4 ms·

One question: can I finish the setup of an M1 Mac without giving it an internet connection? As in, could I get it from unboxing to desktop without it sending a

One question: can I finish the setup of an M1 Mac without giving it an internet connection? As in, could I get it from unboxing to desktop without it sending a single network packet to Apple?

gjsman-1000 5y ago
Yes, right now you can on M1. Windows 11 Home will not support that in the final release, but there are workarounds in the beta period.
- spideymans 5y ago
  From the article: >According to the small print in Apple’s Platform Security Guide, when you set up a new M1 Mac, or set one up after restoring it in DFU mode, the primary admin account created is special: it’s the Owner account of that Mac. During that inital setup, the Mac sends a request to Apple for that Mac’s signed Owner Identity Certificate (OIC). This is based on a private key generated in the Secure Enclave known as the Owner Identity Key (OIK). I'm not trying to imply that you're wrong at all, but I'm curious how the Mac goes about obtaining the OIC without a network connection.
  - gjsman-1000 5y ago
    The OIC, if I understand correctly, is an Apple vetted OIK which is created on-device. This mainly would come into play, as the article says, if you install another operating system. By default, the OS is in Full Security mode, so it would contact Apple when installing the other OS and the OIC may come into play. But if you aren’t installing another OS, or you set your Mac to permissive security which needs no internet, perhaps the OIC is not required because you’ve downgraded the security? Im just speculating. Still, somehow, the fact remains you can fully set up an M1 Mac without internet. The technicals of how it does this while reconciling that with the security guide is unknown.
    - grishka 5y ago
      Can you disable secure boot without Apple having a say in the process? I trust myself much more than I trust Apple.
      - Wowfunhappy 5y ago
        Yes, you can.
      - gjsman-1000 5y ago
        There are three levels of M1 security, Full, Reduced, and Permissive. You can downgrade at any time without internet, but you cannot re-enter Full without contacting Apple over the internet.
        brigade 5y ago
        No, you cannot downgrade before creating a user account in setup.
        gjsman-1000 5y ago
        Technically true, but no internet is required to make that account, so it’s a minor inconvenience.
        Wowfunhappy 5y ago
        Wait, really? What mechanism makes a user account required? Since the change has to be made from 1TR, I’d have thought you’d never need to log in...
        gjsman-1000 5y ago
        You need to log into 1TR with a local admin account, which is used to prevent thieves from wiping the drive and reselling. This process apparently works even if macOS is damaged, meaning your account credentials are likely stored in the enclave which is persistent and has storage inside the chip.
  - grishka 5y ago
    Yes, it's after reading this that I'm asking. I really don't like my own hardware phoning home without my explicit consent. Ideally I'd install a firewall before I first connect it to the internet, and I'd block *.apple.com by default.
    - gjsman-1000 5y ago
      It is currently unknown how it reconciles with the security guide, but the fact remains that you can set up a M1 Mac without any internet.
  - comex 5y ago
    According to [1], the whole dance with the OIC and OIK happens > When macOS is first installed in the factory, or when a tethered erase-install is performed So when you're setting up for the first time after the factory install, it already has the OIC. I think. [1] https://support.apple.com/guide/security/localpolicy-signing-key-creation-management-sec1f90fbad1/1/web/1 https://support.apple.com/guide/security/localpolicy-signing...
- Beached 5y ago
  To clarify, Home will not. But home is targeted to the non techy layman. pro / Enterprise will allow this. comparing window home to oax is like complaining that my Honda civic doesn't have the towing capacity that my f150 has. different class and purpose. apple doesn't even have a comparable os to be compared to home, as it's a market they don't even target or develop for.
  - judge2020 5y ago
    > But home is targeted to the non techy layman. Yet it will be sold on laptops to anyone that buys them, even if the customer is a 'pro'. It's their prerogative, but I would rather see 'Want to set up with an offline account? Upgrade to pro now for $80'.
  - vetinari 5y ago
    > omparing window home to oax is like complaining that my Honda civic doesn't have the towing capacity that my f150 has. different class and purpose. Microsoft puts garbage into Pro/Enterprise too, surely you know.
deleted 5y ago
[deleted]
brigade 5y ago
No, because of activation lock. Setup doesn’t differentiate whether it’s been wiped or not, and activation lock would be weak if a simple wipe could defeat it.
- gjsman-1000 5y ago
  False. Setup is actually quite aware of whether it’s been wiped or not, because of the Secure Enclave.

