5 ms·

The author himself points out in the article that Apple provides you with the necessary tools to hand Apple support a completely wiped phone as they diagnose yo

The author himself points out in the article that Apple provides you with the necessary tools to hand Apple support a completely wiped phone as they diagnose your issue and then recover it again at home. If his point is simply that this process is inconvenient and the state of the art should be better, then I think it's a pretty weak point. The analogy that a commenter made here about a plumber entering your home is spot on. Like the locks on a door, the security mechanisms Apple has designed are constructed to thwart breaches on a large-scale (governments) and also on a small scale (your snooping family members). Protecting it from people who need to service is it does not seem to fit any of these categories; if you cannot trust the Apple Genius in the store, seems silly that this same person would nonetheless trust the probably dozens of people who handled the device before it was finally placed in its box. And, like the plumber, if you somehow want him in your house and you want him to provide expert advice on how to fix your problem yet you fear that he may do something nefarious in the process, Apple does one better than "keepin' ya eye on him" -- it essentially allows you to strip the house of all of your belongings so the plumber has nothing to look at but the sink. And then it lets you put all your things back in. Seems pretty good to me.

ajmurmann 10y ago
I took his point to be that Apple encourages you to go the insecure route and just trust them instead of teaching their customers good security awareness. Apple doesn't suggest to you to wipe your phone, they tell you to just trust them. A better analogy from the physical world would be a locksmith who tells you to just leave your keys under the door mat for him so that he can come in and do the work when you aren't home.
- ghostly_s 10y ago
  And plenty of people would be willing to make that trade-off on security for convenience. (This is locksmith right? Like...you realize if he actually cared he could get in your house without keys?) Others wouldn't. Depends how sensitive your personal information is; or in the locksmith analogy, to what extent you consider your valuables irreplaceable. Seems kind of silly to expect every layperson to operate to the same security standards as a security professional. My mother does not have credentials to dozens of business systems on her phone; she has pictures of her cats and maybe a credit card account stored somewhere.
  - gonvaled 10y ago
    The locksmith analogy breaks down fast: the locksmith can enter into your house if he really tries, but Apple can not enter into your phone without your help (if it can, it's utterly broken)
    - sangnoir 10y ago
      Remember Apple (the organization, not some random 'Genius') has code that runs as root on all Apple devices and can remotely update that code. > but Apple can not enter into your phone without your help Of course Apple can - that is why the FBI asked them to do just that. Apple won't as a matter of principle, not due to any technological limitation.
      - gonvaled 10y ago
        > Of course Apple can - that is why the FBI asked them to do just that. If they can, it's broken. Do not buy those devices.
        ghostly_s 10y ago
        You are hopelessly naive. Do you have some method for independently verifying Microsoft and Google cannot remotely access their respective consumer OS's that you'd like to share with us?
- threeseed 10y ago
  Your analogy isn't correct. It's more akin to leaving the car keys with the manufacturer when you are getting your car serviced.
  - mastazi 10y ago
    ...with all your personal information (bank info, passwords, etc.) written down on a notebook left on the seat of the car? Then yes, the car analogy works.
    - Tinyyy 10y ago
      And you can choose to take those personal items out.
      - gonvaled 10y ago
        Choice which is not offered to you by Apple. They are neither explaining what it means to give them the unlocked phone nor telling you that you have the option to wipe out the phone before handing it to them. You are supposed to know that beforehand, and they are even discorauging you to consider that there are some issues with handing over an unlocked phone, which means 95% of their userbase are not aware that there are security implications.
jsaxton86 10y ago
I think the author's main point is that Apple's process violates the principle of least privilege. Technicians shouldn't require access to the software in order to repair a hardware problem.
ac29 10y ago
>The author himself points out in the article that Apple provides you with the necessary tools to hand Apple support a completely wiped phone as they diagnose your issue and then recover it again at home. If his point is simply that this process is inconvenient and the state of the art should be better, then I think it's a pretty weak point. An anecdote from a long time Nexus owner: last year my Nexus lost the ability to charge via its USB port. After a short while on the phone with Google (who, contrary to other anecdotes I've read here, does have good customer service in my experience), they overnighted me a brand new phone at no charge. They too provided me instructions on wiping my phone before sending it back, but they also provided me a brand new device without ever having to hand over my old one for evaluation first. It was easy enough to setup the new phone, since my old one had plenty of charge when the new phone arrived the next day. Does Apple do this? Is it a requirement to bring your phone into an Apple store or ship it to get replacement equipment? If they provide similar service as Google gave me, this seems more like a complaint about Apple Stores or their employees, and not Apple.
- tkxxx7 10y ago
  You can call and get a new phone, and send your old phone back in the same box.
pdkl95 10y ago
> plumber Is Apple support bonded and insured, so the risk to the customer is limited? Do they follow a code of ethics[1] that creates requirements to, for example: ...act as a trustworthy and fiduciary agent for each employer or client, shall seek no favors and shall not profit or misuse confidential client or employer information. [1] https://www.aspe.org/codeofethics https://www.aspe.org/codeofethics
- majewsky 10y ago
  This is similar to a fundamental disconnect that I've observed between lawmakers and tech guys. Tech guy: "This process is obviously broken. Any cop could spy on me with this!" Lawmaker: "Oh, don't worry. There's a law forbidding that." I'm under the impression that some lawmakers actually think that a law forbidding snooping will keep snoops out.
gonvaled 10y ago
The Apple Genius should tell the customer: You have two options: either you give me you unlocked iPhone and I, and any of my colleagues, could steal any information from your device, or you backup and wipe the phone before giving it to us. That is, Apple should make very clear what it means giving an unlocked phone to an untrusted third-party - even when that party happens to work for Apple. Let's not forget that, by definition, Apple the company is also an untrusted third-party (not only the Apple employees).
- sangnoir 10y ago
  > Let's not forget that, by definition, Apple the company is also an untrusted third-party Maybe in theory. In practice, the devices trust all software updates signed by Apple's certificates. Who knows what other trusted diagnostic hardware exists 'at the back' referred to in the article.

