8 ms·
The summary here is the T2 chip provides custom hardware encryption for the SSD, which makes recovery impossible (and so they removed the data recovery port bec
by eridius 8y ago
The summary here is the T2 chip provides custom hardware encryption for the SSD, which makes recovery impossible (and so they removed the data recovery port because what's the point in having it?).
So remember, backups are important!
- mattnewton 8y agoAlso a reminder that apple really does seem to care about privacy, in ways the average user isn’t likely to understand / appreciate.
- dvfjsdhgfv 8y agoCaring about privacy or not giving the customer a choice - these are two very different things.
- danShumway 8y agoHardware encryption isn't really something you can turn on or off though, right? You can look at something like the headphone jack and say, "adding a jack doesn't prevent anyone from using wireless headphones." But if they get rid of the chip, then it does prevent people from using it. Short of selling two separate models with different configs, is there any way they could allow the customer to choose?
- willtim 8y agoWhy not provide the customer with a recovery key? Microsoft Bitlocker is able to do this and uses hardware-based encryption.
- pvg 8y agoFilevault generates recovery keys.
- dogma1138 8y agoTPM isn’t adversary resistant, these modules are easily accessible over the IC2 bus and can be compromised there is plenty of research to support that. With Bitlocker unless you backup the recovery key in the cloud or manually there is no way to recover it unless you are going to attempt to compromise the TPM this is no different than FileVault/TimeMachine backups which do exactly that however with the added assurance that at least at the writing of this comment the T2 chip cannot be easily compromised or accesses outside of normal operating parameters.
- dvfjsdhgfv 8y ago> Hardware encryption isn't really something you can turn on or off though, right? Why? This is something completely up to the manufacturer. As for forcing HW encryption of hard drives, other companies already tried (WD My Book Duo) and it didn't land well with users.
- jonknee 8y agoLuckily Apple has loads of experience with hardware encryption of iPhones and it seems like they land pretty damn well with users. Almost no one knew previous models had this recovery feature and almost no one will actually care that the new ones don't. Make a backup of data you want to keep in case of hardware failure, don't rely on any magic from a vendor.
- Mindwipe 8y ago> Almost no one knew previous models had this recovery feature and almost no one will actually care that the new ones don't. Until their Macbook dies and they take it to Apple for servicing. At which point they'll care a lot. I'd hate to be an Apple Genius. They don't half get thrown under the bus by corporate decisions sometimes.
- jonknee 8y ago> Until their Macbook dies and they take it to Apple for servicing. At which point they'll care a lot. The iPhone outsells the MacBook by more than 10 to 1 and works exactly the same way. I think they'll be OK.
- dingo_bat 8y agoDon't have to sell different configs. Just a checkbox in the settings should be enough.
- annabellish 8y agoI don't see any technical reason why your encryption/decryption route couldn't sustain one branch. You're doing it in hardware, there's not going to be a performance decrease from it, though there would be a slight increase in chip complexity. Apple have taken the decision here that abandoning the ability to recover data from failed machines is worth the guaranteed security floor of it not being possible to disable strong encryption, and honestly I find it hard to disagree.
- rsynnott 8y agoI think you actually can turn it off (or at least you can with the iMac Pro, which uses the same mechanism).
- dvfjsdhgfv 8y ago...in which case the removed port could come in handy.
- Mindwipe 8y agoThey could offer to let the user backup the key from the T2 chip to iCloud (and put the port back). Obviously if you're worried about nation state attackers you wouldn't want to do that in a million years. But if your primary threat model is that you're an average boring home user suffering data loss because you don't backup and dropped coffee on your Macbook it would be a solution.
- mattnewton 8y agoI think their buisiness model is instead to back up your files to iCloud, not the hard drive key. Which also protects drive losses like theft and drive failure, and is generally useful for people with multiple machines. They justify charging you a iCloud service fee for this better user experience. From apple’s perspective, hardrive encryption keys aren’t something the average user is going to care about, but files are. The fact that this drives iCloud storage is probably a happy accident ;)
- eridius 8y agoApple doesn't offer iCloud backup for Macs, only for iOS devices. Apple's backup solution for Macs is Time Machine, which backs up to a local destination (either another drive attached to the machine or a NAS).
