept your correction. In fact, now I think about it, essentially 0% of apple customers would likely be aware of this possibility at the time they make their purchase. I should have considered that most consumers won't follow stories like this as closely as the tech crowd. I do stand by my assertion that it is legitimate for apple to behave in this way though. They get to present their business as they choose to just like any other company and the customer get to choose whether to accept their terms. Personally I don't but, empirically, most other people seem to. I would however support requirements (as legislation) that consumers should be made aware of such practices at the point of purchase such that they can factor it into their buying decision.
skc 11y ago
Wouldn't a better idea be to simply display an error message to the effect of "your phone has undergone untrusted changes, please bring to your nearest Apple store" rather than bricking the whole thing?
- watmough 11y ago
  This, or simply allow it to be completely reset a la Android or Chrome.
- kevincox 11y ago
  Or just after you enter your PIN (which can override the fingerprint reader anyways) notify you that the sensor has been replaced and reset it.
interdrift 11y ago
That's how desperate Apple is.
kleiba 11y ago
Could someone explain what is the legal basis for this?
chris_wot 11y ago
I'm fairly certain that's illegal in Australia. It's called third line forcing. Looks like Apple is, yet again, going to be investigated by the ACCC.
bbarn 11y ago
Isn't this piece core to the virtual wallet/payment tech installed on the phone? Should apple's engineers have to put in friendly error messages if you exchange components in what's supposed to be a closed system?
hirephone 11y ago
This is just the beginning. High prices and resale values have spawned a substantial and apparently growing 3rd party repair and refurbishment market for Apple mobile devices. Beyond the dodgy corner unlock shops, multiple national chains have sprung up over the last 2 years where I live that advertise heavily on broadcast TV. Apple clearly sees this as money left on the table and they're concerned about the emergence of a comprehensive parallel supply chain for repair parts. Bricking end-user devices is one of the few levers they've got to try and shut down this industry, since there's no way to effectively identify and pursue the upstream suppliers in mainland China. Sucks for the users, though. I wonder if Apple will still be selling devices at all in 5 years, or if they'll only rent them out for €25/$25/£25 per month. Ultimately that'll probably be the only way to get the control they want.
- marincounty 11y ago
  People buy a high-end watch, like a Rolex. They can repair it if they have then knowledge. The problem is Rolex, and 99 percent of watch manufactures won't sell your, or your Watch Repair person the parts. You need to send the watch to the factory for service, at factory prices. So, when you buy a Rolex, your are actually leasing it? You don't truely own it, if you can't get the parts to fix it? It's just another way to make money. I didn't think Apple would irritate their customers at this particular point in time? And yes, I too believe, "This is just the beginning."
  - tshtf 11y ago
    Actually a majority of the watches, besides Rolex, in the <$5000 range use standard unmodified Swiss ETA movements, which can be repaired by any competent watchmaker. Very few watches in this price range use in-house movements.
    - micampe 11y ago
      http://watchguy.co.uk/swatch-group-parts-policy/ http://watchguy.co.uk/swatch-group-parts-policy/
PSeitz 11y ago
This is just to protect customers. </irony>
an_d_rew 11y ago
You DO have the right to repair your iPhone; it just has to be done by an official Apple repair centre. I completely understand the downsides of Apple's particular approach here, and totally get why people want the right to use 3rd party repair services. I've used them myself in the past to save (a lot of) money. But considering just how much of my life, financial and otherwise, is on my phone, I'm actually very glad that Apple has erred on the side of obsessive security!
- jrochkind1 11y ago
  Apparently, YOU don't have the right to repair your own iPhone then, only an official Apple repair centre does. You mean: You have the right to pay an official Apple repair center, and nobody else, to repair your iPhone.
- mgkimsal 11y ago
  > and totally get why people want the right to use 3rd party repair services. I've used them myself in the past to save (a lot of) money. The BBC article talks about someone who was in Macedonia. Apple doesn't have repair centres there. What they did - try to repair their device in a non-Apple-served country - was about all they could reasonably do. As Apple wants more of our life to be phone-oriented (payment details, wallet, physical data, etc) expecting 100% of people to be within X minutes of official repair centers 100% of the time is not workable, nor reasonable. I get it - the home button is secure and might have been compromised. This was just horrible design - they failed to account for a failure mode, and default to a brick instead. A warning bar or message on boot indicating "the touch id may have been compromised - all touch id features are disabled - please contact Apple" - while annoying - would have been reasonable.
- robgibbons 11y ago
  That's a very disingenuous definition of "the right to repair." In fact, requiring that all repairs be done by the OEM is exactly the opposite of the right to repair.
pjc50 11y ago
The stated rationale is that it's reasonable for a security-critical device to self-destruct if it thinks it may have been tampered with. Unfortunately this is a phone which costs a lot of money and has much of the user's life stored on it. I wouldn't be surprised to see Apple sued over this; I don't know what the interaction of the Sale of Goods Act and remote-bricking is. I was thinking along similar lines recently when someone sent me an email to an old PGP key - I was able to dig up the key, but had long since forgotten the password. Do you want your computer security system to fail-open (leaking your stuff and potentially exposing you to fraud) or fail-closed (losing data which may be irreplaceable and of emotional significance)?. It's not obvious. But if you store your photos on your phone, you should probably back them up to the cloud - and to a different system that is not under the same account, either locally or another cloud. User-friendly crypto may be possible, but user-friendly key management is a total nightmare.
- SixSigma 11y ago
  > has much of the user's life stored on it Stores life in fragile device Fragile device breaks Dies
  - pjc50 11y ago
    You may not like it, but this is how non-techy users use computers and phones.
    - SixSigma 11y ago
      We techy people have let them down, in that case. It should be safe to crush any of my terminals under a tyre and lose nothing. I learned 15+ years ago that the OS should have that as standard, with no privacy issue either. It is crazy that it is not baked in already. It's not even difficult.
- DanBC 11y ago
  Apple have been accused of copper-bottoming the rules when relatives want to get access to a dead person's phone. Apple only really need a death certificate and certificates of probate; but Apple insist on different court orders. So I'm not sure if SOGA etc will affect Apple here.
mc_hammer 11y ago
"these 10 fun tricks helped us get sued" apple.com
DominikR 11y ago
Correct me if I'm wrong, but from what I understand this is done to protect the customers from tampered with Touch ID sensors. It may be overly paranoid but I can at least understand the motivation behind this. Changing the display also involves disconnecting the Touch ID sensor so technically a malicious person might have done something that exposes the user of the device in some way. Statement from an Apple spokeswoman: “We protect fingerprint data using a secure enclave, which is uniquely paired to the touch ID sensor. When iPhone is serviced by an authorised Apple service provider or Apple retail store for changes that affect the touch ID sensor, the pairing is re-validated. This check ensures the device and the iOS features related to touch ID remain secure. Without this unique pairing, a malicious touch ID sensor could be substituted, thereby gaining access to the secure enclave. When iOS detects that the pairing fails, touch ID, including Apple Pay, is disabled so the device remains secure.” http://www.macrumors.com/2016/02/05/error-53-home-button-iphone-brick/ http://www.macrumors.com/2016/02/05/error-53-home-button-iph...
- izacus 11y ago
  Yes, but instead of disabling authentication with the non-authenticated TouchID sensor it bricks the phone.
  - Klathmon 11y ago
    ... until the old sensor is replaced. Which is a good thing. This is like complaining that forgetting your encryption password "bricks" your hard drive. Yeah, apple deserves some flack for not making this known to 3rd party repair shops, but it's not a problem itself.
- chippy 11y ago
  > "the device remains secure." A non functioning bricked device is more secure than a functioning device. Yes.
- Yetanfou 11y ago
  Did you really believe them when they said that? Just like all other similar decisions made by other companies under the guise of 'protect[ing] the customers', it should be clear that this is no more than a guise. If protection is what they had in mind they'd simply disable any functionality which could be impacted by a dodgy part. Disabling the whole device has the single, self-serving purpose of channelling the cash flow from the repair businesses into Apple's coffers.
randomname2 11y ago
Alternative: Apple stops NSA, China, crooks meddling with TouchID during repair. https://twitter.com/charlesarthur/status/695709113964195840 https://twitter.com/charlesarthur/status/695709113964195840
- grubles 11y ago
  Alternative alternative: Apple wants you to pay Apple a premium to repair your device.
letitleak 11y ago
