4 ms·

"Recovery" meaning what? When I went to the Genius Bar because my laptop had WiFi issues, they didn't boot from the internal hard drive, they booted from an ex

"Recovery" meaning what? When I went to the Genius Bar because my laptop had WiFi issues, they didn't boot from the internal hard drive, they booted from an external unit that seemed to do way more than just function as a USB-external-HD. If they mean "self-service" recovery, then I don't know that a soldered hard drive is any different from a removable one. It either works or it doesn't, if it does you can recover from a recovery partition... if it doesn't then you can't recover no matter what.

sjm-lbm 8y ago
IIRC, on the 2016 MBP revision, they included a port to be used for data recovery by authorized repair centers. They appear to have removed that port for this revision.
- jonknee 8y ago
  It's encrypted using the T2 chip (with a key that can't be extracted) so I'm not sure what value getting a copy of the SSD would be. The 2016 MBP did not have this encryption.
  - userbinator 8y ago
    with a key that can't be extracted I'm pretty sure it can, just that the methods are (currently) beyond the reach of DIYers. Besides, there's probably easier ways... like tapping into the decrypted data. Like any classic DRM scheme, if you have the key and the algorithm, you can get the content. That does not make it easy, but it can certainly be done with enough effort.
    - jonknee 8y ago
      > I'm pretty sure it can, just that the methods are (currently) beyond the reach of DIYers. That would be very huge news worth many millions of dollars as it's the critical piece of iOS device security.
      - TillE 8y ago
        Haven't people extracted keys from TPM chips with electron microscopes? I don't know if the T2 is fundamentally different in some way which would render it immune to such analysis.
        selectodude 8y ago
        >Haven't people extracted keys from TPM chips with electron microscopes? Once, with one brand, in 2010. And it took 9 months.
        solarkraft 8y ago
        That sounds like much to me, with a 2018 mindset. Is it not pretty easy to read out a chip nowadays, even at low double digit nanometer levels?
      - userbinator 8y ago
        Something "worth many millions of dollars" will most certainly be kept very quiet by the repair industry, since it can provide recurring revenue (until someone else discovers and reports it to Apple) to an otherwise extremely repair-hostile ecosystem. Bug bounties are a one-time deal that otherwise gives no advantage to the reporter, but unlocking services are not. These people are certainly not looking for a pat on the back from Apple or wanting to make its devices more difficult to repair.
        aneidon 8y ago
        You really think the repair industry is the one sitting on that vuln?
        jonknee 8y ago
        Forget the repair industry, this would be NSA level interest. No one is going to repair your computer using the zero day of all zero days.
      - deleted 8y ago
        [deleted]
JohnTHaller 8y ago
Well, if your computer dies, you take the hard drive out and plug it into something else to get your files off of it. Here, your data goes with your computer, it seems. And, if you work with confidential information, just about any issue would make these machines disposable (even within warranty) if your organization is unable to remove the drive containing said confidential information before sending the unit in for repair.
- jdietrich 8y ago
  If you work with confidential information, you should be using strong full-disk encryption. Forget about sending your device for repair - what happens if a device is lost or stolen?
  - JohnTHaller 8y ago
    They are using full-disk encryption. But most organizations also have policy that requires removal of the encrypted disk before sending a device offsite for repairs.

sjm-lbm 8y ago

IIRC, on the 2016 MBP revision, they included a port to be used for data recovery by authorized repair centers. They appear to have removed that port for this revision.

jonknee 8y ago
It's encrypted using the T2 chip (with a key that can't be extracted) so I'm not sure what value getting a copy of the SSD would be. The 2016 MBP did not have this encryption.
- userbinator 8y ago
  with a key that can't be extracted I'm pretty sure it can, just that the methods are (currently) beyond the reach of DIYers. Besides, there's probably easier ways... like tapping into the decrypted data. Like any classic DRM scheme, if you have the key and the algorithm, you can get the content. That does not make it easy, but it can certainly be done with enough effort.
  - jonknee 8y ago
    > I'm pretty sure it can, just that the methods are (currently) beyond the reach of DIYers. That would be very huge news worth many millions of dollars as it's the critical piece of iOS device security.
    - TillE 8y ago
      Haven't people extracted keys from TPM chips with electron microscopes? I don't know if the T2 is fundamentally different in some way which would render it immune to such analysis.
      - selectodude 8y ago
        >Haven't people extracted keys from TPM chips with electron microscopes? Once, with one brand, in 2010. And it took 9 months.
        solarkraft 8y ago
        That sounds like much to me, with a 2018 mindset. Is it not pretty easy to read out a chip nowadays, even at low double digit nanometer levels?
    - userbinator 8y ago
      Something "worth many millions of dollars" will most certainly be kept very quiet by the repair industry, since it can provide recurring revenue (until someone else discovers and reports it to Apple) to an otherwise extremely repair-hostile ecosystem. Bug bounties are a one-time deal that otherwise gives no advantage to the reporter, but unlocking services are not. These people are certainly not looking for a pat on the back from Apple or wanting to make its devices more difficult to repair.
      - aneidon 8y ago
        You really think the repair industry is the one sitting on that vuln?
      - jonknee 8y ago
        Forget the repair industry, this would be NSA level interest. No one is going to repair your computer using the zero day of all zero days.
    - deleted 8y ago
      [deleted]

JohnTHaller 8y ago

Well, if your computer dies, you take the hard drive out and plug it into something else to get your files off of it. Here, your data goes with your computer, it seems. And, if you work with confidential information, just about any issue would make these machines disposable (even within warranty) if your organization is unable to remove the drive containing said confidential information before sending the unit in for repair.

jdietrich 8y ago
If you work with confidential information, you should be using strong full-disk encryption. Forget about sending your device for repair - what happens if a device is lost or stolen?
- JohnTHaller 8y ago
  They are using full-disk encryption. But most organizations also have policy that requires removal of the encrypted disk before sending a device offsite for repairs.