One question: can I finish the setup of an M1 Mac without giving it an internet connection? As in, could I get it from unboxing to desktop without it sending a single network packet to Apple?

gjsman-1000 5y ago

Yes, right now you can on M1. Windows 11 Home will not support that in the final release, but there are workarounds in the beta period.

spideymans 5y ago
From the article: >According to the small print in Apple’s Platform Security Guide, when you set up a new M1 Mac, or set one up after restoring it in DFU mode, the primary admin account created is special: it’s the Owner account of that Mac. During that inital setup, the Mac sends a request to Apple for that Mac’s signed Owner Identity Certificate (OIC). This is based on a private key generated in the Secure Enclave known as the Owner Identity Key (OIK). I'm not trying to imply that you're wrong at all, but I'm curious how the Mac goes about obtaining the OIC without a network connection.
- gjsman-1000 5y ago
  The OIC, if I understand correctly, is an Apple vetted OIK which is created on-device. This mainly would come into play, as the article says, if you install another operating system. By default, the OS is in Full Security mode, so it would contact Apple when installing the other OS and the OIC may come into play. But if you aren’t installing another OS, or you set your Mac to permissive security which needs no internet, perhaps the OIC is not required because you’ve downgraded the security? Im just speculating. Still, somehow, the fact remains you can fully set up an M1 Mac without internet. The technicals of how it does this while reconciling that with the security guide is unknown.
  - grishka 5y ago
    Can you disable secure boot without Apple having a say in the process? I trust myself much more than I trust Apple.
    - Wowfunhappy 5y ago
      Yes, you can.
    - gjsman-1000 5y ago
      There are three levels of M1 security, Full, Reduced, and Permissive. You can downgrade at any time without internet, but you cannot re-enter Full without contacting Apple over the internet.
      - brigade 5y ago
        No, you cannot downgrade before creating a user account in setup.
        gjsman-1000 5y ago
        Technically true, but no internet is required to make that account, so it’s a minor inconvenience.
        Wowfunhappy 5y ago
        Wait, really? What mechanism makes a user account required? Since the change has to be made from 1TR, I’d have thought you’d never need to log in...
        gjsman-1000 5y ago
        You need to log into 1TR with a local admin account, which is used to prevent thieves from wiping the drive and reselling. This process apparently works even if macOS is damaged, meaning your account credentials are likely stored in the enclave which is persistent and has storage inside the chip.
- grishka 5y ago
  Yes, it's after reading this that I'm asking. I really don't like my own hardware phoning home without my explicit consent. Ideally I'd install a firewall before I first connect it to the internet, and I'd block *.apple.com by default.
  - gjsman-1000 5y ago
    It is currently unknown how it reconciles with the security guide, but the fact remains that you can set up a M1 Mac without any internet.
- comex 5y ago
  According to [1], the whole dance with the OIC and OIK happens > When macOS is first installed in the factory, or when a tethered erase-install is performed So when you're setting up for the first time after the factory install, it already has the OIC. I think. [1] https://support.apple.com/guide/security/localpolicy-signing-key-creation-management-sec1f90fbad1/1/web/1 https://support.apple.com/guide/security/localpolicy-signing...
Beached 5y ago
To clarify, Home will not. But home is targeted to the non techy layman. pro / Enterprise will allow this. comparing window home to oax is like complaining that my Honda civic doesn't have the towing capacity that my f150 has. different class and purpose. apple doesn't even have a comparable os to be compared to home, as it's a market they don't even target or develop for.
- judge2020 5y ago
  > But home is targeted to the non techy layman. Yet it will be sold on laptops to anyone that buys them, even if the customer is a 'pro'. It's their prerogative, but I would rather see 'Want to set up with an offline account? Upgrade to pro now for $80'.
- vetinari 5y ago
  > omparing window home to oax is like complaining that my Honda civic doesn't have the towing capacity that my f150 has. different class and purpose. Microsoft puts garbage into Pro/Enterprise too, surely you know.

deleted 5y ago

[deleted]

brigade 5y ago

No, because of activation lock. Setup doesn’t differentiate whether it’s been wiped or not, and activation lock would be weak if a simple wipe could defeat it.

gjsman-1000 5y ago
False. Setup is actually quite aware of whether it’s been wiped or not, because of the Secure Enclave.