People in the US should be complaining to the FTC. In the very least, for phone's under warranty, Magnuson-Moss should apply if Apple isn't fixing these problems for free. https://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty_Act https://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty...
mootothemax 11y ago
Damned if they do, and damned if they don't. "Anyone can access your private photos and emails! Just replace the home button with one programmed with your own fingerprints!" Can you imagine the comments if that were a story? The problem here is that Apple didn't find a way to tell repair shops and users that this could be an issue.
- ohthehugemanate 11y ago
  It doesn't have to be either or. Apple could provide a better fail over behavior for the home key, including a way for a consumer to validate the changed hardware. For instance: "IOS has detected a change in your Secure Home Key. Please contact apple secure support to confirm that your device is still secure!" add a 1-800 number and some security questions. Or automate it by requiring a login to your Apple account, email validation, and email notification of the change. Bottom line, when one authentication method fails, you need a fail over to something more difficult.
  - unfamiliar 11y ago
    > Please contact apple secure support to confirm that your device is still secure There's no way the customer or Apple can do that with third party hardware installed. The only solution I can see is to disable all of the features relying on Touch ID.
    - tim333 11y ago
      If they can issue an auth code for apple hardware then presumably it's possible to issue one for non apple hardware. They just have to make some effort to confirm the owner of the phone has it rather than a thief.
      - cududa 11y ago
        I'm sure no nation-state level actor would ever infiltrate this process..
consto 11y ago
So stupid, it's like they are asking for a class action lawsuit
progrocks9 11y ago
This type of move can't work now, because Apple is losing its mojo in a very fast pace.
laverick 11y ago
Something suspiciously like this happened to me on a second-hand iPhone 6 I bought a few weeks ago. Talk about crappy timing. Everything pointed to a software issue, but every repair person I took it to (both apple and non-apple) kept saying it was a hardware fault. Touch ID stopped working and the phone drains super quickly despite not being in use. Hoping Apple can provide a "fix", not gonna hold my breath though.
- tdkl 11y ago
  I got a second-hand 5S last year with faulty Touch ID, the seller admitted that it didn't work and didn't even notice because he never used it (at the time also many Touch IDs stopped working after iOS 8 updates). I got a lower price and a friend took it to Apple Store in Germany (had couple months warranty left), where they tried to change the display first, then swapped it for a new unit without issues.
awqrre 11y ago
One more proof that you don't own your device?
dade_ 11y ago
I think it is a design flaw, putting a security component in a common fail assembly, a fragile glass cover. Sony chose to put their touch ID sensor in a side button. I wonder if they thought of this, it sure looks like a smart design decision in light of this.
Fr0styMatt88 11y ago
I guess "iPhone 'disabled' if Apple detects key security component replaced with unauthorized version" wouldn't get as many clicks.
systemz 11y ago
Has someone made unintentional medical joke with this error? It reminds me of https://en.m.wikipedia.org/wiki/P53 https://en.m.wikipedia.org/wiki/P53, which is responsible for apoptosis - programmed death of cell.
- hackaflocka 11y ago
  Could be intentional.
ywecur 11y ago
The wonder of closed source
aurizon 11y ago
Lawsuit time, which Apple will lose
MCRed 11y ago
There is a strong bias, and the amazing thing is that its very difficult for the people who have this bias to realize it. As far as they can tell it is fact, and this is in large part because they live in a filter bubble where they only see things that confirm their bias. For example: Articles bashing Steve Jobs get upvoted a lot more than ones praising him. Exactly the opposite for bill Gates. Now if you look at Slashdot a decade before Hacker news the results for bill gates would have been the opposite of what you see here. Effectively, Bill Gates' millions in spending to improve his PR have changed people's perceptions (they will argue that its because he's such a generous benefactor, because that's politically correct, alas, they won't look too close at the activities of the Bill and Melinda Gates foundation lest they notice he isn't.) Google Good, Apple Bad, Leftism Good, Socialism Good, Basic Income! Global Warming is FACT, and anything you post that goes against this narrative risks getting you slow banned or hellbanned. Hell, I was once banned from here for relating how I met Grace Hopper as a kid (in a comment on an article about Grace Hopper.) I have no clue why that was hell ban worthy, after all she was the original "GRrrl in tech!!11!" Welcome to hacker news where there are no hackers.
- WhyDoiPostHere 11y ago
  For me, the real question is where have all the hackers gone? Years ago, there were high quality contributors here. They all had to go somewhere. When slashdot was dying, it was clear where everyone went (HN and Digg). This time around, it's not clear at all.
  - MCRed 11y ago
    I wish I knew, I would go there too.
  - l33tbro 11y ago
    The culture changed. Tech now mostly attracts (post)collegiate millennials chasing the startup wave (don't blame them, it's where there's chance of an actual job). You only have to look at the dwindling state of open-source right now to see proof of this. Add to that the post-Snowden cynicism that killed off what was left of cyber-utopianism and the free web, and it's that pretty clear that the hackers of yore grew up and weren't replaced by the next generation.
Dolores12 11y ago
So basically you do not own your hardware.
imeron 11y ago
Could this be a protection against selling stolen iPhones? As I remember a "broken TouchID" rates pretty high as a shady phone. Does anyone know how does this work? Can you reset a stolen phone or do they just sell those as parts nowdays?
- derwiki 11y ago
  This would be a great theft deterrent, if you could remotely brick your iPhone.
paulasmuth 11y ago
I'm not sure I understand what exactly happened here. Was it previously possible for non-apple engineers to replace the home button or was it not? The guardian's article seems to suggest it was: "Indeed, the phone may have been working perfectly for weeks or months since a repair or being damaged." If that is the case and it was possible to replace these sensors before, apple's narrative that the "error 53" code was introduced for security reasons doesn't seem to make a lot of sense: If the hardware sensor wasn't designed with secure authorization (e.g. via asymmetric cryptography) in the first place, all they could do now in a software update would be to add some kind of cosmetic device ID check. However, any such newly introduced check in software could not actually prevent "malicious sensor" attacks but would only add a (possibly trivial) additional step to the attack where you have to spoof the correct device id. Or maybe my reading of the guardian article is imprecise and replacing the home button has always meant loosing access to at least some security-relevant features?
- 95014_refugee 11y ago
  Third-party repair shops have never been able to correctly replace the TouchID sensor.
- tdkl 11y ago
  You can get the button exchanged, but since each one is coupled with the secure enclave co-processor, touch ID doesn't work anymore. But home button still works, so does the phone encryption, you just can't identify yourself with the fingerprint anymore. If you go and try to add a fingerprint, it behaves like you have a muddy finger and can't scan it. But this ain't an issue since encryption is done by a PIN code first, then fingerprints are used as a more convenient way to unlock. Frankly the device bricking is BS, since the encryption PIN code is still there and unknown to a possible attacker. You just can't use the victims fingerprints to unlock it anymore, or attach a hacked fingerprint reader, because it still won't be able to access the secure enclave to open and get the PIN code.
jeffmould 11y ago
All these comparisons to car warranties, and more specifically how in some countries there may be a question of legality. The U.S. has similar laws that car dealers can't deny warranty coverage because of third party repairs. IANAL, but it would be interesting to see how this translates to phones (or any other similar asset). http://www.consumer.ftc.gov/articles/0138-auto-warranties-routine-maintenance http://www.consumer.ftc.gov/articles/0138-auto-warranties-ro...
- ascagnel_ 11y ago
  Later updates from Apple have said that they'll replace the touch sensor and other hardware if necessary. I'm curious; although auto makers can't decline warranty coverage, does an "authorized maintenance" shop change the dynamics?
soneil 11y ago
I feel like a hypocrite criticising this one. Security has always been a tradeoff against convenience. I've been, overall, happy that Apple's starting to take the security of personal data on a very losable device seriously. I mean, not to gloss over it. I just got stung €320 for a screen repair, and I won't pretend I'm at all happy with that. But I have to accept we can't have it both ways - if we're demanding tough encryption, we have to accept the inconvenience that comes with it.
- lisper 11y ago
  The problem here is not so much that the devices are being bricked as the fact that it's coming as a nasty surprise. People needed to be warned about this, and the warning needed to happen before they bought the phone.
arihant 11y ago
