12 ms·
Intel driven MacBook Pros have secondary ARM processor for Touch ID and security
- okket 10y agoSee also: https://news.ycombinator.com/item?id=12814655 https://news.ycombinator.com/item?id=12814655 And: http://arstechnica.com/apple/2016/10/15-hours-with-the-13-macbook-pro-and-how-apples-t1-bridges-arm-and-intel/ http://arstechnica.com/apple/2016/10/15-hours-with-the-13-ma...
- denzil_correa 10y agoWired has an interesting and in-depth article on this. Also, the camera seems to have more security than earlier. > In the MacBook, the Secure Enclave is part of Apple’s new T1 processor, meaning it’s tied explicitly to the touch bar and Touch ID. It’s also, though, in charge of your webcam, a small but important difference. > “In previous generations of Macbook the webcam light was software controlled—which meant that an attacker who compromised your OS could potentially activate the camera without turning on the light,” says Johns Hopkins University cryptography expert Matthew Green. “Adding a separate secure processor could make this much harder to do.” https://www.wired.com/2016/10/macbook-pro-touch-id-secure-enclave/ https://www.wired.com/2016/10/macbook-pro-touch-id-secure-en...
- revelation 10y agoOr, you know, spare one of the trillion transistors to switch power to 1) camera and 2) LED. There, solved. No full-powered ARM needed to control an indicator light.
- denzil_correa 10y agoThe ARM was not bought to power the LED, it was bought in for TouchID. The camera LED is the icing, not the cake.
- krastanov 10y agoThey have a point though. Why would there be any software that controls the LED? Is it not more secure to have it hooked up directly to the camera power line and turn them both on and off inseparably?
- a2tech 10y agoPost 2013? that's exactly how it was hooked up.
- eropple 10y agoI write a piece of malware that pops the camera on long enough to snap a single frame and then turn back off. The LED blinks, quite possibly too fast for you to notice. OTOH, you can delay the LED and have it very noticeably on for a second or two when it's software-controlled.
- krastanov 10y agoGood point, but then why not implement the delay in immutable (and trivial and cheap) hardware? Is this not both simpler and more secure?
- eropple 10y agoI guess, yeah, you could do it in hardware. But I don't think, then, it ends up being directly connected to the power feed for the camera itself, yeah? You start creating false-status cases. (This is speculation; I am not an electronics wizard.)
- nitrogen 10y agoPower->delay off circuit->LED. Seems pretty direct to me. The delay off circuit would probably have its own connection to power as well.
- out_of_protocol 10y ago
- johnm1019 10y agoI'm guessing it's not that simple because there may be situations when the camera has power and is capturing an image (think hot-standby) but is not transmitting image data to the world outside the sensor package.
- adrianN 10y agoI don't want my camera to capture pictures without the LED being on, ever.
- vigilant 10y agoAnd what if I turn on the camera for a tenth of a second, take a picture, and turn it off. You won't notice the LED being on for a tenth of a second. Software makes it easier to prevent such things.
- CapacitorSet 10y agoWhy not both? It is trivial to make a circuit such that the LED is on if either there is power to the camera, or the software tells you to.
- halflings 10y agoI would guess you could do the same with a circuit, even if that means you lose on flexibility (but given the concerns of many users, I'd say it's worthy).
- TillE 10y agoYou definitely don't need software to add a little delay for turning off the LED, but sure, it would be slightly more complicated than just a dang wire.
- GuiA 10y agoJust wrote a test app on macOS that initializes the camera, gets the first video frame, and turns it off. You definitely notice the bright green LED being on for a split second.
- samfisher83 10y agoWhy not just have a hard switch to cut the power to the camera. It is pretty low tech. Would be hard to hack without flipping the switch. No way camera could operate without power.
- jws 10y agoA physical power switch would take more volume in the computer than the camera itself and would have a failure rate at least an order of magnitude higher than the camera. Things which people physically operate need to be physically more robust than electronic components on a circuit board.
- joecool1029 10y agoYo dawg. I heard you like ARMs, so we put an ARM on your ARM. https://github.com/patjak/bcwc_pcie/wiki/Specification---Features https://github.com/patjak/bcwc_pcie/wiki/Specification---Fea... ^^ did everyone already miss that the webcam was an entire SoC and not just a sensor hooked up to UVC?
