17 ms·

> Apple should be lauded for trying to bring their laptop and desktop lines into the same defensive posture as their mobile offerings. I think this can't be st

by Shank 8y ago

> Apple should be lauded for trying to bring their laptop and desktop lines into the same defensive posture as their mobile offerings. I think this can't be stated enough. The fact of the matter is that pre T2, evil maid attacks were ridiculously easy. Now they're at least as secure as iOS -- which also means that shared vulnerabilities can be patched and detected. By no means is it perfect security, but it's a heck of a lot better than "stick boot disk in and gain keys to the kingdom." For so long we've gone by the mantra that physical access means you have root. Now we're a step ahead of that -- which is great for data privacy.

userbinator 8y ago
which is great for data privacy. ...and absolutely horrible for freedom. It used to be the case, and still widely accepted for a lot of other products, that physical ownership actually meant something beyond just being a consumer. Now companies are turning the security against users, lest they also be attackers. From the point of view of the DRM-advocating media corporations, the user is an attacker. Locking down the platform to allow only "trusted" (not by you, but by them!) code only benefits when their goals align with yours; you may agree with them on not wanting things like ransomware, but not on things like them not allowing you to share a file between two apps or even run code you wrote yourself. It's scarier than any security attack to see what used to be an open and free platform turned into a walled garden of corporate control and obedience. (Insert famous Benjamin Franklin quote.)
- scarface74 8y ago
  Tell that to the million of Windows users that have 10 toolbars on their browser, ransomware, etc....
  - LeoNatan25 8y ago
    2001 called, it wants its outdated Windows memes back.
    - scarface74 8y ago
      Yes because there aren’t users that are downloading web extensions that are malware, getting infected with ransomware, and programs that secretly mine crypto currency. My mom was just looking for a printer driver (why are printer drivers even a thing on Windows in 2018?) and ended up with all kind of crap on her computer after going to the first site she saw on Google. A friends mother told me that when she is on her computer she can see someone else controlling it remotely.
- privateSFacct 8y ago
  "It's scarier than any security attack to see what used to be an open and free platform turned into a walled garden of corporate control and obedience." Most users threat posture is around security from adversaries who may gain control of their hardware. That security helps preserve their freedom, to store secrets more safely on the device etc. Users are generally much less concerned with their own ability to hack / boot an alternative OS etc. I suspect very few companies other than Apple will even have a chance of standing up to big gov demands, and even Apple may cave (though they seemed willing to stick to principal even in case of known domestic terrorist shooter which is one of the toughest arguments to make). If you need the freedom to be hacked and to hack your own hardware, consider an android or linux machine.
- xvector 8y ago
  > Now companies are turning the security against users, lest they also be attackers. This has always been the case, has it not? Modern security practices seem to operate under the assumption that the attacker can do almost anything the user can except sniff the password out of the user's head. I think that's a reasonable model to work under. Building a platform that makes it a near-guarantee that the only way to unlock a computer is to be in the user's brain is a commendable security model, and the fact that Apple is executing it so seamlessly (i.e. with minimal user interaction) is honestly incredible. Gone are the days when you need to jump through hoops for security. It's democratized and available to everyone. I would say that this is amazing for freedom. You could ask for little more than for every citizen to have state-of-the-art security. --- Of course, vote with your wallet. If you don't like DRM content, don't get it. If you like the T2 chip and need a new laptop, get a Mac. No one is depriving you of choice, here.
  - extrapickles 8y ago
    They even go beyond the assumption of sniffing passwords from users head on the iPhone. Thanks to the face/fingerprint reader, most people are incapable of divulging their pin/password to someone claiming to be the county password inspector. While in an absolute/legal sense it’s less secure, for day to day use by most people it’s more secure as there is no password for someone to watch you enter, or socialy compel you to give them.
    - isostatic 8y ago
      Don't know about face id, but with finger ID you certainly need to know the pin number for all the cases that finger ID doesn't work. More than that, it's easier for a security guard to point the phone at your face / push your thumb on the sensor than get you to reveal a passcode
      - CharlesW 8y ago
        > Don't know about face id, but with finger ID you certainly need to know the pin number for all the cases that finger ID doesn't work. This is the case with Face ID as well. I use my PIN more with Face ID than I did with Touch ID. > More than that, it's easier for a security guard to point the phone at your face / push your thumb on the sensor than get you to reveal a passcode It's fairly easy to discreetly disable, FWIW. Just "squeeze" your phone for two seconds (i.e. press the power button and either volume button) to disable Face ID. It also won't work if you're looking away or have your eyes closed.
- nneonneo 8y ago
  Please read Apple’s white paper on the security chip: https://www.apple.com/mac/docs/Apple_T2_Security_Chip_Overview.pdf https://www.apple.com/mac/docs/Apple_T2_Security_Chip_Overvi... They provide a setting that lets you disable the boot security at will, allowing you to install Linux or any other alternative OS. Security features on macOS (as opposed to iOS) are generally optional, but enabled by default (as is the sensible choice). They don’t provide you the ability to reprogram the T2 itself, which is a shame but not entirely without merit - compromising the T2 chip would be far more dangerous than compromising the OS in terms of persistence.
  - HankB99 8y ago
