9 ms·
I wonder if this has security implications. The T2 houses the "secure enclave" and that's where your private keys, certificates and passwords are stored.
by bartvk 6y ago
I wonder if this has security implications. The T2 houses the "secure enclave" and that's where your private keys, certificates and passwords are stored.
- harrygeez 6y agoof course. Previously your keys are stored securely in a vault in a security facility but now the doors to the security facility is blown wide open. They still need to figure out the Secure Enclave though, which is no easy feat
- deleted 6y ago[deleted]
- saagarjha 6y agoIt’s been largely figured out already. The actual work is going into A11’s enclave at the moment.
- pvg 6y agoThe things stored in the enclave are encrypted with a key derived from, among other things, your device password so no jailbreak is going to provide access to them. It would be a big deal if one could, say, run 'offline' dictionary attacks against secure enclave content.
- systemvoltage 6y agoSame password results in a different hash if you run it again.
- harrygeez 6y agothat's literally opposite to how hashing works
- DaiPlusPlus 6y ago> run 'offline' dictionary attacks against secure enclave content. Isn't the T2 chip the only reason they can't do that:: because it sets a minimum time-limit and cooldown period on attempts to authenticate using the device passcode? So presumably rooting T2 and removing the artificial time limits and/or extracting KDF data would mean game-over because brute-forcing `[0-9]{4,8}`, with even the most expensive hash function - and with a salted hash - can probably be done on a desktop within a day. ...but why can't we do that today by de-capping the T2 chip and looking at its flash storage with an electron-microscope?
- filleokus 6y agoThe Secure Enclave is just a part of the T2 chip. My understanding is that this is similar to if you jailbreak your iOS device, you won't get any special access to the Secure Enclave. And as I understand it, it's also the Secure Enclave that enforces the attempt limits.
- saagarjha 6y agoThat’s right, but the T2 chip is based on the A10 one and has the same Secure Enclave; this enclave is vulnerable to the blackbird exploit discovered recently.
- Jnr 6y agoDe-capping would probably be much harder than rooting T2.
- sparker72678 6y agoAnd both would be much harder than just holding a gun to someone's head until they give up their password.
- Jnr 6y agoBut only one of those could potentially be stealthy enough so that target would not notice anything.
- poslix97 6y agoI still don't understand why nobody seems to be able to answer the question that everybody would want to know the answer to, which is: Is it possible to get at the encrypted user data of a locked MacBook or not? * Yes or no, please...