- revelation 10y agoHence why you power-cycle the thing.
- joecool1029 10y agoWhat? How is that supposed to help anything. It's not like you can physically disconnect the webcam without disassembling the panel. The crazy part is you don't even know if it's still recording with the entire laptop off. Could it not, in theory, draw power off the main battery independent of the system being on? It certainly should be able to while in sleep mode.
- revelation 10y agoBefore we shrinked transistors to a mere atoms wide their main purpose was in switching power. And no, it's not connected to the main battery, because presumably it runs on 3.3V and maybe even some more exotic voltages for the image sensor. That needs to be regulated.
- ginko 10y agoNot really that surprising. Your average laptop nowadays probably has more ARM cores than x86 cores. They're in all kinds of peripherials like wifi controllers, power supplies, harddisk controllers, GPU job control, heck even AMD's recent APUs come with an integrated Cortex-A5.[1] ARM cores are everywhere, people just don't know about it. [1]http://www.anandtech.com/show/6007/amd-2013-apus-to-include-arm-cortexa5-processor-for-trustzone-capabilities http://www.anandtech.com/show/6007/amd-2013-apus-to-include-...
- walterbell 10y agoWhat is the AMD equivalent of Intel's open-source tboot for trusted execution, to take advantage of ARM TrustZone on an AMD processor?
- userbinator 10y agoLaptops have what is known as an "embedded controller" to handle peripherals like keyboard/touchpad, power management, and fan control. Most of them seem to be low-power 8/16-bit MCUs like 8051 and H8S, but I wouldn't be surprised if newer ones use ARM too. ...and don't forget Intel ME, which is not ARM but another processor in the system.
- aexaey 10y agoMost Chromebooks have embedded controller running on ARM specifically. https://www.chromium.org/chromium-os/ec-development https://www.chromium.org/chromium-os/ec-development
- StringyBob 10y agoSystem-on-chips (most big chips these days) are so complex they usually have the same thing one level deeper: On chip embedded controllers, often an mcu. You might find that 'one arm chip' has many independent arm cpu cores carrying out different functions mostly completely hidden from end user behind firmware or rom
- makomk 10y ago
- revelation 10y agoWho cares, now the LED is connected to the "secure enclave" ARM, previously it was connected to the SMC ARM. The point is: no frikken ARM should control the LED.
- denzil_correa 10y agoEarlier, it was software controlled. Now, it is not. Isn't that a good thing?
- userbinator 10y agoIt is still software controlled; by software on a separate processor, and which is far harder to access than before. I'm not sure if that's a good thing.
- denzil_correa 10y agoWhy not?
- userbinator 10y agoThe basic idea is that this is an area of the system that even you as the owner cannot inspect, but I'll let others do the bulk of the explaining: https://www.gnu.org/philosophy/right-to-read.en.html https://www.gnu.org/philosophy/right-to-read.en.html http://boingboing.net/2012/08/23/civilwar.html http://boingboing.net/2012/08/23/civilwar.html http://boingboing.net/2012/01/10/lockdown.html http://boingboing.net/2012/01/10/lockdown.html
- tptacek 10y agoIt's interesting to me that you feel this way. Do you also object to the Secure Enclave architecture on the iPhone?
- userbinator 10y ago
- krastanov 10y agoAny idea whether this secure enclave will work if you are running Linux? (I like the hardware, but I am more used to the Linux/GNU/gnome software)
- cm3 10y agoGiven that iSight and Facetime HD cameras required drivers and firmware to get running under Linux, I would be positively surprised if the new camera is easier to set up, meaning I don't think it works right now. Even the existing camera support isn't 100%, with features like suspend/resume being flaky, all due to it being reverse engineered. That said, the options for developer laptops has shifted in favor of general x86 computers, including very light-weight machines and ones with mechanical keyboards. If I want to use Linux on it, my first choice wouldn't be a macbook. So, unless you require macos for work, you have have a more diverse variety of laptops to find one that suites you best.
- krastanov 10y agoSure, but the laptops you describe do not have secure enclave. If I want that level of security on Linux what can I do?
- johncolanduoni 10y agoWhat would the enclave do for you if you're running an OS that doesn't support Apple Pay or Touch ID?