    I've read that the T2 chip also provides the mass storage interface and without documentation or drivers, Linux cannot be run from the internal drive. Devices with the T2 chip can be booted and run from USB connections with the security disabled but not an internal drive.
    - nneonneo 8y ago
      Yes, that's unfortunate - the lack of drivers means that Linux devs will once again have to reverse someone's proprietary software to develop their own drivers. It's not a fun state of affairs. Unfortunately, Apple is not likely to start fully supporting Linux on Mac hardware by providing drivers and documentation. But the point here is that they haven't done anything technically to prevent you from running Linux.
      - floatboth 8y ago
        From what I remember, it acts as a "normal" NVMe device and you can just add its PCI ID and see the disk in Linux… but in 10 seconds after that it powers the system off because it detects something like an unauthorized OS. Sounds a bit like prevention.
  - cmurf 8y ago
    Unacceptable. The user must disable Secure Boot to run Linux, which means the system becomes vulnerable to bootkit attacks. And, the typical scenario will be a user who leaves it disabled, making both macOS and Linux and possibly Windows (if also installed) more vulnerable to bootkit attacks. I'm quite sure Microsoft would be willing to provide Apple their UEFI public key, which is what pretty much all Linux shim bootloaders are signed with.
- geofft 8y ago
  > It used to be the case, and still widely accepted for a lot of other products, that physical ownership actually meant something beyond just being a consumer. It still does. The only thing is we've distinguished physical ownership and mere physical possession. It is a feature that if I leave my personal laptop at my desk at work while using the bathroom, my IT department can't rootkit it. It is an improvement to my freedom - both my computing freedom and my physical freedom - if I can leave a laptop in my hotel room while seeing tourist sights. It protects me from the government if a border control agent looking through my bag, or a cop who's seized my laptop, can't get in. (The iPhone is an existence proof that such defense against the government is possible, and it's weird that the usually pro-personal-liberty free software crowd hasn't decided that a free software implementation of the same thing is critically important.) Of course software freedom requires access control. My freedom over my possessions involves other people's lack of freedom over my possessions. I can't make sure my computer is running the code I want it to if everyone else can make my computer run the code they want it to. This control is essential liberty; pretending that anyone with physical access is an owner because it's easier than crypto and key management has been decades of temporary convenience, and I'm glad it's coming to an end. I can turn secure boot on and off with an admin password, which I set when I first booted the machine because that's what demonstrates physical ownership and not mere possession. (And systems that don't permit me to do so, like Microsoft or Apple ARM devices, are in fact an affront to software freedom.) But nobody else can.
  - eikenberry 8y ago
    You can turn it on or off, but if you want to do anything on your own you have to turn it off as your can't sign anything. If they were really giving you what you say they should make signing your own apps as easy as turning it on/off.
    - lisper 8y ago
      This can't be stressed enough. Freedom (indeed "ownership") means that I should be able to run any app I want on my device without having to create an account with Apple. It would be great if I could have both freedom and security, but Apple has decided that is not an option. I have to choose one or the other. I choose freedom.
lern_too_spel 8y ago
> For so long we've gone by the mantra that physical access means you have root. This hasn't been the case for a long time. Chromebooks shipped with "verified boot" since the first consumer hardware in 2011. Windows machines have been shipping with UEFI secure boot, which Apple uses the T2 chip to implement, for the past 6 years.
josteink 8y ago
> I think this can't be stated enough. The fact of the matter is that pre T2, evil maid attacks were ridiculously easy. Factually and objectively wrong. This does nothing for end-user security which wasn’t already solved by UEFI Secure boot half a decade ago. The only difference here is that Apple now insist on owning all the keys, taking away any aspect of end-user freedom which may have been present in the UEFI spec. This is all bad, all regression for the PC-platform and Apple should definitely not be applauded.
- lloeki 8y ago
  > Factually and objectively wrong. This does nothing for end-user security which wasn’t already solved by UEFI Secure boot half a decade ago. UEFI Secure Boot is a noop security-wise if you don't have a TPM to store keys and validate signatures, otherwise it's trivial to bypass. This whole thing implements UEFI Secure Boot, and T2 is the TPM. Secure Boot can be disabled to install Linux, the only difference from before T2 was introduced on Macs being that Linux fails to initialise/access† internal storage behind T2. Using either a pre-signed loader with MOKs in NVRAM or your own signing keys is terribly involved[0][1] and adding keys or disabling SB is not always supported, even on PCs. † For reasons yet unknown which could be any of a) bug in T2, b) lack of hardware support within Linux, c) intentional security measure, d) intentionally crippled feature. Judgement as to whether this is a glitch, undocumented hardware behaviour, or a mischievous scheme is currently impossible and an open question; stating anything one way or the other is currently based purely on personal beliefs, not facts. [0] https://wiki.archlinux.org/index.php/Secure_Boot https://wiki.archlinux.org/index.php/Secure_Boot [1] http://www.rodsbooks.com/efi-bootloaders/secureboot.html#final_disable http://www.rodsbooks.com/efi-bootloaders/secureboot.html#fin...
sys_64738 8y ago
are my back ups encrypted? I can physically get those too.
- CharlesW 8y ago
  That's up to you. The details depend on what you're using to do backups.
admax88q 8y ago
I'm also super excited that the entertainment industry has caught up as well. Before it was ridiculously easy to inject ads and objectionable content into my video streams but thanks to HDCP I never have to worry about that again. It's so much more secure!
vbezhenar 8y ago
How is it different from UEFI secure boot which was on PC for years?