This is still not as bad as the newer laptops in which TPM is soldered onto motherboard and the OS won't boot if it's damaged. You can't even get it repaired, even by the manufacturer without getting a brand new motherboard. Hardware level security is important, but one must know that whenever you involve hardware into the equation you must allow for collateral damage. Trusting trust is hard. You can't expect the verifier to verify the security module you got changed from the guy in a basement. Might as well get the OS and kernel from the same guy too. The reason this disables your phone is the same reason you see a red page when using self signed certificates. The guy vetting you isn't vetted himself. Now there is a case to be made that Apple should just show you a warning and let you use the phone. But this isn't about protecting your privacy, this is about protecting privacy of the guy whose phone you found.
- Dylan16807 11y ago
  How often do you damage a chip on your motherboard? Or need to replace non-capacitor parts on it? This is such a problem because it's stuck to the screen, and people need to replace screens all the time.
  - arihant 11y ago
    Out of three things -- thin phone, hardware level security, and cheapness of repairs -- you get to pick two. FWIW, I've lost 2 chromebooks to TPM failure in 18 months.
    - Dylan16807 11y ago
      I was under the impression that it wasn't hard to keep the old module when replacing a screen, just that people hadn't always done it.
  - deleted 11y ago
    [deleted]
  - ericabiz 11y ago
    This only affects the home button. If you replace the screen and keep your original home button, there is no issue. I co-own a repair shop. We have known about this for a while. We won't replace home buttons for this reason. But we replace hundreds of screens a month with no issues.
lisper 11y ago
Now might be a good time to make a donation to the EFF. https://www.eff.org/issues/right-to-repair https://www.eff.org/issues/right-to-repair
quackerhacker 11y ago
I haven't experience any error 53 codes on the devices I've repaired, but if this is true... Wow! That's really shady of Apple. I'm starting to get the feeling that the moves they're making (like charging for Apple radio [not Apple music], and now disabling phones with unauthorized repairs) is their response to their recent report of declining iPhone sales. Disappointing if this is true that these changes are at the expense of their end users and fans (and I am a fan).
userbinator 11y ago
This seems like a deliberate move by Apple, since they could've put the secure component ("TPM") on the mainboard, where it won't be as easily damaged, instead of the fingerprint reader. It's like an organism whose brain is in one of its appendages instead of its head... Either way, if the skills of the Chinese (and other far-East) reverse-engineers continue to be what they are, I think workarounds will be found soon enough - from what I've seen, the repair people in particular are very resourceful and clever, and come up with "tricks" to fix things that the original manufacturer never even thought about. It's their core business; you can bet they'll spend a ton of effort on figuring out how. Apple's proprietary cable authentication chips have been cloned. The infamous Thinkpad BIOS password has been circumvented. Replacements for ink cartridge authentication chips (seriously) have appeared. There is always a crack. I continue to find it amazing how effective the "security" excuse is; it seems you can get the majority to give up anything if you can turn it into some sort of argument about how it'll make things safer. Who doesn't want to feel safe, even if it ultimately results in society where every little thing you do is controlled by some huge bureaucracy? The old quote on security vs. freedom is so relevant today, but related to what I think will happen, here's a variant on that theme: "I wish for the insecurity that gives us freedom."
singham 11y ago
More reasons for not to be in Apple ecosystem.
once-in-a-while 11y ago
Don't use smart phones. Just don't. It works for me.
KiDD 11y ago
I highly recommend reading up on Apple's Security white paper that details how it all works... https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
natch 11y ago
What really surprised me, and what most people don't seem to know, is that repairs at an Apple store are way cheaper than third party repairs.
- natch 11y ago
  Why the downvotes? I got a Macbook Pro repaired recently and the Genius guy took me aside and said I got a great deal because they have a per-model, per-service visit price cap on replacement parts charges for repairs. Meaning that in one visit, you can get your Macbook repaired and replace the screen, the motherboard, the hard drive, the power board, the battery, the keyboard, pretty much the whole thing, and the price (for parts) is capped at around $280 for my particular model. The labor price is not capped but they are good at what they do, so the labor is super fast and ends up being cheap. I had a similar experience with an iPhone repair, where my camera had dust in it. Apparently the best way to do this is a back cover replacement, and the back cover comes with the camera built in. I was pretty scared until I heard the price, which was I think at the time $30, way less than third party vendors charge for this. Again the downvotes, for providing useful information, are really baffling here.
stefek99 11y ago
Has anyone read full Terms and Conditions? I think most of the people clicked / tapped / pressed "AGREE". So here you go.
dghughes 11y ago
The iPhone6 and F-35 share the same problem trying to detect approved or faulty parts. Funny.
mattkrea 11y ago
I'll take it as a positive that there is a good chance if someone tampered with my device my information is still secure.
sneakycr0w 11y ago
I feel for both sides of this. On one hand, as a consumer, I think it's unfair to force users to either buy a new iPhone or do repairs via Apple (do they even do them all?). As a business, I understand how non-Apple repairs can damage a brand.
tristanj 11y ago
I posted this earlier today, but the current article (from bbc.co.uk) does a poor job covering the issue. In summary, Apple iOS uses a validation system to ensure Touch ID sensor is not maliciously replaced or modified. The Touch ID sensor has access to the iPhone Security Enclave, where fingerprint data is kept. A malicious sensor could, hypothetically, steal fingerprints from an iPhone user unknowingly. This could be used to unlock the phone and make purchases through Apple Pay without the owner's permission. To prevent this, Apple uses a validation system whenever the Touch ID sensor is repaired. When iPhone is serviced by an authorised Apple service provider or Apple retail store for changes that affect the touch ID sensor, the validation paring is updated. Third-party repairs to the sensor will not update the pairing, and will fail validation when using Touch ID. This validation error is shown to users as the mysterious "Error 53". If the validation fails, the device will function mostly fine, although with Touch ID disabled. However, the device will be prevented from restoring or updating to a new version. Restoring from backup still works. I'm not too sure why restoring or updating is blocked, but my guess is that they want to prevent malicious software from being uploaded in this process. From the Daily Dot article, if a user encounters this error, Apple's current resolution is a full device replacement. It may be overkill I don't think Apple expected many people to encounter this issue, so it seems reasonable why they chose this option. This is a great security feature for users, and I'm really glad Apple engineers considered this situation. Unfortunately the media is blowing this and leaving crucial details about what's happening and the reasoning behind it. Here is Apple's statement on the matter: We take customer security very seriously and Error 53 is the result of security checks designed to protect our customers. iOS checks that the Touch ID sensor in your iPhone or iPad correctly matches your device's other components. If iOS finds a mismatch, the check fails and Touch ID, including for Apple Pay use, is disabled. This security measure is necessary to protect your device and prevent a fraudulent Touch ID sensor from being used. If a customer encounters Error 53, we encourage them to contact Apple Support.
- jdhawk 11y ago
  Wouldnt it be more logical to simply disable the Touch Functionality and treat it like a Pre-TouchID button when not replaced by Apple with an OEM part?
sneakycr0w 11y ago
I feel for both sides of this issue. As a consumer I am upset that I am essentially being forced to either buy a new iPhone or do my repair via Apple (do they even do all repairs?). Although, as a business I understand not wanting third party repairs as those can damage your brand if done incorrectly.
dang 11y ago
Url changed from http://www.bbc.com/news/technology-35502030 http://www.bbc.com/news/technology-35502030, which points to this.
remriel 11y ago
Fuck Apple.
remriel 11y ago
Fuck Apple.
skywhopper 11y ago
I think it's utterly reasonable for the device to shut down if it detects what looks like tampering with a high-security component. It's frustrating, sure, and the error message is beyond poor, but the behavior makes sense. It's not about preventing third party repairs. It is unfortunate but true that high levels of security ultimately require trust, and that means that some things we used to take for granted will fall by the wayside. Third party repair of what are now secure components may be one of those things.
stesch 11y ago
Wow, Apple hate like on /r/technology.
aftbit 11y ago
I love the sentence: >He had to pay £270 for a replacement and is furious. He was so furious that he bought a second iPhone which had the same fundamental design decisions and would fail in the same way if he got it repaired by a non-Apple repairer. No wonder Apple doesn't give a damn about this - everyone is just buying a new phone from them.
yason 11y ago
So much for owning something you thought you owned. This has happened again and again, and will increasingly happen in the future under whatever disguise, security-wise or not.
enlightenedfool 11y ago
yet another thing that anti-iphone people rile and iphone users don't care. The bricked owners will buy the next gen iphone and won't repeat the mistake of third party repair. what's the fuss about? yawn...