- Zoon 10y agoIt is used for the camera too.
- cm3 10y agoOn Thinkpads you can disable the routing of signals of the mic and camera in the firmware. Afterwards, it's not available to the kernel. Whether that's somehow hackable via a UEFI bug I don't know, but there are also laptops with physical switches the mic, wifi and a lid for the camera. Your safest bet is to open it up and disconnect the device, which is less likely to raise alarms on Linux and BSD than it is under macos, I assume.
- fowlerpower 10y agoThe one thing I will say is even though Apple's software quality lately has taken a hit. Their commitment to security has only gotten stronger. The secure enclave, hardware level security, all of the things that came up with the FBI request have become a self serving prophecy for them. I applaud them for this and it looks like the MacBook Pro is going to be one of the most secure laptops around. Nothing is perfect of course. Even though I applaud them for this I am still pissed about the headphone jack.
- shawkinaw 10y agoYou mean the headphone jack that is still there?
- ludwigschubert 10y ago...and on the wrong side. ;-)
- wlesieutre 10y agoAs a lefty, I'm looking forward to not having the headphone cable dangling across my papers area. Suck it, righties! It's your turn to be slightly inconvenienced!
- TillE 10y agoBut...lots of headphones only connect on the left side, and run the connection for the right earphone along the headband. I'm pretty sure it's always left or both, never right. Putting the jack on the right really screws that up, even for lefties!
- wlesieutre 10y agoThat's fine, it can loop around the back and run along the left edge of the computer. Better than having to stick straight out there.
- 10y ago
- userbinator 10y agoThough transmission of data is handled by the main processor, Apple Pay dialogs on screen are completely rendered by the T1 to take advantage of the Secure Enclave, a portion of the chip set aside for personal information just as it is in iPhones and Apple Watch devices. That sounds similar in concept to Intel ME, another "secure" coprocessor that can do a lot of other things that the more paranoid are freaking out over... It also makes me wonder if these MacBook Pros also have Intel ME.
- a-no-n 10y agoAnd my car has a jet engine because flames come out the back when I floor it. No touchscreen, no serious advances; only designer-first churn and imposing clunky acce$$orie$. Apple, in the computer industry, is chopped, unless radical, turnaround action is taken immediately. Sales of iPhone are also down because of lackluster improvements and declining value-for-dollar. Three straight quarters of revenue decline, the worst since Sculley.
- misnome 10y ago> acce$$orie$. Apple, in the computer industry, I'm sure this will be completely true, unlike every single other 'prediction' ever made without qualification, in their entire history, made every single time they release a new product. Substituting dollars for 's' also makes the writer even more respectable and objective, just like writing 'Microsoft' with dollars.
- oDot 10y agoQuick question -- what's so good about ARM specifically? Aren't there other minimal architectures, maybe even one with lower/no licensing costs?
- deafcalculus 10y agodeveloper tools, operating system and software ecosystem, probably other IPs (like GPUs) integrate well with ARM but that might not be the case for a brand new processor, and a history of success (selling processor IP is enterprise sales).
- r00fus 10y agoIn short: it's not Intel. Longer: Intel has continually sucked at mobile (likely due to innovator's dilemma and it's love-hate relationship with Microsoft which also sucks at mobile), and this may mean a stronger shift by Apple to integration with it's priorities (security, iOS/WatchOS friendliness, better battery life).
- mianos 10y agoThey already have a lot of in house expertise in ARM. It could even just run their existing watch OS, enabling everything that already has such as display drivers, tools, firmware updates and boot system.
- oct29_goat 10y agoI believe MIPS is cheaper for the average Joe to license, but Apple is already an ARM licensee with high volume so they probably get a hot deal. Also they already have ARM IP and >20 years experience integrating it. Besides, ARM is a fine architecture and it's popular these days, so why not?
- drawkbox 10y agoARM processors are the best at low power and this allows longer battery life [1]. [1] http://www.androidauthority.com/arms-secret-recipe-for-power-efficient-processing-409850/ http://www.androidauthority.com/arms-secret-recipe-for-power...
- djrogers 10y ago
- godmodus 10y agothat's nice dear. insert grandma gif here how about more RAM, tho?