by Shank 8y ago

userbinator 8y ago

which is great for data privacy. ...and absolutely horrible for freedom. It used to be the case, and still widely accepted for a lot of other products, that physical ownership actually meant something beyond just being a consumer. Now companies are turning the security against users, lest they also be attackers. From the point of view of the DRM-advocating media corporations, the user is an attacker. Locking down the platform to allow only "trusted" (not by you, but by them!) code only benefits when their goals align with yours; you may agree with them on not wanting things like ransomware, but not on things like them not allowing you to share a file between two apps or even run code you wrote yourself. It's scarier than any security attack to see what used to be an open and free platform turned into a walled garden of corporate control and obedience. (Insert famous Benjamin Franklin quote.)

scarface74 8y ago
Tell that to the million of Windows users that have 10 toolbars on their browser, ransomware, etc....
- LeoNatan25 8y ago
  2001 called, it wants its outdated Windows memes back.
  - scarface74 8y ago
    Yes because there aren’t users that are downloading web extensions that are malware, getting infected with ransomware, and programs that secretly mine crypto currency. My mom was just looking for a printer driver (why are printer drivers even a thing on Windows in 2018?) and ended up with all kind of crap on her computer after going to the first site she saw on Google. A friends mother told me that when she is on her computer she can see someone else controlling it remotely.
privateSFacct 8y ago
"It's scarier than any security attack to see what used to be an open and free platform turned into a walled garden of corporate control and obedience." Most users threat posture is around security from adversaries who may gain control of their hardware. That security helps preserve their freedom, to store secrets more safely on the device etc. Users are generally much less concerned with their own ability to hack / boot an alternative OS etc. I suspect very few companies other than Apple will even have a chance of standing up to big gov demands, and even Apple may cave (though they seemed willing to stick to principal even in case of known domestic terrorist shooter which is one of the toughest arguments to make). If you need the freedom to be hacked and to hack your own hardware, consider an android or linux machine.
xvector 8y ago
> Now companies are turning the security against users, lest they also be attackers. This has always been the case, has it not? Modern security practices seem to operate under the assumption that the attacker can do almost anything the user can except sniff the password out of the user's head. I think that's a reasonable model to work under. Building a platform that makes it a near-guarantee that the only way to unlock a computer is to be in the user's brain is a commendable security model, and the fact that Apple is executing it so seamlessly (i.e. with minimal user interaction) is honestly incredible. Gone are the days when you need to jump through hoops for security. It's democratized and available to everyone. I would say that this is amazing for freedom. You could ask for little more than for every citizen to have state-of-the-art security. --- Of course, vote with your wallet. If you don't like DRM content, don't get it. If you like the T2 chip and need a new laptop, get a Mac. No one is depriving you of choice, here.
- extrapickles 8y ago
  They even go beyond the assumption of sniffing passwords from users head on the iPhone. Thanks to the face/fingerprint reader, most people are incapable of divulging their pin/password to someone claiming to be the county password inspector. While in an absolute/legal sense it’s less secure, for day to day use by most people it’s more secure as there is no password for someone to watch you enter, or socialy compel you to give them.
  - isostatic 8y ago
    Don't know about face id, but with finger ID you certainly need to know the pin number for all the cases that finger ID doesn't work. More than that, it's easier for a security guard to point the phone at your face / push your thumb on the sensor than get you to reveal a passcode
    - CharlesW 8y ago
      > Don't know about face id, but with finger ID you certainly need to know the pin number for all the cases that finger ID doesn't work. This is the case with Face ID as well. I use my PIN more with Face ID than I did with Touch ID. > More than that, it's easier for a security guard to point the phone at your face / push your thumb on the sensor than get you to reveal a passcode It's fairly easy to discreetly disable, FWIW. Just "squeeze" your phone for two seconds (i.e. press the power button and either volume button) to disable Face ID. It also won't work if you're looking away or have your eyes closed.
