6 ms·

It's fine if you want to run iOS or iPadOS on your device, that shouldn't exclude other people from installing an OS of their own choosing though.

judge2020 5y ago
I would argue that being able to easily do that would be a security issue in itself - imagine an evil maid attack that is just installing iOS with a change that sends all keychain items to a remote server or makes it easy to obtain the encryption key that protects all user data.
- fartcannon 5y ago
  Since iOS isn't flawless and it is ubiquitous across Apple devices, think of the damage that can be done by a single virus. iOS lacks diversity and is therefore a fantastic target for malware.
- mindslight 5y ago
  As these systems rely on trusted hardware, it's straightforward to do things like require the device be plugged in and in some low-level diag mode for 72 hours before allowing the root signing key to be changed. Trusted hardware could be interesting if companies actually developed it to be legible to the user-owner, rather than their current approach of doing the bare minimum to bake in their own fixed root keys.
  - warkdarrior 5y ago
    Next headline would be: "Apple cripple iPads, force Linux installs to take 72 hours"
    - bengale 5y ago
      It's becoming more and more clear that 'tech journalism' is essentially the same thing as the celebrity news rags.
      - Tsiklon 5y ago
        Some tech news websites like The Register are completely self aware of that fact and lean into it completely and utterly
  - spockz 5y ago
    There can be other mechanisms here. For example requiring a notification or 2FA before replacing a non Apple sourced iOS with something else. If your device is encrypted it should require the keys to install something new. With this it might be easier to just “gift” someone the latest iPhone on which you installed an hardware exploit.
    - mindslight 5y ago
      The idea is that every physical device has some sort of trust root, whether well defined or not. Traditionally this has been physical possession of the device. The treacherous computing model is to make the trust root a key that only the manufacturer has. I'm proposing that the trust root should be "possession of the device for X days", which doesn't privilege the manufacturer with indefinite control over something they've supposedly sold. I don't understand what you're describing. Things like "2FA" and "notifications" aren't part of a bootloader, and therefore would have to be implemented externally. Keeping the manufacturer as part of the privileged base is still the dark ages. FWIW the answer to the gifted trojan iPhone is to make the bootloader report the signing key that it is trusting. If you receive an iPhone from someone else and you want to assure integrity, you either plug it into another device of yours which checks the Apple signing key (possibly needing to wait X days to load it), or you bring the device to an Apple store where they do it for you.
      - thejsa 5y ago
        Re: the gifted trojan device scenario, I think the primary line of defense would be to display a prominent boot time warning in the bootloader where a non-Apple root of trust has been used, just as many Android devices do already -- perhaps similar to the recovery screen, but with more warning signs and an open lock symbol or something.
      - spockz 5y ago
        Regarding the notifications and 2FA I was thinking along the following lines. Every device is unique. In order to get an unlock key and get the phone to unlock itself you need some signed payload by Apple. In order to obtain the unlock you would need to prove you own the iCloud account attached to the phone. That is where 2FA comes in. The notifications will go to all your other devices similar to the “your iCloud account is now being used on device x” messages.
- happymellon 5y ago
  Is this a common issue for MacOS?
  - 0x0nyandesu 5y ago
    It's not. They made it all up.
BoorishBears 5y ago
Yes it should, because being able to install an OS on their device means they can install one on mine. And people will come up with all kinds of farcical workarounds for this, like that nonsense about 72 hrs in diag another comment made (right, because someone can't hold a device from you for 72 hrs), but I'm not interested. Jailbreaks are security flaws, I like that they're patched and I like that there's no blessed equivalent. I liked that I can trust my iPhone in ways I can't trust the Android devices I'm paid to develop for. The same freedom that makes developing for Android fun is the same freedom that ruins them for any reasonable use I might have.
bradknowles 5y ago
You advocate breaking the first link in the chain of security. If anyone can install any OS they want on any device in their possession, even if it’s a device they stole from me, then that reduces my security. I prefer to keep all the links in the chain of security as unbroken and undamaged as possible, and if the only way to do that is to have a company like Apple run a closed walled garden, then I’m okay with that. Give me an alternative that doesn’t require the Apple solution but still actually works, and I’ll be happy to take a look at it. But so far, the market hasn’t come up with anything that can compare or compete.

