4 ms·

It is one of the manipulation techniques used to convince people they should trade freedom to use their devices however they want for notion of security. Apple

It is one of the manipulation techniques used to convince people they should trade freedom to use their devices however they want for notion of security. Apple is known for opposing right to repair initiatives and prefer that faulty devices would rather be destroyed than repaired.

gambiting 6y ago
It's an interesting balance though. On one hand I don't want a thief(or anyone) to be able to use my device after it's stolen, it should be literally impossible for anyone to unlock that device, ever. On the other hand, I'm not happy with Apple positioning themselves where they are, aggressively going after independent repair shops and not selling spare parts. Can we have it both ways? I don't know.
- ben-schaaf 6y ago
  Apple have the keys that let them control hardware pairing and firmware updates, you can have those same keys in an open ecosystem with open hardware where you can be in control of those keys. You can absolutely have it both ways.
  - acdha 6y ago
    How do you believe that would work? Do you think the average person is capable of operating a robust PKI management system? I want to like the idea but it seems most likely that this would just mean people having the keys on the device which was stolen (because they don't have redundant storage in a separate location), having a compromise mean that someone now has persistent control of all of your devices, and a spike in the kind of social engineering attacks we saw in the desktop space for decades where someone convinces the user to compromise their security because 99.99% of people using computers do not have the experience needed to understand the security decisions they're being asked to make.
- varispeed 6y ago
  I think people should accept the fact of life that stolen goods will be used one way or another anyway. I think good compromise is to make sure phone reset wipes all data irrecoverably. Rather than fighting the effect, maybe we should address why people steal and why government is ineffective at catching them (but seems to be doing just fine catching students relaxing with a wrong kind of plant)
libertine 6y ago
Now this poses the question - if they made such security claims regarding the T2 chip, and if the T2 is effectively unsecure and unpatchable, are people who have devices with Apple T2 entitled to a refund, or at least compensation? Didn't this become false advertising?
- joosters 6y ago
  Point me at some of this 'false advertising' then, please? No-one (at least, no-one reputable) claims that anything is 100% secure. You'll only hear that a product feature makes it 'more secure'. And that's still (slightly) true, since you could reasonably argue: 1) Even with an exploit, hackers have to do some extra work to bypass the feature. 2) The product was more secure for a time, until the exploit was discovered.
- dahfizz 6y ago
  > Didn't this become false advertising? I don't think this counts as false advertising. "False advertising" is the colloquial phrase but the actual law uses terms like "misleading" or "deceptive": > The FTC Act prohibits unfair or deceptive advertising in any medium. That is, advertising must tell the truth and not mislead consumers. A claim can be misleading if relevant information is left out or if the claim implies something that's not true[1]. So maybe if Apple made some very strong statements to the tune of "This T2 chip will absolutely never ever be hacked, its impossible", that might be misleading. I suspect the Apple legal team is a little more clever than that, though. General marketing fluff like "This car is good, you should buy this car" doesn't count as false advertising if your car breaks down. I think this falls into that category. [1] https://www.ftc.gov/tips-advice/business-center/guidance/advertising-marketing-internet-rules-road https://www.ftc.gov/tips-advice/business-center/guidance/adv...
xoa 6y ago
>It is one of the manipulation techniques used to convince people they should trade freedom to use their devices however they want for notion of security. No, it absolutely is not. It is a 100% genuine trade off, and you are being deceptive out of your own personal interests if you lie and claim it isn't. The ability to do anything necessarily means the ability to do bad things, and the more power is available the more work, knowledge, and metaknowledge is needed to both make full use of it and avoid pitfalls. Software lockdowns prevent power users like the typical HNer from doing useful and valuable things. But they also help ensure that non-power users (who, remember, may anything from doctors to engineers to diplomats to farmers, brilliant experts in their own fields key to society just not in computers) cannot even be social engineered into getting themselves too deep in trouble. And this is obviously, objectively a real problem, and one frankly the tech community brought in part on ourselves with constant "the user is at fault, the user is stupid" stuff for decades. But why SHOULDN'T users just be able to go easily find anything they think looks interesting and give it a whirl, and have a reasonable expectation that it'll meet certain isolation/privacy/payment standards, and if not that it'll get automatically removed and the developer banned? And even for power users, lockdowns can help shift the power balance away from developers and pool user buying power through a point so that devs are forced to obey certain basic standards whether they like it or not. Of course, software lockdowns also destroy valuable innovation, and they create a single point of pressure that is in turn prone to abuse or (likely worse in theory and more prevalent in practice) pressure from even more powerful entities. The likes of China, the EU, or if things go bad enough the US can force censorship onto a vast array of people and devices via iOS in a way that they can't with traditional systems. On the hardware side, lockdowns make repair more difficult/centralized. But they also prevent hardware hacks, and have proven make theft vastly less economic. IMO, I'd like to see a single point, buy-time option to opt for the ability for an owner to load their own root keys for software, hardware, both, or neither. Personally, I'd go for software and not hardware: the devices are very reliable, I'm not a hardware hacker myself and in my own model I'd prefer to run the risk of buying replacement kit rather then even think about hardware subversion. For my parents and grandparents I'd strongly push them to continue with "neither" which should be the default. I'm sure many on HN would like both. Maybe some (particularly in countries where official repairs are much harder) would even prefer to keep the software side of things locked down for malware but as a practical matter allow repairs. But it's intensely frustrating to still see techies who apparently never dealt with family support or Help Desk or whatever in their lives blithely repeat 1990s/early-00s memes about PEBKAC/PICNIC/lusers etc. The BOFH was a ton of fun to read but it's realworld application has limits. I don't feel bad about not being skilled at small engine work, or pharmaceuticals or whatever.
userbinator 6y ago
Indeed, it is always interesting to see these articles that never mention the positive side of these exploits, i.e. enabling freedom. I guess it shouldn't be that much of a surprise, given the authoritarian nature of the security industry (and most big corporations in general, including Apple.)

