12 ms·

I've experienced that repair shops ask "and your password and username is?", many times when handing over my laptop - and i'm always like "what, no i'm not givi

I've experienced that repair shops ask "and your password and username is?", many times when handing over my laptop - and i'm always like "what, no i'm not giving you my password" resulting in them looking surprised. Who the on earth gives their passwords, also all laptops should be encrypted by default. I find it absurd to give away the keys to your bank, search history, personal notes, images, whatever - it's beyond private and personal besides being economically dangerous and very bad job security wise for most jobs. Not blaming regular people though, but it's weird that people are so lax about giving the keys to absolutely everything.

Sebb767 5y ago
I feel this is a bit like popping your hood at the car shop, but taking your key with you. I can absolutely see why repair shops would want to verify that a) it's not a software problem and b) everything still works fine afterwards, both of which is hard w/o the password. Sure, you can send in a wiped device or a device without hard drive - and if you can do so yourself, this is probably fine. But for the "average" user it's quite likely a better experience, assuming you can trust the repair shop - but then again, they have full access to your hardware plus the knowledge and time to permanently bug your device. If you really don't trust them, you probably should not give them your device at all. I can see the issue here and I'd probably err on the side of privacy given the choice, but the other side has a point.
- baby 5y ago
  They can do this from a guest account. Full disk encryption will protect your data.
  - Sebb767 5y ago
    No, it won't. They could simply put in a different BIOS chip, which records you password the next time you enter it. Or a malicious RAM chip that injects a virus at runtime and extract your data that way. Or a bugged keyboard that transmits your key presses, combined with a full copy of your disk ... Sure, it's a bit more sophisticated than Ctrl+C/Ctrl+V. But if you're running a computer repair shop, it is quite likely that you have a good amount of technical knowledge. If someone has hardware access, you can usually see your device as compromised - especially if they have a lot of time and are expected to open up the device.
    - lorenzhs 5y ago
      If that's your threat model, you should not be using any repair shop. And the attacks you describe are not just "a bit more sophisticated than Ctrl+C/Ctrl+V", they're most likely far beyond the abilities of most repair technicians.
      - Sebb767 5y ago
        > If that's your threat model, you should not be using any repair shop. That's exactly what I said in my first comment: >> If you really don't trust them, you probably should not give them your device at all. > And the attacks you describe are not just "a bit more sophisticated than Ctrl+C/Ctrl+V", they're most likely far beyond the abilities of most repair technicians. The RAM one, yes. ROM chip swaps, on the other hand, are rather common. You will need to be able to solder quite well, but given the current state of macs, this is basically a given for anyone doing repairs on them. You'd of course need to get a malicious ROM chip, which might not be so easy, but probably doable - the technician only needs to be able to swap it, not to manufacture one. And if you can't get your hands on one - your can order a keylogger right now, for just a few bucks! [0] This was just the first result; if you invest a bit more time, you can surely find a smaller one or more fitting one. The keyboard is probably connected with USB [1], so no trouble there. As a bonus, you get all the passwords of accounts that were not saved at the time. Sure, simply unlocking is a bit easier. But it's not like this stuff is beyond anyone who is able to debug and solder on a Mac. [0] https://de.aliexpress.com/item/1005001988834597.html https://de.aliexpress.com/item/1005001988834597.html? [1] It's in my laptops; I don't know the specifics for macs, but I doubt is something more sophisticated than a strange plug.
        Talanes 5y ago
        There are levels of trust. "Trust not to source and install malicious hardware in order to potentially steal unknown to them data" is a magnitude apart from "Trust not to go snooping around through unprotected photo albums."
- hammock 5y ago
  >I feel this is a bit like popping your hood at the car shop, but taking your key with you. Do you leave all your valuables in the car when you drop it off at the shop? Or do you take them out first?
  - Sebb767 5y ago
    Well, the protection strategy for my valuables is not "leave the car locked in the shop". And then there's that one customer who's "rattle" is something in the glove compartment, to extend the metaphor further. So, in keeping with my points above, I would probably move the really valuable stuff out, but for some customers taking everything out will prevent the technician from removing the issue (and they will probably be blamed for it) and if I feel the need to completely get everything saved out of the car beforehand, I would not trust that shop with my car, either.
    - Krasnol 5y ago
      Let's not water the analogy down so far that it loses all connections to the current case. I doubt anyone would leave an album with their nude pictures in the car hoping that the mechanic wouldn't do anything with it. Like...posting it all over the block where the customer lives.
