6 ms·

While I'm not disagreeing that this should be possible to (easily) factory reset a device, it also shouldn't be possible for just _anyone_ with physical access

While I'm not disagreeing that this should be possible to (easily) factory reset a device, it also shouldn't be possible for just _anyone_ with physical access to completely reset the device either. Easy resets also mean more interesting to steal

ciupicri 6y ago
Is it that hard to just corrupt the file system?
- tinus_hn 6y ago
  Like iPhones, new Macs are linked to an account and you can’t activate a new installation without access to the account. This is a pretty strong theft deterrent. Of course this only works if you need access to the account to break this link.
  - deleted 6y ago
    [deleted]
aulin 6y ago
we used to say there's no security if you have physical access... any measure to protect physical access vulnerabilities is bound to cause annoyances and limit freedom of what you can do with your own devices sooner or later
elcomet 6y ago
Why though ? If someone wants to harm you, they can damage the hard drive enough so that the data is unreadable if they have physical access.
- superhuzza 6y ago
  So that they can use/sell the stolen Macbook, which is much more common than stealing a Macbook to delete the data.
  - user-the-name 6y ago
    Erasing the drive doesn't let you do this, the Apple ID of the owner is stored elsewhere and you have to log in to restore the machine.
    - superhuzza 6y ago
      This was a response to a comment about a potential feature as described: "Why does the recovery not just have a button called factory reset which unlinks your apple account, deletes the volume and then sets it all up like new." So yes, it currently does not work like that. But such a feature would allow Macbooks to be easily stolen and reused by others.
      - PurpleFoxy 6y ago
        The unlink stage would require your password. The recovery partition requires internet to reinstall already.
        josephg 6y ago
        Yep, just like it does on iPhones - where Apple has a button for this and it’s really easy. I’m sure a lot more iPhones get stolen than laptops every year, and I doubt the factory reset button behind its password prompt makes that any worse.
    - acomjean 6y ago
      The weird thing is that when my partner turned in an old Mac mini to Apple for recycling they wouldn’t do it because her account was still on there and there was a system password. But we couldn’t figure out what they were talking about, we had reinstalled the OS. It’s embeded in there somewhere deep.
      - willstrafach 6y ago
        If it had a T2, that will store the Apple ID.
PurpleFoxy 6y ago
It should just ask for your Apple ID password when you do the reset. It’s not that hard. Honestly it should even be an option within the main OS
- southerntofu 6y ago
  Why, though? Physical access to the hardware should prevent you from accessing existing files (encryption at rest) but should not prevent you from resetting/reusing the device. Does your fridge come with FridgeID? Or a book? Introducing such mechanisms is really hostile to users, especially poorer users of second-hand hardware who have to go through extra (shady) hoops to get a device running just because some rich Silicon Valley start-uppers thought locking hardware down was a feature.
  - lupire 6y ago
    Who is going to walk a away with my fridge? How about my car? Many users appreciate having anti-theft protections on their easy to physically-access devices, and very few need to wipe of the owner's account. It's great that you have a niche use case, but that doesn't make your case the priority over the main use cases.
    - southerntofu 6y ago
      > Who is going to walk a away with my fridge? People would steal your wallet, your jewelry... There's a lot more value to be extracted from a stolen credit card than from a "smart" phone. > It's great that you have a niche use case, but that doesn't make your case the priority over the main use cases. You're taking it the other way around. The common use case for first-world software developers is the niche use case for the rest of the world. In the rest of the world (i.e. the vast majority), who can't afford buying new luxury devices, people are more concerned with getting locked out after forgetting their password (or after their kids changed it) or about acquiring a second-hand device, than about "protecting" their device from thieves. Because this "protection" doesn't protect anything. Once your iPhone is stolen, it's gone. No iCloud lock is going to bring it back, so why prevent other, less-privileged folks from using it when you can't use it? That type of "mine or noone else's" capitalist mentality is actively harming users and destroying the environment https://www.ifixit.com/News/34072/apples-activation-lock-will-make-it-very-difficult-to-refurbish-macs https://www.ifixit.com/News/34072/apples-activation-lock-wil...
southerntofu 6y ago
I strongly disagree with your opinion. For economic reason, i'm using (and supporting many users from my neighborhood of) second-hand hardware. Some systems like Apple's make our life incredibly difficult and most times people will just have to pay a shady phone store to have the device they purchased unlocked, adding 20-30€ to the bill. It's important to note that most people are incredibly gullible when it comes to technology, and they won't hesitate to buy a second-hand iPhone (whether stolen or not) for a few bucks assuming they'll be able to use it, because that's what a phone does, only to find themselves trapped in iCloud lock. Locking devices does not protect users (contrary to encrypting the local storage), and does not deter anyone from stealing. It simply adds one layer of mafia to deal with (iCloud unlock shady companies) when you're just trying to find a second-hand phone.
- deleted 6y ago
  [deleted]
- matthias509 6y ago
  Your statement regarding the lack of deterrence does not match reality. See https://transition.fcc.gov/bureaus/oet/tac/tacdocs/meeting12414/TAC-MDTP-Report-v1.0-FINAL-TAC-version.pdf https://transition.fcc.gov/bureaus/oet/tac/tacdocs/meeting12... "Similar to New York City, San Francisco also provides evidence that mobile device theft prevention technologies work. In 2009, Apple smartphones constituted the vast majority (69%) of smartphones stolen in San Francisco robberies; in the six months after Apple made Activation Lock available, iPhone robberies in San Francisco declined 38%."
- dsabanin 6y ago
  You are not making any sense by saying it does not deter anyone from stealing. Sooner or later everyone will know that buying stolen Apple hardware is meaningless, and without a market to sell into, thiefs will be less interested in stealing it.
- ska 6y ago
  > and does not deter anyone from stealing. This statement appears to be false, which I guess is the entire point. People absolutely should be able to sell a device second hand, so perhaps re-authentication should be easier and more obvious, but making stolen equipment harder to sell is a net win.

