5 ms·

Caring about privacy or not giving the customer a choice - these are two very different things.

danShumway 8y ago
Hardware encryption isn't really something you can turn on or off though, right? You can look at something like the headphone jack and say, "adding a jack doesn't prevent anyone from using wireless headphones." But if they get rid of the chip, then it does prevent people from using it. Short of selling two separate models with different configs, is there any way they could allow the customer to choose?
- willtim 8y ago
  Why not provide the customer with a recovery key? Microsoft Bitlocker is able to do this and uses hardware-based encryption.
  - pvg 8y ago
    Filevault generates recovery keys.
  - dogma1138 8y ago
    TPM isn’t adversary resistant, these modules are easily accessible over the IC2 bus and can be compromised there is plenty of research to support that. With Bitlocker unless you backup the recovery key in the cloud or manually there is no way to recover it unless you are going to attempt to compromise the TPM this is no different than FileVault/TimeMachine backups which do exactly that however with the added assurance that at least at the writing of this comment the T2 chip cannot be easily compromised or accesses outside of normal operating parameters.
- dvfjsdhgfv 8y ago
  > Hardware encryption isn't really something you can turn on or off though, right? Why? This is something completely up to the manufacturer. As for forcing HW encryption of hard drives, other companies already tried (WD My Book Duo) and it didn't land well with users.
  - jonknee 8y ago
    Luckily Apple has loads of experience with hardware encryption of iPhones and it seems like they land pretty damn well with users. Almost no one knew previous models had this recovery feature and almost no one will actually care that the new ones don't. Make a backup of data you want to keep in case of hardware failure, don't rely on any magic from a vendor.
    - Mindwipe 8y ago
      > Almost no one knew previous models had this recovery feature and almost no one will actually care that the new ones don't. Until their Macbook dies and they take it to Apple for servicing. At which point they'll care a lot. I'd hate to be an Apple Genius. They don't half get thrown under the bus by corporate decisions sometimes.
      - jonknee 8y ago
        > Until their Macbook dies and they take it to Apple for servicing. At which point they'll care a lot. The iPhone outsells the MacBook by more than 10 to 1 and works exactly the same way. I think they'll be OK.
        slededit 8y ago
        The iPhone is primarily a consumption device. People generally don't have their iPhones crash losing months of work due to the client in a few days.
        jonknee 8y ago
        Good luck telling that to the parent that just lost all the pics of their child... If you can lose months of work due to a client and haven't backed it up you do not deserve to have any clients.
        slededit 8y ago
- dingo_bat 8y ago
  Don't have to sell different configs. Just a checkbox in the settings should be enough.
  - saagarjha 8y ago
    How many users would be technically competent enough to understand what the consequences of that checkbox is?
    - dingo_bat 8y ago
      Irrelevant. Those who understand can use it.
      - lozf 8y ago
        But then you're in the territory of "unsafe defaults", as have been discussed elsewhere.
- annabellish 8y ago
  I don't see any technical reason why your encryption/decryption route couldn't sustain one branch. You're doing it in hardware, there's not going to be a performance decrease from it, though there would be a slight increase in chip complexity. Apple have taken the decision here that abandoning the ability to recover data from failed machines is worth the guaranteed security floor of it not being possible to disable strong encryption, and honestly I find it hard to disagree.
- rsynnott 8y ago
  I think you actually can turn it off (or at least you can with the iMac Pro, which uses the same mechanism).
  - dvfjsdhgfv 8y ago
    ...in which case the removed port could come in handy.
- Mindwipe 8y ago
  They could offer to let the user backup the key from the T2 chip to iCloud (and put the port back). Obviously if you're worried about nation state attackers you wouldn't want to do that in a million years. But if your primary threat model is that you're an average boring home user suffering data loss because you don't backup and dropped coffee on your Macbook it would be a solution.
  - mattnewton 8y ago
    I think their buisiness model is instead to back up your files to iCloud, not the hard drive key. Which also protects drive losses like theft and drive failure, and is generally useful for people with multiple machines. They justify charging you a iCloud service fee for this better user experience. From apple’s perspective, hardrive encryption keys aren’t something the average user is going to care about, but files are. The fact that this drives iCloud storage is probably a happy accident ;)
    - eridius 8y ago
      Apple doesn't offer iCloud backup for Macs, only for iOS devices. Apple's backup solution for Macs is Time Machine, which backs up to a local destination (either another drive attached to the machine or a NAS).