  - bee_rider 5y ago
    For once I think a car analogy is actually useful. But, in this analogy, "taking all your valuables out of the car" would be like removing all the important documents from the computer. Which would be a reasonable thing to do, I guess, if the computer shop really needed access to do the repairs that they need to do. Another possibility -- maybe the computer is so borked that you can't even log on to remove your important documents. This seems more like calling somebody because your key broke in the lock... which... I guess most people would stick around? It is a little bit of a mismatch, because it is a quick fix and it isn't like you can go anywhere anyway.
    - dheera 5y ago
      Also, people from the general public don't know how to write random bits to a drive. Deleting files doesn't actually wipe the information, it just marks the space as available on the OS. Repair agents could still take an image of the drive and recover many of those secret documents. It should be standard procedure in the repair world to hand the hard drive to the user to take home and keep only the PC for servicing.
- LorenPechtel 5y ago
  This. Protecting data is practical for those of us sufficiently technically literate, but I've helped a fair number of people over the years that certainly would not be capable of doing it. (Admittedly, selection bias--the people who are asking for software help aren't the most technically knowledgeable.)
caymanjim 5y ago
There's a US-nationwide chain called "ubreakifix". I brought my Pixel phone there to have a broken screen replaced, and they wanted my passcode. I told them they were insane, and they acted as if I was the first person who ever declined. I can't believe they even ask, especially when there's no need for it whatsoever for a screen replacement.
- miketery 5y ago
  Similar thing for me, was best buy about 4 years ago in NYC. Handed an iPhone for. screen replacement. They wanted a password. Them: "what's your password" Me: "I'm not giving that to you" Them: "We'll have to wipe your phone then" Me: "Fine by me" Me: pickup phone next day, screen fixed all data still there
- schoolornot 5y ago
  Opposite experience here w/ two uBreakiFix stores and a Pixel 3. Neither time I was asked to provide the PIN. The first time I asked and they gave me a strong "no". No factory wipe, etc.
  - lkbm 5y ago
    Same. I've had them replace phone screens for me multiple times--both in Austin and Atlanta--and neither location asked for the PIN nor reset my phone.
- waheoo 5y ago
  The usual reasoning behind this is to confirm the phone is properly functioning before opening it up. Lots of people try to scam repair shops bringing broken phones in. On top of that repairs can often break fingerprint scanner connections and depending on the screen type its good to check camera functionality after screen replacement.
  - dheera 5y ago
    > confirm the phone is properly functioning They could have the user unlock the phone in front of them without revealing the code to confirm this.
stephenr 5y ago
I've always either told them to wipe the drive, or setup a deliberate 'apple support' account before taking it in. I sympathise with the young woman who was the victim here, but apart from "send your device unlocked" Apple do also recommend wiping the device before sending it. When PINs started to become more common here, I had supermarket and continence store workers asking me to tell them the pin to my card, when paying for stuff. It didn't help that they'd ask me in Thai, I'd not understand, my wife would translate, and I'd immediately respond - in English - to the staff "Are you fucking crazy?". Thankfully that idea didn't last long. I guess enough other people had similar reactions in their native tongue that they realised that's a really stupid way to do business.
TonyTrapp 5y ago
I once sent in a ThinkPad for repair and Lenovo explicitly mentioned that I should remove any drives from the device before shipping it. I really think this should be the standard for fixing hardware issues. Edit: This was during the times when even a layman could do it because drives were in a slot secured by a single screw. These days it might be more complex.
- seabrookmx 5y ago
  You just can't. They're soldered onto the motherboard.
  - deleted 5y ago
    [deleted]
  - TonyTrapp 5y ago
    Certainly not in every device. But access to the drive has definitely gotten more difficult on average. I also have a newer ThinkPad where the drive is still replaceable, but it requires taking the laptop apart.
  - bashinator 5y ago
    My Lenovo laptop has removable NVMe drives that are accessible with a philips-head screwdriver.
    - seabrookmx 5y ago
      Sure but assuming the victim in the arcticle had a recent Macbook, it would be soldered.
      - snypher 5y ago
        You replied to a comment about Thinkpads.
        seabrookmx 5y ago
chasd00 5y ago
i agree, if it's a hardware issue there's no reason to require a login. If the repair is finished and the tech can get to the login/pin screen then the job is done. If it's a software issue then maybe they do legitimately need a password but i would never hand one over without very careful consideration. And, strange hands on the keyboard of my laptop or phone would be watched very very closely at all times. I good app would be one that disables the network stack, bluetooth, and cell modem with a separate secure pin.
- TeMPOraL 5y ago