ciupicri 6y ago

Is it that hard to just corrupt the file system?

tinus_hn 6y ago
Like iPhones, new Macs are linked to an account and you can’t activate a new installation without access to the account. This is a pretty strong theft deterrent. Of course this only works if you need access to the account to break this link.
- deleted 6y ago
  [deleted]

aulin 6y ago

we used to say there's no security if you have physical access... any measure to protect physical access vulnerabilities is bound to cause annoyances and limit freedom of what you can do with your own devices sooner or later

elcomet 6y ago

Why though ? If someone wants to harm you, they can damage the hard drive enough so that the data is unreadable if they have physical access.

superhuzza 6y ago
So that they can use/sell the stolen Macbook, which is much more common than stealing a Macbook to delete the data.
- user-the-name 6y ago
  Erasing the drive doesn't let you do this, the Apple ID of the owner is stored elsewhere and you have to log in to restore the machine.
  - superhuzza 6y ago
    This was a response to a comment about a potential feature as described: "Why does the recovery not just have a button called factory reset which unlinks your apple account, deletes the volume and then sets it all up like new." So yes, it currently does not work like that. But such a feature would allow Macbooks to be easily stolen and reused by others.
    - PurpleFoxy 6y ago
      The unlink stage would require your password. The recovery partition requires internet to reinstall already.
      - josephg 6y ago
        Yep, just like it does on iPhones - where Apple has a button for this and it’s really easy. I’m sure a lot more iPhones get stolen than laptops every year, and I doubt the factory reset button behind its password prompt makes that any worse.
  - acomjean 6y ago
    The weird thing is that when my partner turned in an old Mac mini to Apple for recycling they wouldn’t do it because her account was still on there and there was a system password. But we couldn’t figure out what they were talking about, we had reinstalled the OS. It’s embeded in there somewhere deep.
    - willstrafach 6y ago
      If it had a T2, that will store the Apple ID.