nneonneo 8y ago
Please read Apple’s white paper on the security chip: https://www.apple.com/mac/docs/Apple_T2_Security_Chip_Overview.pdf https://www.apple.com/mac/docs/Apple_T2_Security_Chip_Overvi... They provide a setting that lets you disable the boot security at will, allowing you to install Linux or any other alternative OS. Security features on macOS (as opposed to iOS) are generally optional, but enabled by default (as is the sensible choice). They don’t provide you the ability to reprogram the T2 itself, which is a shame but not entirely without merit - compromising the T2 chip would be far more dangerous than compromising the OS in terms of persistence.
- HankB99 8y ago
  I've read that the T2 chip also provides the mass storage interface and without documentation or drivers, Linux cannot be run from the internal drive. Devices with the T2 chip can be booted and run from USB connections with the security disabled but not an internal drive.
  - nneonneo 8y ago
    Yes, that's unfortunate - the lack of drivers means that Linux devs will once again have to reverse someone's proprietary software to develop their own drivers. It's not a fun state of affairs. Unfortunately, Apple is not likely to start fully supporting Linux on Mac hardware by providing drivers and documentation. But the point here is that they haven't done anything technically to prevent you from running Linux.
    - floatboth 8y ago
      From what I remember, it acts as a "normal" NVMe device and you can just add its PCI ID and see the disk in Linux… but in 10 seconds after that it powers the system off because it detects something like an unauthorized OS. Sounds a bit like prevention.
- cmurf 8y ago
  Unacceptable. The user must disable Secure Boot to run Linux, which means the system becomes vulnerable to bootkit attacks. And, the typical scenario will be a user who leaves it disabled, making both macOS and Linux and possibly Windows (if also installed) more vulnerable to bootkit attacks. I'm quite sure Microsoft would be willing to provide Apple their UEFI public key, which is what pretty much all Linux shim bootloaders are signed with.
geofft 8y ago
> It used to be the case, and still widely accepted for a lot of other products, that physical ownership actually meant something beyond just being a consumer. It still does. The only thing is we've distinguished physical ownership and mere physical possession. It is a feature that if I leave my personal laptop at my desk at work while using the bathroom, my IT department can't rootkit it. It is an improvement to my freedom - both my computing freedom and my physical freedom - if I can leave a laptop in my hotel room while seeing tourist sights. It protects me from the government if a border control agent looking through my bag, or a cop who's seized my laptop, can't get in. (The iPhone is an existence proof that such defense against the government is possible, and it's weird that the usually pro-personal-liberty free software crowd hasn't decided that a free software implementation of the same thing is critically important.) Of course software freedom requires access control. My freedom over my possessions involves other people's lack of freedom over my possessions. I can't make sure my computer is running the code I want it to if everyone else can make my computer run the code they want it to. This control is essential liberty; pretending that anyone with physical access is an owner because it's easier than crypto and key management has been decades of temporary convenience, and I'm glad it's coming to an end. I can turn secure boot on and off with an admin password, which I set when I first booted the machine because that's what demonstrates physical ownership and not mere possession. (And systems that don't permit me to do so, like Microsoft or Apple ARM devices, are in fact an affront to software freedom.) But nobody else can.
- eikenberry 8y ago
  You can turn it on or off, but if you want to do anything on your own you have to turn it off as your can't sign anything. If they were really giving you what you say they should make signing your own apps as easy as turning it on/off.
  - lisper 8y ago
    This can't be stressed enough. Freedom (indeed "ownership") means that I should be able to run any app I want on my device without having to create an account with Apple. It would be great if I could have both freedom and security, but Apple has decided that is not an option. I have to choose one or the other. I choose freedom.