  I think it should be a standard to have hardware come with a full suite of tests that can be accessed by anyone, without any kind of login. Otherwise, repair shops will keep asking for full access. In my case, many years ago, I got asked by a phone repair shop to backup the phone and wipe it before handing it over unlocked. My understanding was, they had no good way of doing proper diagnosis and after-repair testing without full access to the system.
  - toomuchtodo 5y ago
    Like a password enabled BIOS option to allow for booting off of external storage with no access to onboard storage provided? “Valet mode” if you will.
    - splistud 5y ago
      Valet mode! Excellent.
      - deleted 5y ago
        [deleted]
  - grishka 5y ago
    Macs have an "Apple hardware test" you can boot into. And you could as well just boot from an external drive to run all kinds of diagnostics. Phones however...
gregoriol 5y ago
I had this experience at an Apple authorised repair center (ie. not Apple Store but a shop that is partner with Apple): they almost forced me to give the password of my Mac, even after I argued that we set up security/Filevault explicitly to protect data and it would be stupid to give the password to anyone after that... They argued that when they change the component (battery problem), they have to test that everything works fine. I found that really shady! At the Apple Store, they also asked for the password, but when I said no way, the support person was just "ok, no problem".
- clintonb 5y ago
  I had a similar experience with a battery replacement. I declined to share the password, and the owner claims he was able to run the battery diagnostics without the password.
  - drclau 5y ago
    I believe they can boot up from an external device, or over network, and run the tests. There's absolutely no reason to give them your password. I went through a battery replacement (out of warranty, but still covered by Apple), and I was never asked for the password. But maybe they didn't even bother to run tests, since it was literally pushing the keyboard up ever so slightly, the touch pad wouldn't click anymore (haptic feedback very weak) and the bottom plate was bulging out. It was pretty obvious what is up. The nice thing tho, I ended up with a new battery, new keyboard, new touchpad and new bottom plate. I guess every (most?) cloud has a silver lining? :)
- bussierem 5y ago
  >At the Apple Store, they also asked for the password, but when I said no way, the support person was just "ok, no problem". Can we take a moment to realize how crazy this is? I'm glad they didn't fight you, but the fact that they didn't means that they know in an instant that _they never needed the password in the first place to do what you asked them to_. This means that them asking for the password is them asking you for the private key to your entire personal life for no other reason than "most people will give it to them".
deleted 5y ago
[deleted]
0xbadcafebee 5y ago
It's a heuristics quirk. It starts with "unknown unknowns" - the things you aren't even aware that you should be concerned about. Then add in a relationship where someone is trying to fix something for you. If you've never been trained to refuse information from someone who's seemingly trying to help you, it would never occur to you. When you go to the doctor and they prescribe you pills, most people don't question it and just take them. And that leads to a lot of people taking antibiotics that they don't need. Or when you move and need to sign up for internet, phone service, power, water, electricity, gas, etc.... almost all of them will ask for your social security number. Even I don't know when it's mandatory and when it's optional, so usually I ask them first, but sometimes I don't. The last time I witnessed this was some malware that infected an ex-roommate's laptop. The malware pretended to be an anti-virus and said she had a virus on her computer that it would fix. But first she needed to pay for the software - by putting in her credit card info & social security number. She complied because the files on her laptop were very sensitive and she didn't want lose them, and she had no idea that there was no reason to ask for a social to pay for this software. We could probably do more as a community to educate people on keeping sensitive information secure. Part of it involves media outreach, as most people seem to get their news from the TV or Facebook.
raverbashing 5y ago
Also remember that's one of the excuses that Apple uses for being against right to repair. I'm just glad they have an excellent example here of how it's fundamentally BS
vinni2 5y ago
Ya I once went to get my iPhone screen replaced, the technician wanted me to turn off my passcode just to diagnose the problem. I of course said I am not doing that. Instead I backed up my iPhone and reset it. This is ridiculous how can they even dare to ask people to turn off passcode and hand over their phones with so much personal information. This was not even an apple Genius Bar. This was an Apple premium reseller. I am sure many non tech savvy people just handover their iPhones this way.
cmckn 5y ago
I worked at a tech support desk at my university, and we asked for passwords. We were supporting software, so there's really no way around that. I always felt a bit uneasy that a dozen college kids had full access to the data on every machine in the shop. We should have at least recommended that folks change their password when they picked the machine up, or set a temporary password while it was in the shop.