Hardware encryption isn't really something you can turn on or off though, right? You can look at something like the headphone jack and say, "adding a jack doesn't prevent anyone from using wireless headphones." But if they get rid of the chip, then it does prevent people from using it. Short of selling two separate models with different configs, is there any way they could allow the customer to choose?

willtim 8y ago
Why not provide the customer with a recovery key? Microsoft Bitlocker is able to do this and uses hardware-based encryption.
- pvg 8y ago
  Filevault generates recovery keys.
- dogma1138 8y ago
  TPM isn’t adversary resistant, these modules are easily accessible over the IC2 bus and can be compromised there is plenty of research to support that. With Bitlocker unless you backup the recovery key in the cloud or manually there is no way to recover it unless you are going to attempt to compromise the TPM this is no different than FileVault/TimeMachine backups which do exactly that however with the added assurance that at least at the writing of this comment the T2 chip cannot be easily compromised or accesses outside of normal operating parameters.
dvfjsdhgfv 8y ago
> Hardware encryption isn't really something you can turn on or off though, right? Why? This is something completely up to the manufacturer. As for forcing HW encryption of hard drives, other companies already tried (WD My Book Duo) and it didn't land well with users.
- jonknee 8y ago
  Luckily Apple has loads of experience with hardware encryption of iPhones and it seems like they land pretty damn well with users. Almost no one knew previous models had this recovery feature and almost no one will actually care that the new ones don't. Make a backup of data you want to keep in case of hardware failure, don't rely on any magic from a vendor.
  - Mindwipe 8y ago
    > Almost no one knew previous models had this recovery feature and almost no one will actually care that the new ones don't. Until their Macbook dies and they take it to Apple for servicing. At which point they'll care a lot. I'd hate to be an Apple Genius. They don't half get thrown under the bus by corporate decisions sometimes.
    - jonknee 8y ago
      > Until their Macbook dies and they take it to Apple for servicing. At which point they'll care a lot. The iPhone outsells the MacBook by more than 10 to 1 and works exactly the same way. I think they'll be OK.
      - slededit 8y ago
        The iPhone is primarily a consumption device. People generally don't have their iPhones crash losing months of work due to the client in a few days.
        jonknee 8y ago
        Good luck telling that to the parent that just lost all the pics of their child... If you can lose months of work due to a client and haven't backed it up you do not deserve to have any clients.
        slededit 8y ago
dingo_bat 8y ago
Don't have to sell different configs. Just a checkbox in the settings should be enough.
- saagarjha 8y ago
  How many users would be technically competent enough to understand what the consequences of that checkbox is?
  - dingo_bat 8y ago
    Irrelevant. Those who understand can use it.
    - lozf 8y ago
      But then you're in the territory of "unsafe defaults", as have been discussed elsewhere.
annabellish 8y ago
I don't see any technical reason why your encryption/decryption route couldn't sustain one branch. You're doing it in hardware, there's not going to be a performance decrease from it, though there would be a slight increase in chip complexity. Apple have taken the decision here that abandoning the ability to recover data from failed machines is worth the guaranteed security floor of it not being possible to disable strong encryption, and honestly I find it hard to disagree.
rsynnott 8y ago
I think you actually can turn it off (or at least you can with the iMac Pro, which uses the same mechanism).
- dvfjsdhgfv 8y ago
  ...in which case the removed port could come in handy.
Mindwipe 8y ago
They could offer to let the user backup the key from the T2 chip to iCloud (and put the port back). Obviously if you're worried about nation state attackers you wouldn't want to do that in a million years. But if your primary threat model is that you're an average boring home user suffering data loss because you don't backup and dropped coffee on your Macbook it would be a solution.
- mattnewton 8y ago
  I think their buisiness model is instead to back up your files to iCloud, not the hard drive key. Which also protects drive losses like theft and drive failure, and is generally useful for people with multiple machines. They justify charging you a iCloud service fee for this better user experience. From apple’s perspective, hardrive encryption keys aren’t something the average user is going to care about, but files are. The fact that this drives iCloud storage is probably a happy accident ;)
  - eridius 8y ago
    Apple doesn't offer iCloud backup for Macs, only for iOS devices. Apple's backup solution for Macs is Time Machine, which backs up to a local destination (either another drive attached to the machine or a NAS).