PurpleFoxy 6y ago

It should just ask for your Apple ID password when you do the reset. It’s not that hard. Honestly it should even be an option within the main OS

southerntofu 6y ago
Why, though? Physical access to the hardware should prevent you from accessing existing files (encryption at rest) but should not prevent you from resetting/reusing the device. Does your fridge come with FridgeID? Or a book? Introducing such mechanisms is really hostile to users, especially poorer users of second-hand hardware who have to go through extra (shady) hoops to get a device running just because some rich Silicon Valley start-uppers thought locking hardware down was a feature.
- lupire 6y ago
  Who is going to walk a away with my fridge? How about my car? Many users appreciate having anti-theft protections on their easy to physically-access devices, and very few need to wipe of the owner's account. It's great that you have a niche use case, but that doesn't make your case the priority over the main use cases.
  - southerntofu 6y ago
    > Who is going to walk a away with my fridge? People would steal your wallet, your jewelry... There's a lot more value to be extracted from a stolen credit card than from a "smart" phone. > It's great that you have a niche use case, but that doesn't make your case the priority over the main use cases. You're taking it the other way around. The common use case for first-world software developers is the niche use case for the rest of the world. In the rest of the world (i.e. the vast majority), who can't afford buying new luxury devices, people are more concerned with getting locked out after forgetting their password (or after their kids changed it) or about acquiring a second-hand device, than about "protecting" their device from thieves. Because this "protection" doesn't protect anything. Once your iPhone is stolen, it's gone. No iCloud lock is going to bring it back, so why prevent other, less-privileged folks from using it when you can't use it? That type of "mine or noone else's" capitalist mentality is actively harming users and destroying the environment https://www.ifixit.com/News/34072/apples-activation-lock-will-make-it-very-difficult-to-refurbish-macs https://www.ifixit.com/News/34072/apples-activation-lock-wil...

southerntofu 6y ago

I strongly disagree with your opinion. For economic reason, i'm using (and supporting many users from my neighborhood of) second-hand hardware. Some systems like Apple's make our life incredibly difficult and most times people will just have to pay a shady phone store to have the device they purchased unlocked, adding 20-30€ to the bill. It's important to note that most people are incredibly gullible when it comes to technology, and they won't hesitate to buy a second-hand iPhone (whether stolen or not) for a few bucks assuming they'll be able to use it, because that's what a phone does, only to find themselves trapped in iCloud lock. Locking devices does not protect users (contrary to encrypting the local storage), and does not deter anyone from stealing. It simply adds one layer of mafia to deal with (iCloud unlock shady companies) when you're just trying to find a second-hand phone.

deleted 6y ago
[deleted]
matthias509 6y ago
Your statement regarding the lack of deterrence does not match reality. See https://transition.fcc.gov/bureaus/oet/tac/tacdocs/meeting12414/TAC-MDTP-Report-v1.0-FINAL-TAC-version.pdf https://transition.fcc.gov/bureaus/oet/tac/tacdocs/meeting12... "Similar to New York City, San Francisco also provides evidence that mobile device theft prevention technologies work. In 2009, Apple smartphones constituted the vast majority (69%) of smartphones stolen in San Francisco robberies; in the six months after Apple made Activation Lock available, iPhone robberies in San Francisco declined 38%."
dsabanin 6y ago
You are not making any sense by saying it does not deter anyone from stealing. Sooner or later everyone will know that buying stolen Apple hardware is meaningless, and without a market to sell into, thiefs will be less interested in stealing it.
ska 6y ago
> and does not deter anyone from stealing. This statement appears to be false, which I guess is the entire point. People absolutely should be able to sell a device second hand, so perhaps re-authentication should be easier and more obvious, but making stolen equipment harder to sell is a net win.