438 points by noobie 11y ago

The way they've reported on this seems a bit misleading. Isn't it just that the third-party repairers haven't reset the security mechanism after replacing the home button?

jacquesm 11y ago
Should it matter?
DiabloD3 11y ago
The problem is, Apple refuses to reset the security mechanism after such repairs have happened. Ergo, Apple is bricking phones as some sort of misplaced revenge-like behavior.
- zepto 11y ago
  This doesn't follow. Apple refuses to reset the security mechanism because it can't verify the integrity of the repair. Call it revenge like behavior is just you attacking Apple. It's certainly incompetent or unanticipated and poorly handled, but it's an attempt to maintain their security promises.
MartinMond 11y ago
If third-party repairers can reset the security mechanism, then the security mechanism won't protect against actual attackers.
stuaxo 11y ago
The phone is still useful without the finger print reader, it should just degrade. I don't know anyone who uses the fingerprint reader or the purchasing functionality.

jacquesm 11y ago

It's totally dumb that a functioning phone is bricked by an update because of repairs done in the past. Imagine the same thing happening to your car. "Sorry sir, the software update done to your car has now disabled the vehicle because in the past someone not related to x (insert name of car company here) has repaired it, your car is now junk (you can't even resell it) and you'll have to buy a new one". It's just petty revenge because you had to temerity to go to another party other than apple to get your phone repaired and maybe even saved some money in the process. So now, in retaliation we'll destroy your phone in software. I'm sure this will go down well with the various EU courts.

KhalilK 11y ago
>Imagine the same thing happening to your car. Given that apple is working on an iCar, it's just a matter of time I presume.
Loic 11y ago
It may even be against the law in Europe because the phone was working perfectly after the repair and only the later update locked the phone without the ability to unlock it. To keep with the care maker example, in Germany, the car makers used to void the 10 years guarantee on the painting of the car if the regular checks were done by an independent car shop. This was then declared as illegal. I suppose Apple will soon release an update and declare that this was "a bug".
- yulaow 11y ago
  How will affected users get the "new update" if their phone is already broken by the previous? I mean, I hope that, in the case of already broken phone caused by their own update, apple _at_least_ give them a new iphone for free, else they are gonna get rape-sued here in EU
- tajen 11y ago
  It would be definitely illegal in France which has a law against planned obsolescence - but EU doesn't have it yet. https://en.m.wikipedia.org/wiki/Planned_obsolescence#Regulation https://en.m.wikipedia.org/wiki/Planned_obsolescence#Regulat...