jmcz 5y ago
If you don’t hire degenerates, then your employees won’t do degenerate things ¯\_(ツ)_/¯
ipython 5y ago
The answer is “everyone”. I’m particularly aware of this as I just spent the past two days setting up my non technical parents-in-law with 1Password. Not to go out on a tangent here, but on the whole, authentication is broken for “normal” people. By the time someone takes a computer in to a repair facility, giving the person on the other end their password is about the least of their concerns.
kevincox 5y ago
I had the same issue. I sent my phone to ubreakifix (Google's official repair partner) for a repair with warranty. After completing the repair they asked for my password and said that if I didn't provide it it would void the warranty on my phone. I refused and they eventually relented while still providing the warranty but it ended up delaying the repair by 5 days (for a 2h repair).
asimpletune 5y ago
Regular people are slowly catching up and understanding the consequences of technical stuff. For example, I think for years I struggled to provide concrete examples when trying to explain why people should care about privacy. Now, unfortunately, it's obvious that we should care about privacy because without, we're essentially provided a blueprint to our brains and how we can be psychologically exploited, e.g. fake news, conspiracy theories, etc... I think these are concepts that before would have seemed liked sci-fi, but after 2020, I think most regular people seem to have an intuitive appreciation for how damaging this can be. It's a shame that it's taken such a tragic schism to allow, but here we are and it's better late than never. Another example would be people probably have a better intuitive understanding for motivations behind decentralized architecture, after seeing people being removed from certain platforms. Note: I'm not saying I'm for or against this in any way, but I am saying that the technological architecture is sort of the lay of the land, in a way that I think people understand better than they used to. And no, I would never in a million years give my password to a repair technician in the past either. Hopefully others now are starting to get a sense for why.
viro 5y ago
software issues..
psychlops 5y ago
At the time, she would have been 16. I imagine she just wanted her phone fixed and the thought didn't occur to her.
TheOtherHobbes 5y ago
This is blaming users for something they shouldn't have to do. The onus should be on manufacturers to keep private data private by default. And also to sell systems that make it easy for repair shops to back up and restore private data without braking the privacy. You can't start with "It just works" and then add "As long as you spend hours backing up and restoring your data before you can send it in for repairs, just - you know - in case." Maybe the millions that were paid out will make Apple think about a more user-oriented solution.
- TheSpiceIsLife 5y ago
  Australians lost AU$840 million dollars last year to scammers. It's on the government have strong regulations that separate the sewage from the drinking water; strong regulations about who can connect what to the electrical power system; etc etc; require doctors to not pick their noses immediately before they perform surgery (gloves, masks, washing hands etc); encourage people to wash their hands after they poop............. And inform people of good security practices, through public policy and school education. I can't really see another way of educating the whole population on something they're otherwise fairly disinterested in.
TheSpiceIsLife 5y ago
They asked for my password when I took a MacBook I took get repaired, it wouldn't power on. I told them in no uncertain terms they cannot have my password, full disk encryption was enabled, and then pointed out if they can get the machine to the password prompt I'll be satisfied it's repaired. I'm convinced these people are either intentionally being nefarious, or they were dropped on their fucking heads at birth.
deleted 5y ago
[deleted]
throw14082020 5y ago
Even at the app store, they asked me to remove the password on my device. I still don't understand why there isn't a better way to do diagnostics.
greyhair 5y ago
The problem being, if the device is so dead, that you cannot factory reset, or otherwise, wipe it, what do you do? My daughter's MacBook Pro, with lovely soldered down solid state memory died, and had to go in for repair. There was simply no way to wipe it, and no physical drive to pull. Same thing with most phones. Soldered storage, glued shut case. If it dies under warranty, what do you do? You have to trust the repair chain, or just chuck it in the garbage.
vinay_ys 5y ago
This is really bad. Apple can and should fix this through policy and training. They talk so much about privacy and so many people have bought into Apple ecosystem because of it that. Many years ago, I had to take an iPhone for repair, my first and only time. It was a week old brand new phone whose proximity sensor wasn't working. The service person said he would need to take it to the back room and debug it. I insisted he diagnose it in front of me and I refused to hand over my phone for him to take it to the back room. Later, I had to wipe the device and send it in for replacement. But I was not happy that they asked me to unlock the phone and hand it to them to take it to the back office.