gambiting 6y ago

It's an interesting balance though. On one hand I don't want a thief(or anyone) to be able to use my device after it's stolen, it should be literally impossible for anyone to unlock that device, ever. On the other hand, I'm not happy with Apple positioning themselves where they are, aggressively going after independent repair shops and not selling spare parts. Can we have it both ways? I don't know.

ben-schaaf 6y ago
Apple have the keys that let them control hardware pairing and firmware updates, you can have those same keys in an open ecosystem with open hardware where you can be in control of those keys. You can absolutely have it both ways.
- acdha 6y ago
  How do you believe that would work? Do you think the average person is capable of operating a robust PKI management system? I want to like the idea but it seems most likely that this would just mean people having the keys on the device which was stolen (because they don't have redundant storage in a separate location), having a compromise mean that someone now has persistent control of all of your devices, and a spike in the kind of social engineering attacks we saw in the desktop space for decades where someone convinces the user to compromise their security because 99.99% of people using computers do not have the experience needed to understand the security decisions they're being asked to make.
varispeed 6y ago
I think people should accept the fact of life that stolen goods will be used one way or another anyway. I think good compromise is to make sure phone reset wipes all data irrecoverably. Rather than fighting the effect, maybe we should address why people steal and why government is ineffective at catching them (but seems to be doing just fine catching students relaxing with a wrong kind of plant)

libertine 6y ago

Now this poses the question - if they made such security claims regarding the T2 chip, and if the T2 is effectively unsecure and unpatchable, are people who have devices with Apple T2 entitled to a refund, or at least compensation? Didn't this become false advertising?