tsmarsh 11y ago

It is frustrating the the language of MA 'right to repair' doesn't extend to devices. https://en.m.wikipedia.org/wiki/Massachusetts_Right_to_Repair_Initiative https://en.m.wikipedia.org/wiki/Massachusetts_Right_to_Repai...

tsmarsh 11y ago

minikites 11y ago

>retarded Don't say this.

jacquesm 11y ago
What would you suggest instead and why?
- minikites 11y ago
  Call it what it actually is: short sighted, greedy, foolish, etc. Don't use a word that puts down people with disabilities.
  - jacquesm 11y ago
    I'm sorry, I did not mean to offend anybody but my reading of the word is that it has two meanings, one of which is 'stupid or dumb'. I'll update the comment.
    - Anderkent 11y ago
      Your reading is correct. But there's always going to be people complaining about word choice even if your meaning is perfectly clear and inoffensive.
      - jacquesm 11y ago
        That may be true but it does not cost me anything at all to change the text so that it does not offend and in that sense it is an improvement. At the same time I see HN slide towards reddit just one little bit more with all the 'you insensitive clod' comments lately and that is sad too.
        minikites 11y ago
        It's less about HN vs. reddit and more about society at large. What sorts of rude and derogatory words do you feel the need to say where you can't pick a synonym?

KhalilK 11y ago

Albeit necessary to check the authenticity of components such as the TouchID sensor for security reasons, bricking the phones seems extreme. Why not simply disable Touch ID? This is them asking for a lawsuit.

tedmiston 11y ago
I wonder if it's really bricked -- could a downgrade to the previous OS version help? (Admittedly, it's not that straightforward for normal consumers.)
- deleted 11y ago
  [deleted]

david_mitchell 11y ago

I don't see why people are upset or surprised about this. Apple is a pioneer in making electronics difficult to open up and play with. It has always been their approach to control every interaction that every customer has with every part of their business and every product produced by it. Accept it or use something else.

everyone 11y ago
Yeah, Apple are evil geniuses. They are prodigies at making money and expanding their business, at the expense of their users. It also seems like a majority of people on this site have some kind of Stockholm syndrome with regard to Apple. I guess making people reliant and locked in to their system is part of their genius. Of course people in that situation will find ingenious logical contortions to go through to justify their continued faith. Also, mass downvoting of this comment in 3. 2. 1 ...
- matthewmacleod 11y ago
  https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html Please don't bait other users by inviting them to downvote you or announce that you expect to get downvoted. You will, of course, be down voted – because of your childish insistence that anybody who thinks differently from you is suffering from some kind of illness.
stinos 11y ago
upset or surprised suprised maybe not so much, but it seems pretty obvious one would get upset if his/hers go-to device is suddenly rendered practically useless?
- david_mitchell 11y ago
  I accept your correction. In fact, now I think about it, essentially 0% of apple customers would likely be aware of this possibility at the time they make their purchase. I should have considered that most consumers won't follow stories like this as closely as the tech crowd. I do stand by my assertion that it is legitimate for apple to behave in this way though. They get to present their business as they choose to just like any other company and the customer get to choose whether to accept their terms. Personally I don't but, empirically, most other people seem to. I would however support requirements (as legislation) that consumers should be made aware of such practices at the point of purchase such that they can factor it into their buying decision.

skc 11y ago

Wouldn't a better idea be to simply display an error message to the effect of "your phone has undergone untrusted changes, please bring to your nearest Apple store" rather than bricking the whole thing?

watmough 11y ago
This, or simply allow it to be completely reset a la Android or Chrome.
kevincox 11y ago
Or just after you enter your PIN (which can override the fingerprint reader anyways) notify you that the sensor has been replaced and reset it.

interdrift 11y ago

That's how desperate Apple is.

kleiba 11y ago

Could someone explain what is the legal basis for this?

chris_wot 11y ago

I'm fairly certain that's illegal in Australia. It's called third line forcing. Looks like Apple is, yet again, going to be investigated by the ACCC.

bbarn 11y ago

Isn't this piece core to the virtual wallet/payment tech installed on the phone? Should apple's engineers have to put in friendly error messages if you exchange components in what's supposed to be a closed system?

hirephone 11y ago

This is just the beginning. High prices and resale values have spawned a substantial and apparently growing 3rd party repair and refurbishment market for Apple mobile devices. Beyond the dodgy corner unlock shops, multiple national chains have sprung up over the last 2 years where I live that advertise heavily on broadcast TV. Apple clearly sees this as money left on the table and they're concerned about the emergence of a comprehensive parallel supply chain for repair parts. Bricking end-user devices is one of the few levers they've got to try and shut down this industry, since there's no way to effectively identify and pursue the upstream suppliers in mainland China. Sucks for the users, though. I wonder if Apple will still be selling devices at all in 5 years, or if they'll only rent them out for €25/$25/£25 per month. Ultimately that'll probably be the only way to get the control they want.

marincounty 11y ago
People buy a high-end watch, like a Rolex. They can repair it if they have then knowledge. The problem is Rolex, and 99 percent of watch manufactures won't sell your, or your Watch Repair person the parts. You need to send the watch to the factory for service, at factory prices. So, when you buy a Rolex, your are actually leasing it? You don't truely own it, if you can't get the parts to fix it? It's just another way to make money. I didn't think Apple would irritate their customers at this particular point in time? And yes, I too believe, "This is just the beginning."
- tshtf 11y ago
  Actually a majority of the watches, besides Rolex, in the <$5000 range use standard unmodified Swiss ETA movements, which can be repaired by any competent watchmaker. Very few watches in this price range use in-house movements.
  - micampe 11y ago
    http://watchguy.co.uk/swatch-group-parts-policy/ http://watchguy.co.uk/swatch-group-parts-policy/

PSeitz 11y ago

This is just to protect customers. </irony>

an_d_rew 11y ago

You DO have the right to repair your iPhone; it just has to be done by an official Apple repair centre. I completely understand the downsides of Apple's particular approach here, and totally get why people want the right to use 3rd party repair services. I've used them myself in the past to save (a lot of) money. But considering just how much of my life, financial and otherwise, is on my phone, I'm actually very glad that Apple has erred on the side of obsessive security!

jrochkind1 11y ago
Apparently, YOU don't have the right to repair your own iPhone then, only an official Apple repair centre does. You mean: You have the right to pay an official Apple repair center, and nobody else, to repair your iPhone.
mgkimsal 11y ago
> and totally get why people want the right to use 3rd party repair services. I've used them myself in the past to save (a lot of) money. The BBC article talks about someone who was in Macedonia. Apple doesn't have repair centres there. What they did - try to repair their device in a non-Apple-served country - was about all they could reasonably do. As Apple wants more of our life to be phone-oriented (payment details, wallet, physical data, etc) expecting 100% of people to be within X minutes of official repair centers 100% of the time is not workable, nor reasonable. I get it - the home button is secure and might have been compromised. This was just horrible design - they failed to account for a failure mode, and default to a brick instead. A warning bar or message on boot indicating "the touch id may have been compromised - all touch id features are disabled - please contact Apple" - while annoying - would have been reasonable.
robgibbons 11y ago
That's a very disingenuous definition of "the right to repair." In fact, requiring that all repairs be done by the OEM is exactly the opposite of the right to repair.

