9 ms·
Macs with T2, M1 chips cannot be restored to factory state without Apple
- rStar 6y agoapple no longer makes general purpose computers. they make iphones, and iphones with keyboards. unfortunately, the processor tech seems spectacular from all accounts.
- burnte 6y ago> unfortunately, the processor tech seems spectacular from all accounts. Why is it unfortunate that their CPUs are great?
- rincebrain 6y agoIf a product has no "redeeming features", it does not matter what restrictions are placed on your use of it, people will often not choose to use it. If a product is, however, a leader in a field, then many more people will likely make the tradeoff to use the product and restrict themselves.
- rStar 6y agofurther, apple no longer get’s to portray themselves as a privacy focused company. if I don’t have control over whether or not I can turn my computer on, I have no right to privacy on an apple computer and I have no data security on an apple computer. It’s one thing if it were a feature a user could opt in or even out of, it’s another to be a consequence of sale. apple used to be a computer company, but they got used to the power they have over ios users and decided to downgrade all of their customers to that level of personal determination, freedom. but hey, at least the RIAA and various nation states that have enough sway to boss apple around will be happy with it.
- gruez 6y agoThe key words missing from the title is "without _connection to_ apple". From the original title I assumed that you had to take it to the apple store to reset it or something.
- Keverw 6y agoYeah, that's what I was thinking from the title too. I guess it's because of the activation lock feature, no different than a iPhone or iPad.
- Zenst 6y agoWhich is good from the aspect that if your device is stolen or lost, the finder/thief just can't factory reset it and use it.
- fastball 6y agoWhich is exactly why they do it. Actual customers that buy lots of Apple products and have appreciated how every year iPhones get more and more pointless to steal have been asking for the same for their laptops for years.
- usrusr 6y agoWell, one could solve that just as well with a device that is fully open to the owner and still pointless to steal. By handing out a per-device master reset key that the owner doesn't need for regular operation and thus doesn't have with the device when and where someone might want to steal it.
- spease 6y agoThey could, but open source has a poor track record of making an easy solution for something this comprehensive that a regular user can set up.
- tomjen3 6y agoIf you don't have to use them regularly then people will misplace them.
- imtringued 6y agoApple can still offer an internet based factory reset in addition to the offline factory reset.
- RcouF1uZ4gsC 6y agoAt this time, I feel a 100% offline, airgapped environment is something of a niche. The way Apple has things set up, likely work better for the average consumer. Apple is omakase, not a la crate. They have made decisions that they think are best for their consumers, and they are not trying to be all things to everyone. That has the advantage that if you are in Apple’s target audience, you get a very nice, polished system. If not, you are free to use many of the various other computers that are available.
- userbinator 6y agoThey have made decisions that they think are best for extracting profit from their consumers. Apple is no different from any other company in its unsatiable appetite for profit --- only its marketing has been vastly more successful. If not, you are free to use many of the various other computers that are available. The problem is others who think emulating Apple's path will also ensure success, which eventually means no real choice.
- CyberRabbi 6y agoCalling Apple “omakase” is a very classy analogy. Never heard that before, makes a lot of sense. Did you make that up? Just perfect.
- RcouF1uZ4gsC 6y ago> Did you make that up? I stole the analogy from this article talking about Rails and applied it to Apple. https://dhh.dk/2012/rails-is-omakase.html https://dhh.dk/2012/rails-is-omakase.html
- CyberRabbi 6y agoOh I should have known it was from DHH. Really talented and smart guy.
- FullyFunctional 6y agoExtended this tangent, the conventional expression for this is "opinionated", but same idea.
- paultopia 6y agoairgapped systems that never touch the internet, such as: [...] SCIFs, or other secure/offline data processing facilities It seems to me that if you were buying hardware for a totally airgapped system for a SCIF or something, you wouldn't buy a computer with built-in wifi or bluetooth at all. I mean, really? Does the NSA buy consumer hardware with network interfaces they don't intend to use?
- Keverw 6y agoI would think air gapped networks probably ran Linux. But I know I heard once some nuclear power uses Windows, looks like that's in Japan. Kind of doubt people are using Macs in that sort of environment, other than maybe a client machine. Feel like it's either going to be Windows or Linux for more industrial stuff.
- Skunkleton 6y agoAir gapped computers run whatever. I've not personally seen MacOS though I wouldn't be surprised. There is a fair bit of secret mobile development, and that requires MacOS.
- roywiggins 6y agoNuclear subs run (or ran) Windows XP. https://www.popularmechanics.com/military/weapons/a19061/britains-doomsday-subs-run-windows-xp https://www.popularmechanics.com/military/weapons/a19061/bri...
- angry_octet 6y agoPlenty of exploit dev systems running in SCIFs! You would want you exploit accidentally collected by the manufacturer, and you certainly don't want binary hashes linked to a device.