Sebb767 5y ago

I feel this is a bit like popping your hood at the car shop, but taking your key with you. I can absolutely see why repair shops would want to verify that a) it's not a software problem and b) everything still works fine afterwards, both of which is hard w/o the password. Sure, you can send in a wiped device or a device without hard drive - and if you can do so yourself, this is probably fine. But for the "average" user it's quite likely a better experience, assuming you can trust the repair shop - but then again, they have full access to your hardware plus the knowledge and time to permanently bug your device. If you really don't trust them, you probably should not give them your device at all. I can see the issue here and I'd probably err on the side of privacy given the choice, but the other side has a point.

baby 5y ago
They can do this from a guest account. Full disk encryption will protect your data.
- Sebb767 5y ago
  No, it won't. They could simply put in a different BIOS chip, which records you password the next time you enter it. Or a malicious RAM chip that injects a virus at runtime and extract your data that way. Or a bugged keyboard that transmits your key presses, combined with a full copy of your disk ... Sure, it's a bit more sophisticated than Ctrl+C/Ctrl+V. But if you're running a computer repair shop, it is quite likely that you have a good amount of technical knowledge. If someone has hardware access, you can usually see your device as compromised - especially if they have a lot of time and are expected to open up the device.
  - lorenzhs 5y ago
    If that's your threat model, you should not be using any repair shop. And the attacks you describe are not just "a bit more sophisticated than Ctrl+C/Ctrl+V", they're most likely far beyond the abilities of most repair technicians.
    - Sebb767 5y ago
      > If that's your threat model, you should not be using any repair shop. That's exactly what I said in my first comment: >> If you really don't trust them, you probably should not give them your device at all. > And the attacks you describe are not just "a bit more sophisticated than Ctrl+C/Ctrl+V", they're most likely far beyond the abilities of most repair technicians. The RAM one, yes. ROM chip swaps, on the other hand, are rather common. You will need to be able to solder quite well, but given the current state of macs, this is basically a given for anyone doing repairs on them. You'd of course need to get a malicious ROM chip, which might not be so easy, but probably doable - the technician only needs to be able to swap it, not to manufacture one. And if you can't get your hands on one - your can order a keylogger right now, for just a few bucks! [0] This was just the first result; if you invest a bit more time, you can surely find a smaller one or more fitting one. The keyboard is probably connected with USB [1], so no trouble there. As a bonus, you get all the passwords of accounts that were not saved at the time. Sure, simply unlocking is a bit easier. But it's not like this stuff is beyond anyone who is able to debug and solder on a Mac. [0] https://de.aliexpress.com/item/1005001988834597.html https://de.aliexpress.com/item/1005001988834597.html? [1] It's in my laptops; I don't know the specifics for macs, but I doubt is something more sophisticated than a strange plug.
      - Talanes 5y ago
        There are levels of trust. "Trust not to source and install malicious hardware in order to potentially steal unknown to them data" is a magnitude apart from "Trust not to go snooping around through unprotected photo albums."
hammock 5y ago
>I feel this is a bit like popping your hood at the car shop, but taking your key with you. Do you leave all your valuables in the car when you drop it off at the shop? Or do you take them out first?
- Sebb767 5y ago
  Well, the protection strategy for my valuables is not "leave the car locked in the shop". And then there's that one customer who's "rattle" is something in the glove compartment, to extend the metaphor further. So, in keeping with my points above, I would probably move the really valuable stuff out, but for some customers taking everything out will prevent the technician from removing the issue (and they will probably be blamed for it) and if I feel the need to completely get everything saved out of the car beforehand, I would not trust that shop with my car, either.
  - Krasnol 5y ago
    Let's not water the analogy down so far that it loses all connections to the current case. I doubt anyone would leave an album with their nude pictures in the car hoping that the mechanic wouldn't do anything with it. Like...posting it all over the block where the customer lives.
- bee_rider 5y ago
  For once I think a car analogy is actually useful. But, in this analogy, "taking all your valuables out of the car" would be like removing all the important documents from the computer. Which would be a reasonable thing to do, I guess, if the computer shop really needed access to do the repairs that they need to do. Another possibility -- maybe the computer is so borked that you can't even log on to remove your important documents. This seems more like calling somebody because your key broke in the lock... which... I guess most people would stick around? It is a little bit of a mismatch, because it is a quick fix and it isn't like you can go anywhere anyway.
  - dheera 5y ago
    Also, people from the general public don't know how to write random bits to a drive. Deleting files doesn't actually wipe the information, it just marks the space as available on the OS. Repair agents could still take an image of the drive and recover many of those secret documents. It should be standard procedure in the repair world to hand the hard drive to the user to take home and keep only the PC for servicing.
LorenPechtel 5y ago
This. Protecting data is practical for those of us sufficiently technically literate, but I've helped a fair number of people over the years that certainly would not be capable of doing it. (Admittedly, selection bias--the people who are asking for software help aren't the most technically knowledgeable.)

