4 ms·

> If any 3rd party can repair something like biometric hardware, any 3rd party could also compromise said hardware. As pointed out in the article, you have to

• xoa 7y ago
  >As pointed out in the article, you have to trust any third party you hire. This isn't unique to electronics. But the whole point is what about 3rd parties I don't hire? The point of "right to repair", at least in the formulations I've seen so far, is that the manufacturer must offer privileges to any 3rd party to perform repairs. How well though will all those 3rd parties that can now perform repairs verify that it is, in fact, the owner that does it? How does the owner really verify things? In the real world amongst normal people, how well can it really be expected vs the first party, which is the one with the most easily understood incentives? As I said in my original post, I do not oppose people that want to be able to grant 3rd parties the right to repair. But I also want to make sure that, like right now, owners can also forbid anyone from having the cryptographic rights to alter their device hardware except the original manufacturer. As-in, even if it's stolen from them or they later decide they "want" to give permission (which isn't distinguishable from a social engineering attack). That's why I propose make it a build-to-order option, with some small external identifier the case. I don't simply want Apple or whomever to be forced to give keys away to any that ask. >Just don't take your electronics to unreputable service centers. This is a very shallow snobbish tech elite answer, and the same one our whole industry gave (and in many cases still gives) to people when it came to malware and the like. "Oh, just don't go to disreputable websites. Don't go installing software willy-nilly. Haha dumb lusers, PEBKAC." And then Apple came along and offered something different, the shocking concept that maybe it shouldn't be regular users' fault, that they're not fundamentally stupid, that why shouldn't they just be able to browser anywhere and install absolutely anything that catches their eye and never have to deal with any long lasting unknown effects? Even when Apple's execution has failed, the fundamental question there has been pretty successful. Of course, Apple has also destroyed a lot of valuable freedoms along the way, many of them unnecessarily I think. They clearly also have cross incentives to misuse their control, and have. But I can't help but think that a lot of that is our fault, our industries fault, for not trying to find a better balance of answers and making it standard long, long before the iPhone.
  • Reelin 7y ago
    > But the whole point is what about 3rd parties I don't hire? What exactly is the threat model you're trying to protect against here? Real life isn't a Hollywood spy movie. If you didn't hire them, then how do they have your device and why haven't you noticed that it's missing? Granted that a robust hardware based anti-theft solution would be nice to have. That's largely unrelated to the current topic though, provided that it's implemented in a reasonable manner. > or they later decide they "want" to give permission (which isn't distinguishable from a social engineering attack) This is the classic argument that users are too stupid to be provided freedom. Outside of technology, this is typically recognized as authoritarian. > > Just don't take your electronics to unreputable service centers. > This is a very shallow snobbish tech elite answer No, it's literally a practical answer. Just take your device to Best Buy or the local equivalent. Reputation is literally how the entire market manages to function on a day to day basis. Tech isn't even slightly unique in this regard. My point here is that a local brick and mortar repair shop has invested a significant amount of capital to set up their operation, so they presumably care about their reputation. Furthermore, committing crimes under such an arrangement would be ill advised due to how easily they could be tied back to the responsible party. In contrast, the malicious web site or software example you bring up isn't even remotely comparable. In your example the bad actor exists outside of the local legal jurisdiction, the "storefront" is cheap and easy to set up (ie there's a low barrier to entry), and the responsible party can't be easily tracked down. Low risk, high reward, and a low barrier to entry. Coupled with inexperienced users this is a recipe for disaster, and indeed malware still shows up on even well curated app stores from time to time.