lern_too_spel 8y ago

> For so long we've gone by the mantra that physical access means you have root. This hasn't been the case for a long time. Chromebooks shipped with "verified boot" since the first consumer hardware in 2011. Windows machines have been shipping with UEFI secure boot, which Apple uses the T2 chip to implement, for the past 6 years.

josteink 8y ago

> I think this can't be stated enough. The fact of the matter is that pre T2, evil maid attacks were ridiculously easy. Factually and objectively wrong. This does nothing for end-user security which wasn’t already solved by UEFI Secure boot half a decade ago. The only difference here is that Apple now insist on owning all the keys, taking away any aspect of end-user freedom which may have been present in the UEFI spec. This is all bad, all regression for the PC-platform and Apple should definitely not be applauded.

lloeki 8y ago
> Factually and objectively wrong. This does nothing for end-user security which wasn’t already solved by UEFI Secure boot half a decade ago. UEFI Secure Boot is a noop security-wise if you don't have a TPM to store keys and validate signatures, otherwise it's trivial to bypass. This whole thing implements UEFI Secure Boot, and T2 is the TPM. Secure Boot can be disabled to install Linux, the only difference from before T2 was introduced on Macs being that Linux fails to initialise/access† internal storage behind T2. Using either a pre-signed loader with MOKs in NVRAM or your own signing keys is terribly involved[0][1] and adding keys or disabling SB is not always supported, even on PCs. † For reasons yet unknown which could be any of a) bug in T2, b) lack of hardware support within Linux, c) intentional security measure, d) intentionally crippled feature. Judgement as to whether this is a glitch, undocumented hardware behaviour, or a mischievous scheme is currently impossible and an open question; stating anything one way or the other is currently based purely on personal beliefs, not facts. [0] https://wiki.archlinux.org/index.php/Secure_Boot https://wiki.archlinux.org/index.php/Secure_Boot [1] http://www.rodsbooks.com/efi-bootloaders/secureboot.html#final_disable http://www.rodsbooks.com/efi-bootloaders/secureboot.html#fin...

sys_64738 8y ago

are my back ups encrypted? I can physically get those too.

CharlesW 8y ago
That's up to you. The details depend on what you're using to do backups.

admax88q 8y ago

I'm also super excited that the entertainment industry has caught up as well. Before it was ridiculously easy to inject ads and objectionable content into my video streams but thanks to HDCP I never have to worry about that again. It's so much more secure!

vbezhenar 8y ago

How is it different from UEFI secure boot which was on PC for years?