caymanjim 5y ago

There's a US-nationwide chain called "ubreakifix". I brought my Pixel phone there to have a broken screen replaced, and they wanted my passcode. I told them they were insane, and they acted as if I was the first person who ever declined. I can't believe they even ask, especially when there's no need for it whatsoever for a screen replacement.

miketery 5y ago
Similar thing for me, was best buy about 4 years ago in NYC. Handed an iPhone for. screen replacement. They wanted a password. Them: "what's your password" Me: "I'm not giving that to you" Them: "We'll have to wipe your phone then" Me: "Fine by me" Me: pickup phone next day, screen fixed all data still there
schoolornot 5y ago
Opposite experience here w/ two uBreakiFix stores and a Pixel 3. Neither time I was asked to provide the PIN. The first time I asked and they gave me a strong "no". No factory wipe, etc.
- lkbm 5y ago
  Same. I've had them replace phone screens for me multiple times--both in Austin and Atlanta--and neither location asked for the PIN nor reset my phone.
waheoo 5y ago
The usual reasoning behind this is to confirm the phone is properly functioning before opening it up. Lots of people try to scam repair shops bringing broken phones in. On top of that repairs can often break fingerprint scanner connections and depending on the screen type its good to check camera functionality after screen replacement.
- dheera 5y ago
  > confirm the phone is properly functioning They could have the user unlock the phone in front of them without revealing the code to confirm this.

stephenr 5y ago

I've always either told them to wipe the drive, or setup a deliberate 'apple support' account before taking it in. I sympathise with the young woman who was the victim here, but apart from "send your device unlocked" Apple do also recommend wiping the device before sending it. When PINs started to become more common here, I had supermarket and continence store workers asking me to tell them the pin to my card, when paying for stuff. It didn't help that they'd ask me in Thai, I'd not understand, my wife would translate, and I'd immediately respond - in English - to the staff "Are you fucking crazy?". Thankfully that idea didn't last long. I guess enough other people had similar reactions in their native tongue that they realised that's a really stupid way to do business.

TonyTrapp 5y ago

I once sent in a ThinkPad for repair and Lenovo explicitly mentioned that I should remove any drives from the device before shipping it. I really think this should be the standard for fixing hardware issues. Edit: This was during the times when even a layman could do it because drives were in a slot secured by a single screw. These days it might be more complex.

seabrookmx 5y ago
You just can't. They're soldered onto the motherboard.
- deleted 5y ago
  [deleted]
- TonyTrapp 5y ago
  Certainly not in every device. But access to the drive has definitely gotten more difficult on average. I also have a newer ThinkPad where the drive is still replaceable, but it requires taking the laptop apart.
- bashinator 5y ago
  My Lenovo laptop has removable NVMe drives that are accessible with a philips-head screwdriver.
  - seabrookmx 5y ago
    Sure but assuming the victim in the arcticle had a recent Macbook, it would be soldered.
    - snypher 5y ago
      You replied to a comment about Thinkpads.
      - seabrookmx 5y ago

chasd00 5y ago

i agree, if it's a hardware issue there's no reason to require a login. If the repair is finished and the tech can get to the login/pin screen then the job is done. If it's a software issue then maybe they do legitimately need a password but i would never hand one over without very careful consideration. And, strange hands on the keyboard of my laptop or phone would be watched very very closely at all times. I good app would be one that disables the network stack, bluetooth, and cell modem with a separate secure pin.