pjc50 11y ago

The stated rationale is that it's reasonable for a security-critical device to self-destruct if it thinks it may have been tampered with. Unfortunately this is a phone which costs a lot of money and has much of the user's life stored on it. I wouldn't be surprised to see Apple sued over this; I don't know what the interaction of the Sale of Goods Act and remote-bricking is. I was thinking along similar lines recently when someone sent me an email to an old PGP key - I was able to dig up the key, but had long since forgotten the password. Do you want your computer security system to fail-open (leaking your stuff and potentially exposing you to fraud) or fail-closed (losing data which may be irreplaceable and of emotional significance)?. It's not obvious. But if you store your photos on your phone, you should probably back them up to the cloud - and to a different system that is not under the same account, either locally or another cloud. User-friendly crypto may be possible, but user-friendly key management is a total nightmare.

SixSigma 11y ago
> has much of the user's life stored on it Stores life in fragile device Fragile device breaks Dies
- pjc50 11y ago
  You may not like it, but this is how non-techy users use computers and phones.
  - SixSigma 11y ago
    We techy people have let them down, in that case. It should be safe to crush any of my terminals under a tyre and lose nothing. I learned 15+ years ago that the OS should have that as standard, with no privacy issue either. It is crazy that it is not baked in already. It's not even difficult.
DanBC 11y ago
Apple have been accused of copper-bottoming the rules when relatives want to get access to a dead person's phone. Apple only really need a death certificate and certificates of probate; but Apple insist on different court orders. So I'm not sure if SOGA etc will affect Apple here.

mc_hammer 11y ago

"these 10 fun tricks helped us get sued" apple.com

DominikR 11y ago

Correct me if I'm wrong, but from what I understand this is done to protect the customers from tampered with Touch ID sensors. It may be overly paranoid but I can at least understand the motivation behind this. Changing the display also involves disconnecting the Touch ID sensor so technically a malicious person might have done something that exposes the user of the device in some way. Statement from an Apple spokeswoman: “We protect fingerprint data using a secure enclave, which is uniquely paired to the touch ID sensor. When iPhone is serviced by an authorised Apple service provider or Apple retail store for changes that affect the touch ID sensor, the pairing is re-validated. This check ensures the device and the iOS features related to touch ID remain secure. Without this unique pairing, a malicious touch ID sensor could be substituted, thereby gaining access to the secure enclave. When iOS detects that the pairing fails, touch ID, including Apple Pay, is disabled so the device remains secure.” http://www.macrumors.com/2016/02/05/error-53-home-button-iphone-brick/ http://www.macrumors.com/2016/02/05/error-53-home-button-iph...

izacus 11y ago
Yes, but instead of disabling authentication with the non-authenticated TouchID sensor it bricks the phone.
- Klathmon 11y ago
  ... until the old sensor is replaced. Which is a good thing. This is like complaining that forgetting your encryption password "bricks" your hard drive. Yeah, apple deserves some flack for not making this known to 3rd party repair shops, but it's not a problem itself.
chippy 11y ago
> "the device remains secure." A non functioning bricked device is more secure than a functioning device. Yes.
Yetanfou 11y ago
Did you really believe them when they said that? Just like all other similar decisions made by other companies under the guise of 'protect[ing] the customers', it should be clear that this is no more than a guise. If protection is what they had in mind they'd simply disable any functionality which could be impacted by a dodgy part. Disabling the whole device has the single, self-serving purpose of channelling the cash flow from the repair businesses into Apple's coffers.

randomname2 11y ago

Alternative: Apple stops NSA, China, crooks meddling with TouchID during repair. https://twitter.com/charlesarthur/status/695709113964195840 https://twitter.com/charlesarthur/status/695709113964195840

grubles 11y ago
Alternative alternative: Apple wants you to pay Apple a premium to repair your device.

letitleak 11y ago

People in the US should be complaining to the FTC. In the very least, for phone's under warranty, Magnuson-Moss should apply if Apple isn't fixing these problems for free. https://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty_Act https://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty...

mootothemax 11y ago

Damned if they do, and damned if they don't. "Anyone can access your private photos and emails! Just replace the home button with one programmed with your own fingerprints!" Can you imagine the comments if that were a story? The problem here is that Apple didn't find a way to tell repair shops and users that this could be an issue.

ohthehugemanate 11y ago
It doesn't have to be either or. Apple could provide a better fail over behavior for the home key, including a way for a consumer to validate the changed hardware. For instance: "IOS has detected a change in your Secure Home Key. Please contact apple secure support to confirm that your device is still secure!" add a 1-800 number and some security questions. Or automate it by requiring a login to your Apple account, email validation, and email notification of the change. Bottom line, when one authentication method fails, you need a fail over to something more difficult.
- unfamiliar 11y ago
  > Please contact apple secure support to confirm that your device is still secure There's no way the customer or Apple can do that with third party hardware installed. The only solution I can see is to disable all of the features relying on Touch ID.
  - tim333 11y ago
    If they can issue an auth code for apple hardware then presumably it's possible to issue one for non apple hardware. They just have to make some effort to confirm the owner of the phone has it rather than a thief.
    - cududa 11y ago
      I'm sure no nation-state level actor would ever infiltrate this process..

consto 11y ago

So stupid, it's like they are asking for a class action lawsuit

progrocks9 11y ago

This type of move can't work now, because Apple is losing its mojo in a very fast pace.

laverick 11y ago

Something suspiciously like this happened to me on a second-hand iPhone 6 I bought a few weeks ago. Talk about crappy timing. Everything pointed to a software issue, but every repair person I took it to (both apple and non-apple) kept saying it was a hardware fault. Touch ID stopped working and the phone drains super quickly despite not being in use. Hoping Apple can provide a "fix", not gonna hold my breath though.

tdkl 11y ago
I got a second-hand 5S last year with faulty Touch ID, the seller admitted that it didn't work and didn't even notice because he never used it (at the time also many Touch IDs stopped working after iOS 8 updates). I got a lower price and a friend took it to Apple Store in Germany (had couple months warranty left), where they tried to change the display first, then swapped it for a new unit without issues.

awqrre 11y ago

One more proof that you don't own your device?

dade_ 11y ago

I think it is a design flaw, putting a security component in a common fail assembly, a fragile glass cover. Sony chose to put their touch ID sensor in a side button. I wonder if they thought of this, it sure looks like a smart design decision in light of this.

