3 ms·
From the article: >According to the small print in Apple’s Platform Security Guide, when you set up a new M1 Mac, or set one up after restoring it in DFU mode,
by spideymans 5y ago
From the article:
>According to the small print in Apple’s Platform Security Guide, when you set up a new M1 Mac, or set one up after restoring it in DFU mode, the primary admin account created is special: it’s the Owner account of that Mac. During that inital setup, the Mac sends a request to Apple for that Mac’s signed Owner Identity Certificate (OIC). This is based on a private key generated in the Secure Enclave known as the Owner Identity Key (OIK).
I'm not trying to imply that you're wrong at all, but I'm curious how the Mac goes about obtaining the OIC without a network connection.
- gjsman-1000 5y agoThe OIC, if I understand correctly, is an Apple vetted OIK which is created on-device. This mainly would come into play, as the article says, if you install another operating system. By default, the OS is in Full Security mode, so it would contact Apple when installing the other OS and the OIC may come into play. But if you aren’t installing another OS, or you set your Mac to permissive security which needs no internet, perhaps the OIC is not required because you’ve downgraded the security? Im just speculating. Still, somehow, the fact remains you can fully set up an M1 Mac without internet. The technicals of how it does this while reconciling that with the security guide is unknown.
- grishka 5y agoCan you disable secure boot without Apple having a say in the process? I trust myself much more than I trust Apple.
- Wowfunhappy 5y agoYes, you can.
- gjsman-1000 5y agoThere are three levels of M1 security, Full, Reduced, and Permissive. You can downgrade at any time without internet, but you cannot re-enter Full without contacting Apple over the internet.
- brigade 5y agoNo, you cannot downgrade before creating a user account in setup.
- gjsman-1000 5y agoTechnically true, but no internet is required to make that account, so it’s a minor inconvenience.
- Wowfunhappy 5y agoWait, really? What mechanism makes a user account required? Since the change has to be made from 1TR, I’d have thought you’d never need to log in...
- gjsman-1000 5y agoYou need to log into 1TR with a local admin account, which is used to prevent thieves from wiping the drive and reselling. This process apparently works even if macOS is damaged, meaning your account credentials are likely stored in the enclave which is persistent and has storage inside the chip.
- SpelingBeeChamp 5y ago1TR?
- Wowfunhappy 5y ago"One True Recovery". It's a special recovery environment that the user enters when they hold down the power button on an M1 Mac. It looks identical to a standard recovery environment, but it allows you to do things turn off secure boot.
- grishka 5y agoYes, it's after reading this that I'm asking. I really don't like my own hardware phoning home without my explicit consent. Ideally I'd install a firewall before I first connect it to the internet, and I'd block *.apple.com by default.
- gjsman-1000 5y agoIt is currently unknown how it reconciles with the security guide, but the fact remains that you can set up a M1 Mac without any internet.
- comex 5y agoAccording to [1], the whole dance with the OIC and OIK happens > When macOS is first installed in the factory, or when a tethered erase-install is performed So when you're setting up for the first time after the factory install, it already has the OIC. I think. [1] https://support.apple.com/guide/security/localpolicy-signing-key-creation-management-sec1f90fbad1/1/web/1 https://support.apple.com/guide/security/localpolicy-signing...