TeMPOraL 5y ago
I think it should be a standard to have hardware come with a full suite of tests that can be accessed by anyone, without any kind of login. Otherwise, repair shops will keep asking for full access. In my case, many years ago, I got asked by a phone repair shop to backup the phone and wipe it before handing it over unlocked. My understanding was, they had no good way of doing proper diagnosis and after-repair testing without full access to the system.
- toomuchtodo 5y ago
  Like a password enabled BIOS option to allow for booting off of external storage with no access to onboard storage provided? “Valet mode” if you will.
  - splistud 5y ago
    Valet mode! Excellent.
    - deleted 5y ago
      [deleted]
- grishka 5y ago
  Macs have an "Apple hardware test" you can boot into. And you could as well just boot from an external drive to run all kinds of diagnostics. Phones however...

gregoriol 5y ago

I had this experience at an Apple authorised repair center (ie. not Apple Store but a shop that is partner with Apple): they almost forced me to give the password of my Mac, even after I argued that we set up security/Filevault explicitly to protect data and it would be stupid to give the password to anyone after that... They argued that when they change the component (battery problem), they have to test that everything works fine. I found that really shady! At the Apple Store, they also asked for the password, but when I said no way, the support person was just "ok, no problem".

clintonb 5y ago
I had a similar experience with a battery replacement. I declined to share the password, and the owner claims he was able to run the battery diagnostics without the password.
- drclau 5y ago
  I believe they can boot up from an external device, or over network, and run the tests. There's absolutely no reason to give them your password. I went through a battery replacement (out of warranty, but still covered by Apple), and I was never asked for the password. But maybe they didn't even bother to run tests, since it was literally pushing the keyboard up ever so slightly, the touch pad wouldn't click anymore (haptic feedback very weak) and the bottom plate was bulging out. It was pretty obvious what is up. The nice thing tho, I ended up with a new battery, new keyboard, new touchpad and new bottom plate. I guess every (most?) cloud has a silver lining? :)
bussierem 5y ago
>At the Apple Store, they also asked for the password, but when I said no way, the support person was just "ok, no problem". Can we take a moment to realize how crazy this is? I'm glad they didn't fight you, but the fact that they didn't means that they know in an instant that _they never needed the password in the first place to do what you asked them to_. This means that them asking for the password is them asking you for the private key to your entire personal life for no other reason than "most people will give it to them".

deleted 5y ago

[deleted]

0xbadcafebee 5y ago

It's a heuristics quirk. It starts with "unknown unknowns" - the things you aren't even aware that you should be concerned about. Then add in a relationship where someone is trying to fix something for you. If you've never been trained to refuse information from someone who's seemingly trying to help you, it would never occur to you. When you go to the doctor and they prescribe you pills, most people don't question it and just take them. And that leads to a lot of people taking antibiotics that they don't need. Or when you move and need to sign up for internet, phone service, power, water, electricity, gas, etc.... almost all of them will ask for your social security number. Even I don't know when it's mandatory and when it's optional, so usually I ask them first, but sometimes I don't. The last time I witnessed this was some malware that infected an ex-roommate's laptop. The malware pretended to be an anti-virus and said she had a virus on her computer that it would fix. But first she needed to pay for the software - by putting in her credit card info & social security number. She complied because the files on her laptop were very sensitive and she didn't want lose them, and she had no idea that there was no reason to ask for a social to pay for this software. We could probably do more as a community to educate people on keeping sensitive information secure. Part of it involves media outreach, as most people seem to get their news from the TV or Facebook.

raverbashing 5y ago

Also remember that's one of the excuses that Apple uses for being against right to repair. I'm just glad they have an excellent example here of how it's fundamentally BS

vinni2 5y ago

Ya I once went to get my iPhone screen replaced, the technician wanted me to turn off my passcode just to diagnose the problem. I of course said I am not doing that. Instead I backed up my iPhone and reset it. This is ridiculous how can they even dare to ask people to turn off passcode and hand over their phones with so much personal information. This was not even an apple Genius Bar. This was an Apple premium reseller. I am sure many non tech savvy people just handover their iPhones this way.

cmckn 5y ago

I worked at a tech support desk at my university, and we asked for passwords. We were supporting software, so there's really no way around that. I always felt a bit uneasy that a dozen college kids had full access to the data on every machine in the shop. We should have at least recommended that folks change their password when they picked the machine up, or set a temporary password while it was in the shop.