joosters 6y ago
Point me at some of this 'false advertising' then, please? No-one (at least, no-one reputable) claims that anything is 100% secure. You'll only hear that a product feature makes it 'more secure'. And that's still (slightly) true, since you could reasonably argue: 1) Even with an exploit, hackers have to do some extra work to bypass the feature. 2) The product was more secure for a time, until the exploit was discovered.
dahfizz 6y ago
> Didn't this become false advertising? I don't think this counts as false advertising. "False advertising" is the colloquial phrase but the actual law uses terms like "misleading" or "deceptive": > The FTC Act prohibits unfair or deceptive advertising in any medium. That is, advertising must tell the truth and not mislead consumers. A claim can be misleading if relevant information is left out or if the claim implies something that's not true[1]. So maybe if Apple made some very strong statements to the tune of "This T2 chip will absolutely never ever be hacked, its impossible", that might be misleading. I suspect the Apple legal team is a little more clever than that, though. General marketing fluff like "This car is good, you should buy this car" doesn't count as false advertising if your car breaks down. I think this falls into that category. [1] https://www.ftc.gov/tips-advice/business-center/guidance/advertising-marketing-internet-rules-road https://www.ftc.gov/tips-advice/business-center/guidance/adv...

xoa 6y ago

>It is one of the manipulation techniques used to convince people they should trade freedom to use their devices however they want for notion of security. No, it absolutely is not. It is a 100% genuine trade off, and you are being deceptive out of your own personal interests if you lie and claim it isn't. The ability to do anything necessarily means the ability to do bad things, and the more power is available the more work, knowledge, and metaknowledge is needed to both make full use of it and avoid pitfalls. Software lockdowns prevent power users like the typical HNer from doing useful and valuable things. But they also help ensure that non-power users (who, remember, may anything from doctors to engineers to diplomats to farmers, brilliant experts in their own fields key to society just not in computers) cannot even be social engineered into getting themselves too deep in trouble. And this is obviously, objectively a real problem, and one frankly the tech community brought in part on ourselves with constant "the user is at fault, the user is stupid" stuff for decades. But why SHOULDN'T users just be able to go easily find anything they think looks interesting and give it a whirl, and have a reasonable expectation that it'll meet certain isolation/privacy/payment standards, and if not that it'll get automatically removed and the developer banned? And even for power users, lockdowns can help shift the power balance away from developers and pool user buying power through a point so that devs are forced to obey certain basic standards whether they like it or not. Of course, software lockdowns also destroy valuable innovation, and they create a single point of pressure that is in turn prone to abuse or (likely worse in theory and more prevalent in practice) pressure from even more powerful entities. The likes of China, the EU, or if things go bad enough the US can force censorship onto a vast array of people and devices via iOS in a way that they can't with traditional systems. On the hardware side, lockdowns make repair more difficult/centralized. But they also prevent hardware hacks, and have proven make theft vastly less economic. IMO, I'd like to see a single point, buy-time option to opt for the ability for an owner to load their own root keys for software, hardware, both, or neither. Personally, I'd go for software and not hardware: the devices are very reliable, I'm not a hardware hacker myself and in my own model I'd prefer to run the risk of buying replacement kit rather then even think about hardware subversion. For my parents and grandparents I'd strongly push them to continue with "neither" which should be the default. I'm sure many on HN would like both. Maybe some (particularly in countries where official repairs are much harder) would even prefer to keep the software side of things locked down for malware but as a practical matter allow repairs. But it's intensely frustrating to still see techies who apparently never dealt with family support or Help Desk or whatever in their lives blithely repeat 1990s/early-00s memes about PEBKAC/PICNIC/lusers etc. The BOFH was a ton of fun to read but it's realworld application has limits. I don't feel bad about not being skilled at small engine work, or pharmaceuticals or whatever.

userbinator 6y ago

Indeed, it is always interesting to see these articles that never mention the positive side of these exploits, i.e. enabling freedom. I guess it shouldn't be that much of a surprise, given the authoritarian nature of the security industry (and most big corporations in general, including Apple.)