judge2020 5y ago

I would argue that being able to easily do that would be a security issue in itself - imagine an evil maid attack that is just installing iOS with a change that sends all keychain items to a remote server or makes it easy to obtain the encryption key that protects all user data.

fartcannon 5y ago
Since iOS isn't flawless and it is ubiquitous across Apple devices, think of the damage that can be done by a single virus. iOS lacks diversity and is therefore a fantastic target for malware.
mindslight 5y ago
As these systems rely on trusted hardware, it's straightforward to do things like require the device be plugged in and in some low-level diag mode for 72 hours before allowing the root signing key to be changed. Trusted hardware could be interesting if companies actually developed it to be legible to the user-owner, rather than their current approach of doing the bare minimum to bake in their own fixed root keys.
- warkdarrior 5y ago
  Next headline would be: "Apple cripple iPads, force Linux installs to take 72 hours"
  - bengale 5y ago
    It's becoming more and more clear that 'tech journalism' is essentially the same thing as the celebrity news rags.
    - Tsiklon 5y ago
      Some tech news websites like The Register are completely self aware of that fact and lean into it completely and utterly
- spockz 5y ago
  There can be other mechanisms here. For example requiring a notification or 2FA before replacing a non Apple sourced iOS with something else. If your device is encrypted it should require the keys to install something new. With this it might be easier to just “gift” someone the latest iPhone on which you installed an hardware exploit.
  - mindslight 5y ago
    The idea is that every physical device has some sort of trust root, whether well defined or not. Traditionally this has been physical possession of the device. The treacherous computing model is to make the trust root a key that only the manufacturer has. I'm proposing that the trust root should be "possession of the device for X days", which doesn't privilege the manufacturer with indefinite control over something they've supposedly sold. I don't understand what you're describing. Things like "2FA" and "notifications" aren't part of a bootloader, and therefore would have to be implemented externally. Keeping the manufacturer as part of the privileged base is still the dark ages. FWIW the answer to the gifted trojan iPhone is to make the bootloader report the signing key that it is trusting. If you receive an iPhone from someone else and you want to assure integrity, you either plug it into another device of yours which checks the Apple signing key (possibly needing to wait X days to load it), or you bring the device to an Apple store where they do it for you.
    - thejsa 5y ago
      Re: the gifted trojan device scenario, I think the primary line of defense would be to display a prominent boot time warning in the bootloader where a non-Apple root of trust has been used, just as many Android devices do already -- perhaps similar to the recovery screen, but with more warning signs and an open lock symbol or something.
    - spockz 5y ago
      Regarding the notifications and 2FA I was thinking along the following lines. Every device is unique. In order to get an unlock key and get the phone to unlock itself you need some signed payload by Apple. In order to obtain the unlock you would need to prove you own the iCloud account attached to the phone. That is where 2FA comes in. The notifications will go to all your other devices similar to the “your iCloud account is now being used on device x” messages.
happymellon 5y ago
Is this a common issue for MacOS?
- 0x0nyandesu 5y ago
  It's not. They made it all up.

BoorishBears 5y ago

Yes it should, because being able to install an OS on their device means they can install one on mine. And people will come up with all kinds of farcical workarounds for this, like that nonsense about 72 hrs in diag another comment made (right, because someone can't hold a device from you for 72 hrs), but I'm not interested. Jailbreaks are security flaws, I like that they're patched and I like that there's no blessed equivalent. I liked that I can trust my iPhone in ways I can't trust the Android devices I'm paid to develop for. The same freedom that makes developing for Android fun is the same freedom that ruins them for any reasonable use I might have.

bradknowles 5y ago

You advocate breaking the first link in the chain of security. If anyone can install any OS they want on any device in their possession, even if it’s a device they stole from me, then that reduces my security. I prefer to keep all the links in the chain of security as unbroken and undamaged as possible, and if the only way to do that is to have a company like Apple run a closed walled garden, then I’m okay with that. Give me an alternative that doesn’t require the Apple solution but still actually works, and I’ll be happy to take a look at it. But so far, the market hasn’t come up with anything that can compare or compete.