Fr0styMatt88 11y ago

I guess "iPhone 'disabled' if Apple detects key security component replaced with unauthorized version" wouldn't get as many clicks.

systemz 11y ago

Has someone made unintentional medical joke with this error? It reminds me of https://en.m.wikipedia.org/wiki/P53 https://en.m.wikipedia.org/wiki/P53, which is responsible for apoptosis - programmed death of cell.

hackaflocka 11y ago
Could be intentional.

ywecur 11y ago

The wonder of closed source

aurizon 11y ago

Lawsuit time, which Apple will lose

MCRed 11y ago

There is a strong bias, and the amazing thing is that its very difficult for the people who have this bias to realize it. As far as they can tell it is fact, and this is in large part because they live in a filter bubble where they only see things that confirm their bias. For example: Articles bashing Steve Jobs get upvoted a lot more than ones praising him. Exactly the opposite for bill Gates. Now if you look at Slashdot a decade before Hacker news the results for bill gates would have been the opposite of what you see here. Effectively, Bill Gates' millions in spending to improve his PR have changed people's perceptions (they will argue that its because he's such a generous benefactor, because that's politically correct, alas, they won't look too close at the activities of the Bill and Melinda Gates foundation lest they notice he isn't.) Google Good, Apple Bad, Leftism Good, Socialism Good, Basic Income! Global Warming is FACT, and anything you post that goes against this narrative risks getting you slow banned or hellbanned. Hell, I was once banned from here for relating how I met Grace Hopper as a kid (in a comment on an article about Grace Hopper.) I have no clue why that was hell ban worthy, after all she was the original "GRrrl in tech!!11!" Welcome to hacker news where there are no hackers.

WhyDoiPostHere 11y ago
For me, the real question is where have all the hackers gone? Years ago, there were high quality contributors here. They all had to go somewhere. When slashdot was dying, it was clear where everyone went (HN and Digg). This time around, it's not clear at all.
- MCRed 11y ago
  I wish I knew, I would go there too.
- l33tbro 11y ago
  The culture changed. Tech now mostly attracts (post)collegiate millennials chasing the startup wave (don't blame them, it's where there's chance of an actual job). You only have to look at the dwindling state of open-source right now to see proof of this. Add to that the post-Snowden cynicism that killed off what was left of cyber-utopianism and the free web, and it's that pretty clear that the hackers of yore grew up and weren't replaced by the next generation.

Dolores12 11y ago

So basically you do not own your hardware.

imeron 11y ago

Could this be a protection against selling stolen iPhones? As I remember a "broken TouchID" rates pretty high as a shady phone. Does anyone know how does this work? Can you reset a stolen phone or do they just sell those as parts nowdays?

derwiki 11y ago
This would be a great theft deterrent, if you could remotely brick your iPhone.

paulasmuth 11y ago

I'm not sure I understand what exactly happened here. Was it previously possible for non-apple engineers to replace the home button or was it not? The guardian's article seems to suggest it was: "Indeed, the phone may have been working perfectly for weeks or months since a repair or being damaged." If that is the case and it was possible to replace these sensors before, apple's narrative that the "error 53" code was introduced for security reasons doesn't seem to make a lot of sense: If the hardware sensor wasn't designed with secure authorization (e.g. via asymmetric cryptography) in the first place, all they could do now in a software update would be to add some kind of cosmetic device ID check. However, any such newly introduced check in software could not actually prevent "malicious sensor" attacks but would only add a (possibly trivial) additional step to the attack where you have to spoof the correct device id. Or maybe my reading of the guardian article is imprecise and replacing the home button has always meant loosing access to at least some security-relevant features?

95014_refugee 11y ago
Third-party repair shops have never been able to correctly replace the TouchID sensor.
tdkl 11y ago
You can get the button exchanged, but since each one is coupled with the secure enclave co-processor, touch ID doesn't work anymore. But home button still works, so does the phone encryption, you just can't identify yourself with the fingerprint anymore. If you go and try to add a fingerprint, it behaves like you have a muddy finger and can't scan it. But this ain't an issue since encryption is done by a PIN code first, then fingerprints are used as a more convenient way to unlock. Frankly the device bricking is BS, since the encryption PIN code is still there and unknown to a possible attacker. You just can't use the victims fingerprints to unlock it anymore, or attach a hacked fingerprint reader, because it still won't be able to access the secure enclave to open and get the PIN code.

jeffmould 11y ago

All these comparisons to car warranties, and more specifically how in some countries there may be a question of legality. The U.S. has similar laws that car dealers can't deny warranty coverage because of third party repairs. IANAL, but it would be interesting to see how this translates to phones (or any other similar asset). http://www.consumer.ftc.gov/articles/0138-auto-warranties-routine-maintenance http://www.consumer.ftc.gov/articles/0138-auto-warranties-ro...

ascagnel_ 11y ago
Later updates from Apple have said that they'll replace the touch sensor and other hardware if necessary. I'm curious; although auto makers can't decline warranty coverage, does an "authorized maintenance" shop change the dynamics?

soneil 11y ago

I feel like a hypocrite criticising this one. Security has always been a tradeoff against convenience. I've been, overall, happy that Apple's starting to take the security of personal data on a very losable device seriously. I mean, not to gloss over it. I just got stung €320 for a screen repair, and I won't pretend I'm at all happy with that. But I have to accept we can't have it both ways - if we're demanding tough encryption, we have to accept the inconvenience that comes with it.

lisper 11y ago
The problem here is not so much that the devices are being bricked as the fact that it's coming as a nasty surprise. People needed to be warned about this, and the warning needed to happen before they bought the phone.

arihant 11y ago

This is still not as bad as the newer laptops in which TPM is soldered onto motherboard and the OS won't boot if it's damaged. You can't even get it repaired, even by the manufacturer without getting a brand new motherboard. Hardware level security is important, but one must know that whenever you involve hardware into the equation you must allow for collateral damage. Trusting trust is hard. You can't expect the verifier to verify the security module you got changed from the guy in a basement. Might as well get the OS and kernel from the same guy too. The reason this disables your phone is the same reason you see a red page when using self signed certificates. The guy vetting you isn't vetted himself. Now there is a case to be made that Apple should just show you a warning and let you use the phone. But this isn't about protecting your privacy, this is about protecting privacy of the guy whose phone you found.