jmcz 5y ago

If you don’t hire degenerates, then your employees won’t do degenerate things ¯\_(ツ)_/¯

ipython 5y ago

The answer is “everyone”. I’m particularly aware of this as I just spent the past two days setting up my non technical parents-in-law with 1Password. Not to go out on a tangent here, but on the whole, authentication is broken for “normal” people. By the time someone takes a computer in to a repair facility, giving the person on the other end their password is about the least of their concerns.

kevincox 5y ago

I had the same issue. I sent my phone to ubreakifix (Google's official repair partner) for a repair with warranty. After completing the repair they asked for my password and said that if I didn't provide it it would void the warranty on my phone. I refused and they eventually relented while still providing the warranty but it ended up delaying the repair by 5 days (for a 2h repair).

asimpletune 5y ago

Regular people are slowly catching up and understanding the consequences of technical stuff. For example, I think for years I struggled to provide concrete examples when trying to explain why people should care about privacy. Now, unfortunately, it's obvious that we should care about privacy because without, we're essentially provided a blueprint to our brains and how we can be psychologically exploited, e.g. fake news, conspiracy theories, etc... I think these are concepts that before would have seemed liked sci-fi, but after 2020, I think most regular people seem to have an intuitive appreciation for how damaging this can be. It's a shame that it's taken such a tragic schism to allow, but here we are and it's better late than never. Another example would be people probably have a better intuitive understanding for motivations behind decentralized architecture, after seeing people being removed from certain platforms. Note: I'm not saying I'm for or against this in any way, but I am saying that the technological architecture is sort of the lay of the land, in a way that I think people understand better than they used to. And no, I would never in a million years give my password to a repair technician in the past either. Hopefully others now are starting to get a sense for why.

viro 5y ago

software issues..

psychlops 5y ago

At the time, she would have been 16. I imagine she just wanted her phone fixed and the thought didn't occur to her.

TheOtherHobbes 5y ago

This is blaming users for something they shouldn't have to do. The onus should be on manufacturers to keep private data private by default. And also to sell systems that make it easy for repair shops to back up and restore private data without braking the privacy. You can't start with "It just works" and then add "As long as you spend hours backing up and restoring your data before you can send it in for repairs, just - you know - in case." Maybe the millions that were paid out will make Apple think about a more user-oriented solution.

TheSpiceIsLife 5y ago
Australians lost AU$840 million dollars last year to scammers. It's on the government have strong regulations that separate the sewage from the drinking water; strong regulations about who can connect what to the electrical power system; etc etc; require doctors to not pick their noses immediately before they perform surgery (gloves, masks, washing hands etc); encourage people to wash their hands after they poop............. And inform people of good security practices, through public policy and school education. I can't really see another way of educating the whole population on something they're otherwise fairly disinterested in.

TheSpiceIsLife 5y ago

They asked for my password when I took a MacBook I took get repaired, it wouldn't power on. I told them in no uncertain terms they cannot have my password, full disk encryption was enabled, and then pointed out if they can get the machine to the password prompt I'll be satisfied it's repaired. I'm convinced these people are either intentionally being nefarious, or they were dropped on their fucking heads at birth.

deleted 5y ago

[deleted]

throw14082020 5y ago

Even at the app store, they asked me to remove the password on my device. I still don't understand why there isn't a better way to do diagnostics.

greyhair 5y ago

The problem being, if the device is so dead, that you cannot factory reset, or otherwise, wipe it, what do you do? My daughter's MacBook Pro, with lovely soldered down solid state memory died, and had to go in for repair. There was simply no way to wipe it, and no physical drive to pull. Same thing with most phones. Soldered storage, glued shut case. If it dies under warranty, what do you do? You have to trust the repair chain, or just chuck it in the garbage.

vinay_ys 5y ago

This is really bad. Apple can and should fix this through policy and training. They talk so much about privacy and so many people have bought into Apple ecosystem because of it that. Many years ago, I had to take an iPhone for repair, my first and only time. It was a week old brand new phone whose proximity sensor wasn't working. The service person said he would need to take it to the back room and debug it. I insisted he diagnose it in front of me and I refused to hand over my phone for him to take it to the back room. Later, I had to wipe the device and send it in for replacement. But I was not happy that they asked me to unlock the phone and hand it to them to take it to the back office.