- maaaats 8y agoHow is this privacy? I would expect to be able to copy out my encrypted data (still encrypted). Not being able to do so is not a privacy feature.
- dogma1138 8y agoYou can copy the data you cannot extract the encryption key it’s not any different than an iPhone if you don’t have backups you are screwed. This is privacy in fact prettty strong one, like with any security measure usability and availability may suffer however it’s on you to mitigate those risks by leveraging backups which on OSX is fairly easy to do so with time machine, FileVault and cloud backups which are also encrypted. If Apple can not offer a recovery service it is also likely that most adversaries will not be able to recover the data which is a pretty darn good thing to have.
- vertwo128 8y agoThey are definitely better than other companies, but if they truly cared about privacy, they would let us download apps without signing up for an Apple ID. Or at the very least, not require a full name and physical address for one.
- scarface74 8y agoThere is nothing stopping you from using any email address, a fake physical address, and a prepaid debit card for iTunes.
- dahdum 8y agoIIRC, the physical address is required for tax compliance.
- gamblor956 8y agoTotal BS. Apple only needs country-level address for tax compliance as local jurisdictions (states, cities, etc.) aren't allowed to impose their own taxes on digital sales anywhere.
- eridius 8y agoEven assuming that's true, the laws could change and the moment they do, Apple would need to comply with the tax laws. If Apple doesn't collect anything more than country-level location, and states start imposing taxes on digital sales, then Apple would have no way to comply with the law.
- dahdum 8y agoDoesn't look true right now, tax jar has an article showing digital services differing in taxation by state. https://blog.taxjar.com/sales-tax-digital-products/ https://blog.taxjar.com/sales-tax-digital-products/
- acchow 8y agoHow would you verify the country someone enters is actually true? We normally do this by riding the credit card rails....which requires the full address...
- sametmax 8y agoYou mean they opted out of PRISM (or whatever is the equivalent today) ? They disable as much as ME on their intel components as they can ? They don't promote the use of a unique ID linked to a remote account to use their hardware ?
- alerighi 8y agoThe T2 chip for what I understand it's a proprietary CPU that executes proprietary software, how can you consider that secure ? It's not different from the Intel ME in that sense, just another secondary processor that have access to all the hardware on the computer and that runs code that the user cannot control. Also for a security prospective it's not good, the main principle of cryptography is that the only secret to decrypt something should reside in the user, not in the obscurity of the algorithm or the hardware, so a perfect encryption is an encryption where when you turn on you laptop you have to insert a 30 character strong password that only you know, like LUKS on Linux, no obscure hardware, no proprietary software. The laptop broke, take out the SSD, put it in another Linux computer, insert you secret password, and recover the data. This system is NOT secure, if someone finds a flaw that permits to extract the key from the T2 chip, and it's only a matter of time and resources before someone does it, your data is no more protected, they can decrypt and extract what they want. We must not consider secure every encryption system that doesn't depend on a secret that only the user knows.
- jsjohnst 8y ago> This system is NOT secure Let me tell you a secret, there is nothing truly secure in the world. Only things which haven’t had a vulnerability found for it. > It's not different from the Intel ME The important sense that matters is Intel ME has been found vulnerable (highly vulnerable in fact). The T2 hasn’t. Should we be skeptical of black boxes, most assuredly! But calling it equivalent to something found to be flawed in serious ways is a bit premature at best, or grossly negligent at worse. > the main principle of cryptography is that the only secret to decrypt something should reside in the user I don’t know about you, but the “main principle of cryptography” is to prevent unauthorized parties from knowing the contents of the data to me. I guess we are allowed to make up any statement that furthers our cause though when that suits us. > if someone finds a flaw that permits to extract the key from the T2 chip, and it's only a matter of time and resources before someone does it, your data is no more protected, they can decrypt and extract what they want Your password is part of the process, the extra stuff done in the T2 is just that, extra. So extracting from the T2 gives you nothing without the user’s password, needed to unlock the secret encryption key for the drive (assuming FileVault is enabled[0], and if you didn’t enable it, then why do you have an expectation of security at all?). [0] https://support.apple.com/en-us/HT208344 https://support.apple.com/en-us/HT208344
- chrisper 8y agoIt's literally the same thing as TPM. If your mobo dies you won't be able to recover either if you don't have a recovery key.