- rasz_pl 10y agoCan we expect Error 53 after you spill something on the keyboard destroying Touch strip = and computer stops booting .. but you have important data on SSD that is now SOLDERED permanently to the motherboard, and Apple doesnt offer data recovery (only logic board swap at a low low price of $2/3 whole computer) so only option is independent repair shop?
- petersellers 10y ago>SSD that is now SOLDERED permanently to the motherboard Citation needed.
- Eric_WVGG 10y agoThe SSD on the new non-Touch Bar laptop has been confirmed to have a removable/replaceable SSD. The SSDs on the 2013-2015 Macbook Pros also had removable SSDs, so there’s little reason to believe the Touch Bar MBPs won’t either.
- 4ad 10y agoPeople who claim that every computer is full of microcontrollers are missing the point. This is not a microcontroller, it's full SoC running (more or less) the same kernel used on the main CPU. It's more similar to the LOM and IPMI systems found on server computers rather than anything else.
- ttul 10y agoI think it's a pity that the Touch Bar was not designed with a dedicated area that can only be rendered by the T1 processor directly. If that were the case, then network services could communicate directly with the user via the Touch Bar, authenticating themselves with cryptography that cannot be broken by anything running on the main system processor. This would have provided a truly trusted mechanism for apps to communicate with the user. For instance, your bank could authenticate itself with you via the Touch Bar.. If the Touch Bar display is controlled from the host OS, then malware could pretend to be your bank, on the Touch Bar.
- walterbell 10y agoApple's demo showed payee name being rendered on the right side of the Touch Bar, https://www.wired.com/wp-content/uploads/2016/10/Gallery_TouchPay-1-1024x768.jpg https://www.wired.com/wp-content/uploads/2016/10/Gallery_Tou... Ars claims that the rightmost 608 pixels ("Control Strip") of the Touch Bar are reserved for Apple, http://arstechnica.com/apple/2016/10/15-hours-with-the-13-macbook-pro-and-how-apples-t1-bridges-arm-and-intel http://arstechnica.com/apple/2016/10/15-hours-with-the-13-ma...
- marklyon 10y agoBut that would complicate using it as a screen for displaying ads.
- visarga 10y agoAdBlock problem solved! Just get everyone to use keyboards that have dedicated ad screens embedded inside.
- mcguire 10y ago"The T1 also sends pixels to the Touch Bar though the MacBook’s main processor is what actually renders that content which is then sent over." I am a bit worried about the author. Is Matthew having a stroke?
- tekacs 10y agoThat's a valid (albeit awkward) sentence. The T1 also sends pixels to the Touch Bar, although the MacBook's main processor is what actually does the rendering for said pixels (which are sent).
- memracom 10y agoYou mean that they are using a tried and proven architecture that helped the 4.77 MHz IBM PC find success in 1982? Yawn.... The IBM PC keyboard had its own Z-80 CPU way back then and likely every single PC of any sort since then has done this. And then there are the disk controller CPUs. Wasn't that introduced around 1984?
- whyenot 10y agoDo you have any further information on this? Having opened up an IBM PC keyboard, and knowing that Z80 CPUs were still fairly expensive in 1982, I'm a little surprised.
- kps 10y agoIntel 8048. [edit: citation needed? http://classiccomputers.info/down/IBM/IBM_PC_5150/IBM_5150_Technical_Reference_6025005_AUG81.pdf http://classiccomputers.info/down/IBM/IBM_PC_5150/IBM_5150_T...]
- jwatte 10y agoAnd the battery has a MCU for charge management, and the trackpad, and the keyboard, and ...
- aq3cn 10y agoTouch ID, security + Apple pay. To keep the cash flowing and replace banks.
- samsonradu 10y agoTbh I really see this might happen. They have internationally widespread devices (unlike banks which don t usually operate in too many countries) they have superior technology, much easier for clients to use and also a better reputation than plenty of banks. Then the remaining issue is regulations, can they solve it? Would an european country back up < 100k deposits for Apple? :)
- aq3cn 10y agoThey want to be monopoly by entering in our home as an IoT devices, pocket as a smart phone, desk as a laptop, office as a desktop, road as a car, wallet as a digital credit card etc. They still have not entered inside our toilet. I guess most people can see the problem and their potential as our next dictator.