- bebop 6y agoNo, in fact you cannot have device that does radio transmission in a SCIF.
- 6y ago
- dehrmann 6y agoWhen I read rumors about the new Magsafe leading to the removal of all ports on the iPhone, I had my doubts because the lightning port is the only reasonable way to restore the device after a bad update. Maybe Apple's not too concerned with this...
- numpad0 6y agoContactless USB-compatible dock is not impossible
- angulardragon03 6y agoThey could also implement some kind of diagnostic port, not unlike what already exists on the Apple Watch https://www.macrumors.com/2015/04/23/apple-watch-diagnostic-port-confirmed/ https://www.macrumors.com/2015/04/23/apple-watch-diagnostic-...
- conradev 6y ago> This means that macs, even the recent Intel ones, are now entirely unsuitable for certain critically important industrial applications For "secure/offline data processing facilities" or "systems that must maintain cryptographic integrity", why would a closed source operating system even be considered in the first place? I don't think this is a good use case for a Mac.
- Spooky23 6y agoOpen source doesn’t solve that problem. I would hope that critical crypto functions aren’t using OpenSSL for example.
- deleted 6y ago[deleted]
- CyberRabbi 6y agoWhenever apple decides to shutdown the service that activates this hardware, many of these wiped computers will no longer be operational which won’t be great for future retro computer collectors and computer historians. Lots of ppl still run their Commodore 64, amigas, and even original Macs. JCS is even doing a whole video series on programming on the original Mac.
- userbinator 6y agoIt doesn't even have to be old enough to qualify as "retro"; it gives Apple enough power to basically remotely kill off its products at any time. They are already hostile enough to right-to-repair and third-party replacements as it is.
- CyberRabbi 6y agoYea I agree, retro is a subjective term. Just meant in the context of computer collectors. A lot of apples latest computers lack the “collectibility” factor, they feel like total junk scrap in 10 years. Which is especially interesting because they usually do such a good job of making their new computers seem like holy grail immaculate gems. I distinctly remember the first intel MacBooks looking very high end and high tech, now they look like total garbage.
- davesmylie 6y agoThis is the real story here. There's already tons of instances of devices becoming worthless because some remote service coming to an end. (Like all remote services eventually must). There should be more regulations around this
- floatboth 6y agoBy the time Apple decides to shut it down (this would be like the end of the Mac era completely) there should be enough jailbreaks and hardware exploits to make the machines usable again.
- nix23 6y ago>Commodore 64 Yes two years ago i was visiting a wood-workshop, the cnc machine was powered by a C64 in production since 30 years, just the power-brick had to be exchanged 2 times ;)
- Wowfunhappy 6y agoWow, this is extremely unfortunate. And I'm pretty surprised it's the first I'm hearing about it, given that T2 chips have been out for a while. Is this true even if the OS is installed to an external hard disk, such as a USB drive? That's not a great solution of course, but perhaps a partial one?
- pram 6y agoHe's talking about Apple Configurator and yes, it connects to Apple to download the T2 firmware automatically: https://support.apple.com/guide/apple-configurator-2/revive-an-intel-based-mac-apdebea5be51/mac https://support.apple.com/guide/apple-configurator-2/revive-... "You may need to configure your web proxy or firewall ports to allow all network traffic from Apple devices to Apple’s network 17.0.0.0/8."
- ec109685 6y agoMuch of the attack vector the author focuses on is pinpointing a user who is restoring their system by their IP address and sending down a poison payload. One way to counteract that is to send this traffic through a Layer 3 proxy. That will obfuscate the true source of the system that is making these reset requests (at least it will mask the IP — not sure if there are other unique identifiers sent along the wire).
- nieve 6y agoIf there were no other unique identifiers for a machine how would they be able to create a key that's specific to it? If they can't create a specifc key the entire thing is just for show and it's certainly not with iOS devices.
- ec109685 6y agoRight good point. I meant something that would reveal the environment where the machine was running in versus the serial number or something similar. Basically, my only real point was that at least the IP address can be hidden from Apple.
- osy 6y agoUnpopular opinion but I like that if someone steals my MacBook, it’s impossible for them to factory reset it unless they get a BootROM exploit or even use it if they don’t have an early boot exploit. If there’s a way to “turn this off” then thieves would be able to use that mechanism to bypass the activation lock. If you want 100% total control, then don’t buy Apple.
- fy20 6y agoThere has been something in place that can achieve this for a while. I had a MacBook Air stolen in 2014, and got it back a few months later with everything intact. I had a BIOS (or whatever the Mac equivalent is) password set, so without some serious work (more than the average thief) it was impossible to reset the machine. I also had the disk encrypted, so even if they managed to bypass that they wouldn't be able to access my data.