Dylan16807 11y ago
How often do you damage a chip on your motherboard? Or need to replace non-capacitor parts on it? This is such a problem because it's stuck to the screen, and people need to replace screens all the time.
- arihant 11y ago
  Out of three things -- thin phone, hardware level security, and cheapness of repairs -- you get to pick two. FWIW, I've lost 2 chromebooks to TPM failure in 18 months.
  - Dylan16807 11y ago
    I was under the impression that it wasn't hard to keep the old module when replacing a screen, just that people hadn't always done it.
- deleted 11y ago
  [deleted]
- ericabiz 11y ago
  This only affects the home button. If you replace the screen and keep your original home button, there is no issue. I co-own a repair shop. We have known about this for a while. We won't replace home buttons for this reason. But we replace hundreds of screens a month with no issues.

lisper 11y ago

Now might be a good time to make a donation to the EFF. https://www.eff.org/issues/right-to-repair https://www.eff.org/issues/right-to-repair

quackerhacker 11y ago

I haven't experience any error 53 codes on the devices I've repaired, but if this is true... Wow! That's really shady of Apple. I'm starting to get the feeling that the moves they're making (like charging for Apple radio [not Apple music], and now disabling phones with unauthorized repairs) is their response to their recent report of declining iPhone sales. Disappointing if this is true that these changes are at the expense of their end users and fans (and I am a fan).

userbinator 11y ago

This seems like a deliberate move by Apple, since they could've put the secure component ("TPM") on the mainboard, where it won't be as easily damaged, instead of the fingerprint reader. It's like an organism whose brain is in one of its appendages instead of its head... Either way, if the skills of the Chinese (and other far-East) reverse-engineers continue to be what they are, I think workarounds will be found soon enough - from what I've seen, the repair people in particular are very resourceful and clever, and come up with "tricks" to fix things that the original manufacturer never even thought about. It's their core business; you can bet they'll spend a ton of effort on figuring out how. Apple's proprietary cable authentication chips have been cloned. The infamous Thinkpad BIOS password has been circumvented. Replacements for ink cartridge authentication chips (seriously) have appeared. There is always a crack. I continue to find it amazing how effective the "security" excuse is; it seems you can get the majority to give up anything if you can turn it into some sort of argument about how it'll make things safer. Who doesn't want to feel safe, even if it ultimately results in society where every little thing you do is controlled by some huge bureaucracy? The old quote on security vs. freedom is so relevant today, but related to what I think will happen, here's a variant on that theme: "I wish for the insecurity that gives us freedom."

singham 11y ago

More reasons for not to be in Apple ecosystem.

once-in-a-while 11y ago

Don't use smart phones. Just don't. It works for me.

KiDD 11y ago

I highly recommend reading up on Apple's Security white paper that details how it all works... https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf

natch 11y ago

What really surprised me, and what most people don't seem to know, is that repairs at an Apple store are way cheaper than third party repairs.

natch 11y ago
Why the downvotes? I got a Macbook Pro repaired recently and the Genius guy took me aside and said I got a great deal because they have a per-model, per-service visit price cap on replacement parts charges for repairs. Meaning that in one visit, you can get your Macbook repaired and replace the screen, the motherboard, the hard drive, the power board, the battery, the keyboard, pretty much the whole thing, and the price (for parts) is capped at around $280 for my particular model. The labor price is not capped but they are good at what they do, so the labor is super fast and ends up being cheap. I had a similar experience with an iPhone repair, where my camera had dust in it. Apparently the best way to do this is a back cover replacement, and the back cover comes with the camera built in. I was pretty scared until I heard the price, which was I think at the time $30, way less than third party vendors charge for this. Again the downvotes, for providing useful information, are really baffling here.

stefek99 11y ago

Has anyone read full Terms and Conditions? I think most of the people clicked / tapped / pressed "AGREE". So here you go.

dghughes 11y ago

The iPhone6 and F-35 share the same problem trying to detect approved or faulty parts. Funny.

mattkrea 11y ago

I'll take it as a positive that there is a good chance if someone tampered with my device my information is still secure.

sneakycr0w 11y ago

I feel for both sides of this. On one hand, as a consumer, I think it's unfair to force users to either buy a new iPhone or do repairs via Apple (do they even do them all?). As a business, I understand how non-Apple repairs can damage a brand.

tristanj 11y ago

I posted this earlier today, but the current article (from bbc.co.uk) does a poor job covering the issue. In summary, Apple iOS uses a validation system to ensure Touch ID sensor is not maliciously replaced or modified. The Touch ID sensor has access to the iPhone Security Enclave, where fingerprint data is kept. A malicious sensor could, hypothetically, steal fingerprints from an iPhone user unknowingly. This could be used to unlock the phone and make purchases through Apple Pay without the owner's permission. To prevent this, Apple uses a validation system whenever the Touch ID sensor is repaired. When iPhone is serviced by an authorised Apple service provider or Apple retail store for changes that affect the touch ID sensor, the validation paring is updated. Third-party repairs to the sensor will not update the pairing, and will fail validation when using Touch ID. This validation error is shown to users as the mysterious "Error 53". If the validation fails, the device will function mostly fine, although with Touch ID disabled. However, the device will be prevented from restoring or updating to a new version. Restoring from backup still works. I'm not too sure why restoring or updating is blocked, but my guess is that they want to prevent malicious software from being uploaded in this process. From the Daily Dot article, if a user encounters this error, Apple's current resolution is a full device replacement. It may be overkill I don't think Apple expected many people to encounter this issue, so it seems reasonable why they chose this option. This is a great security feature for users, and I'm really glad Apple engineers considered this situation. Unfortunately the media is blowing this and leaving crucial details about what's happening and the reasoning behind it. Here is Apple's statement on the matter: We take customer security very seriously and Error 53 is the result of security checks designed to protect our customers. iOS checks that the Touch ID sensor in your iPhone or iPad correctly matches your device's other components. If iOS finds a mismatch, the check fails and Touch ID, including for Apple Pay use, is disabled. This security measure is necessary to protect your device and prevent a fraudulent Touch ID sensor from being used. If a customer encounters Error 53, we encourage them to contact Apple Support.

jdhawk 11y ago
Wouldnt it be more logical to simply disable the Touch Functionality and treat it like a Pre-TouchID button when not replaced by Apple with an OEM part?

sneakycr0w 11y ago

I feel for both sides of this issue. As a consumer I am upset that I am essentially being forced to either buy a new iPhone or do my repair via Apple (do they even do all repairs?). Although, as a business I understand not wanting third party repairs as those can damage your brand if done incorrectly.

dang 11y ago

Url changed from http://www.bbc.com/news/technology-35502030 http://www.bbc.com/news/technology-35502030, which points to this.

remriel 11y ago

Fuck Apple.

remriel 11y ago

Fuck Apple.

skywhopper 11y ago

I think it's utterly reasonable for the device to shut down if it detects what looks like tampering with a high-security component. It's frustrating, sure, and the error message is beyond poor, but the behavior makes sense. It's not about preventing third party repairs. It is unfortunate but true that high levels of security ultimately require trust, and that means that some things we used to take for granted will fall by the wayside. Third party repair of what are now secure components may be one of those things.

stesch 11y ago

Wow, Apple hate like on /r/technology.

aftbit 11y ago

I love the sentence: >He had to pay £270 for a replacement and is furious. He was so furious that he bought a second iPhone which had the same fundamental design decisions and would fail in the same way if he got it repaired by a non-Apple repairer. No wonder Apple doesn't give a damn about this - everyone is just buying a new phone from them.

yason 11y ago

So much for owning something you thought you owned. This has happened again and again, and will increasingly happen in the future under whatever disguise, security-wise or not.

enlightenedfool 11y ago

yet another thing that anti-iphone people rile and iphone users don't care. The bricked owners will buy the next gen iphone and won't repeat the mistake of third party repair. what's the fuss about? yawn...