ajmurmann 10y ago

I took his point to be that Apple encourages you to go the insecure route and just trust them instead of teaching their customers good security awareness. Apple doesn't suggest to you to wipe your phone, they tell you to just trust them. A better analogy from the physical world would be a locksmith who tells you to just leave your keys under the door mat for him so that he can come in and do the work when you aren't home.

ghostly_s 10y ago
And plenty of people would be willing to make that trade-off on security for convenience. (This is locksmith right? Like...you realize if he actually cared he could get in your house without keys?) Others wouldn't. Depends how sensitive your personal information is; or in the locksmith analogy, to what extent you consider your valuables irreplaceable. Seems kind of silly to expect every layperson to operate to the same security standards as a security professional. My mother does not have credentials to dozens of business systems on her phone; she has pictures of her cats and maybe a credit card account stored somewhere.
- gonvaled 10y ago
  The locksmith analogy breaks down fast: the locksmith can enter into your house if he really tries, but Apple can not enter into your phone without your help (if it can, it's utterly broken)
  - sangnoir 10y ago
    Remember Apple (the organization, not some random 'Genius') has code that runs as root on all Apple devices and can remotely update that code. > but Apple can not enter into your phone without your help Of course Apple can - that is why the FBI asked them to do just that. Apple won't as a matter of principle, not due to any technological limitation.
    - gonvaled 10y ago
      > Of course Apple can - that is why the FBI asked them to do just that. If they can, it's broken. Do not buy those devices.
      - ghostly_s 10y ago
        You are hopelessly naive. Do you have some method for independently verifying Microsoft and Google cannot remotely access their respective consumer OS's that you'd like to share with us?
threeseed 10y ago
Your analogy isn't correct. It's more akin to leaving the car keys with the manufacturer when you are getting your car serviced.
- mastazi 10y ago
  ...with all your personal information (bank info, passwords, etc.) written down on a notebook left on the seat of the car? Then yes, the car analogy works.
  - Tinyyy 10y ago
    And you can choose to take those personal items out.
    - gonvaled 10y ago
      Choice which is not offered to you by Apple. They are neither explaining what it means to give them the unlocked phone nor telling you that you have the option to wipe out the phone before handing it to them. You are supposed to know that beforehand, and they are even discorauging you to consider that there are some issues with handing over an unlocked phone, which means 95% of their userbase are not aware that there are security implications.

jsaxton86 10y ago

I think the author's main point is that Apple's process violates the principle of least privilege. Technicians shouldn't require access to the software in order to repair a hardware problem.

ac29 10y ago

>The author himself points out in the article that Apple provides you with the necessary tools to hand Apple support a completely wiped phone as they diagnose your issue and then recover it again at home. If his point is simply that this process is inconvenient and the state of the art should be better, then I think it's a pretty weak point. An anecdote from a long time Nexus owner: last year my Nexus lost the ability to charge via its USB port. After a short while on the phone with Google (who, contrary to other anecdotes I've read here, does have good customer service in my experience), they overnighted me a brand new phone at no charge. They too provided me instructions on wiping my phone before sending it back, but they also provided me a brand new device without ever having to hand over my old one for evaluation first. It was easy enough to setup the new phone, since my old one had plenty of charge when the new phone arrived the next day. Does Apple do this? Is it a requirement to bring your phone into an Apple store or ship it to get replacement equipment? If they provide similar service as Google gave me, this seems more like a complaint about Apple Stores or their employees, and not Apple.

tkxxx7 10y ago
You can call and get a new phone, and send your old phone back in the same box.

pdkl95 10y ago

> plumber Is Apple support bonded and insured, so the risk to the customer is limited? Do they follow a code of ethics[1] that creates requirements to, for example: ...act as a trustworthy and fiduciary agent for each employer or client, shall seek no favors and shall not profit or misuse confidential client or employer information. [1] https://www.aspe.org/codeofethics https://www.aspe.org/codeofethics

majewsky 10y ago
This is similar to a fundamental disconnect that I've observed between lawmakers and tech guys. Tech guy: "This process is obviously broken. Any cop could spy on me with this!" Lawmaker: "Oh, don't worry. There's a law forbidding that." I'm under the impression that some lawmakers actually think that a law forbidding snooping will keep snoops out.

gonvaled 10y ago

The Apple Genius should tell the customer: You have two options: either you give me you unlocked iPhone and I, and any of my colleagues, could steal any information from your device, or you backup and wipe the phone before giving it to us. That is, Apple should make very clear what it means giving an unlocked phone to an untrusted third-party - even when that party happens to work for Apple. Let's not forget that, by definition, Apple the company is also an untrusted third-party (not only the Apple employees).

sangnoir 10y ago
> Let's not forget that, by definition, Apple the company is also an untrusted third-party Maybe in theory. In practice, the devices trust all software updates signed by Apple's certificates. Who knows what other trusted diagnostic hardware exists 'at the back' referred to in the article.