- Normille 6y ago>I had a BIOS (or whatever the Mac equivalent is) password set, I think you're referring to the Open Firmware Password, which can be set to prevent the computer booting from an external drive or booting from a swapped internal drive, without first entering this password
- jbirer 6y agoMy new unethical service is cracking "locked" Macbooks with the T2 chip using Checkm8. I am being paid 100$ per unlock by some people who I do not care where they bring the Macs from. I am not sure if the security chips are a solution as long as there is some sort of security hole to break them. Now if they had a BIOS that only started with the recognition of the owner's fingertip on the other hand...
- tored 6y agoWhat we see now is that companies like Apple, and other hardware & software manufacturers as well, is transforming into service companies, you are de facto renting the system you have purchased. Service companies in other sectors, like social media, is actively banning their customers when the customer in some way is not following the service contract. I predict this will be the next logical evolution, customers will be banned from their purchased hardware.
- epicureanideal 6y agoIt may be a one-in-a-million risk, but I don't like the idea that if some disaster strikes and takes out industrial civilization, at some point we could have perfectly good laptops that are no better than bricks because they can't talk to Apple over the internet...
- dannymx 6y agoI'd be more worried about other things if a disaster big enough takes out civilization than trying to clean wipe a Macbook.
- epicureanideal 6y agoIt might be that we need those machines for some practical purpose.
- ec109685 6y agoThe laptop will work until it needs to be wiped and reset.
- ulisesrmzroche 6y agoYou have reached Peak HN.
- epicureanideal 6y agoAfter the fall of the Roman Empire, technology that could survive in decentralized state survived. That’s why this occurs to me.
- ulisesrmzroche 6y agoSo the collapse of industrial civilization brought by a cataclysmic disaster will not only leave electricity and telecommunications intact but also require a working laptop Huh
- 6y ago
- wmf 6y agoThis is a great example of the divergence between "military-grade" security and real world security. Most people will never "fully wipe, zero out, and then boot from cryptographically verified (locally, on other high assurance systems) boot media" so Apple's restrictions aren't a problem. But Apple's anti-theft system does benefit normal people.
- __jf__ 6y agoThese 2 worlds increasingly overlap. For example the collateral damage of the 2017 NotPetya cyberattack made tens of multinational companies disclose material impact to their P/L. The retaliatory DDoS attacks following the Iran sanctions in 2012 had a big impact on banks worldwide. Based on these cherry-picked examples you could even say that the real world increasingly needs protection from military-policical fall-out.
- wmf 6y agoHow many companies are running air-gapped due to cybercrime/cyberwar? Probably none. Apple's "online" approach to security is actually stronger if you're going to be online anyway.
- RavlaAlvar 6y agoThe T2 chip has utterly failed its purpose. It doesn’t seems to stop any dedicated actor (government or any security company) to crack someone’s phone, all it does is hampering the right of repairing and brings troubles to power users.
- Tepix 6y agoThe theft prevention/deterrent seems to work ok, doesn't it?
- rStar 6y agono, locked machines are stripped or sold for parts. there’s no reason for this other than institutional control of users, while furthering apples overall corporate mantra of planned obsolescence.
- Tepix 6y agoThe fact that they can't bypass the system tells me it is working as intended. Also the data on the encrypted SSDs remains safe.
- thesuperbigfrog 6y agoApple may sell you a computer, but ultimately you do not control it. Who really controls your computer: https://youtu.be/Ag1AKIl_2GM?t=57 https://youtu.be/Ag1AKIl_2GM?t=57
- nicholasbraker 6y agoIf your use case is what the author describes then why consider Apple products anyway? Your threat model (whatever this is) defines your choice of hard- and software, not the other way around. Apple doesn't care its products don't fit 0,5% of all the use cases. There are other products and mitigations (TEMPEST anyone?) for that
- Normille 6y ago>If your use case is what the author describes then why consider Apple products anyway?... I was wondering that too. For someone so declaredly privacy conscious and suspicious of Apple's motives, he sure does seem to throw a lot of money their way: https://sneak.berlin/20170107/current-daily-carry/ https://sneak.berlin/20170107/current-daily-carry/
- deleted 6y ago[deleted]
- pcdoodle 6y agoWe used to fix about 80% of the apple products coming in for recycling around 5 years ago by swapping parts and sending them back into action. Now it's mostly scrap waist that ends up in a land fill.
- tomjen3 6y agoIf you need to do something like what the author does, you should not use a mac in the first place, but use a 100% open source machine that is put together from different parts from different shops and put in a Faraday cage.
- TheRealDunkirk 6y agoWhat's the alternative? It's not Windows, or anything else running on Intel-based boards. A Raspberry Pi running Linux?