6 ms·

This is really no different to Apple’s Activation Lock. If the previous user isn’t careful to sign out of their Apple ID (or, at a minimum, disable “Find My”),

This is really no different to Apple’s Activation Lock. If the previous user isn’t careful to sign out of their Apple ID (or, at a minimum, disable “Find My”), the new owner will need the previous owner’s password to reset the device. This is a good thing. Combined with remote lock, it renders stolen devices useless.

mjevans 5y ago
No, it's not a good thing. The Factory Reset process is defective. It SHOULD ask the user if they are selling, giving away, or otherwise disposing of the device; or otherwise just want to remove that device from their account.
- marginalia_nu 5y ago
  This works well because pickpockets are well known for their inability to tell lies, and would always answer truthfully.
  - ben_w 5y ago
    Sarcasm accepted, but you can require the account password to proceed with the reset when the user makes that choice.
    - LeoPanthera 5y ago
      It does. That is exactly what it does.
      - ben_w 5y ago
        Good to know; but why are you and @swiftcoder saying apparently different things? [0] I’m on iOS, so I can’t test this myself. [0] https://news.ycombinator.com/item?id=30777197 https://news.ycombinator.com/item?id=30777197
        LeoPanthera 5y ago
        He's talking about Android, I'm talking about iOS. I don't know what Android does, and I'm sure that it's device-specific anyway, unlike iPhones.
        ben_w 5y ago
        Ah, I thought what I was responding to was talking about Android. I can see now this was not necessarily the case.
- easton 5y ago
  It does. "Erase all content and settings" prompts the user to enter their password to disable Find My iPhone, and if you do it through iTunes, once the phone reboots into the clean OS it prompts on the computer to type the credentials in. You could refuse to type the credentials in leaving it locked, but Apple is pretty informative throughout the process. (You can also remove it from Find My iPhone on the web and it unlocks the device even if you don't have it anymore)
  - swiftcoder 5y ago
    Note that Android doesn't ask the same thing (and especially not if you initiate factory reset from the bootloader, as tech folks are prone to do).
josefx 5y ago
Couldn't this be done using a reset password shipped with the phone? There is no reason to involve a third party at all.
- danuker 5y ago
  How would the phone check whether it's stolen, without a third party, and without the user knowing the password (or lock screen pattern)?
  - josefx 5y ago
    The thief wouldn't have the reset password?
    - wyattpeak 5y ago
      After two or three years, neither would the owner. Edit: More seriously, if they took this approach, people would regularly lose their codes, which would necessitate a backup means of obtaining it. Which would no doubt require the purchaser log into their Google account. And we're back at square one.
      - josefx 5y ago
        > After two or three years, neither would the owner. It might surprise you, but back before games where always online everyone had to keep track of license keys. Still have a box with all of them. Only those that required feedback from activation servers are now useless because the companies killed the servers.
        mh- 5y ago
        And I misplaced a few CD keys over the years, and sometimes even repurchased the game for $20-50. Modern phones are closer to $1000.
        hutzlibu 5y ago
        Some I still have, too. But even back then, I just looked for a key online, than bothered searching. That was way quicker ... you didn't even had to go to any dark sites. Google showed them right upfront. (for single player games)
thaumasiotes 5y ago
> This is a good thing. Combined with remote lock, it renders stolen devices useless. Of course it's not a good thing. What Apple can do to someone else at your request, they can do to you on their own initiative.
- LeoPanthera 5y ago
  Yes. And your cellular provider could send text messages "from" you. Your email host could randomly delete all your emails. Your credit card provider could buy stuff on your account. But they don't because they're all enormous companies with thousands of employees. The negative PR would be instant and overwhelming, and the sheer amount of staff would render trying to do it secretly, ineffective. There is cautious, and there is paranoid.
  - thaumasiotes 5y ago
    > Your credit card provider could buy stuff on your account. This example is unlike the others; your credit card provider already buys everything that goes on your account. For that to make any sense, they'd need to convince you to pay them "back". > But they don't because they're all enormous companies with thousands of employees. The negative PR would be instant and overwhelming, and the sheer amount of staff would render trying to do it secretly, ineffective. And this is just untrue. Nobody even remembers Amazon retroactively deleting sold copies of 1984 from their customers' internet-connected Kindles. We're swimming in devices that the manufacturer won't let us access right now, but the PR hit from doing what they're already doing is too large for them to... continue doing it?
    - butlerm 5y ago
      Credit card providers not only do not buy anything that goes on your account, they do not pay for anything that goes on your account. They transfer funds for purchases that you make, and make payments on your behalf. As such they are neither the buyer nor the payor in any credit card transaction.
      - 5y ago
b3lvedere 5y ago
"This is a good thing. Combined with remote lock, it renders stolen devices useless." My personal opinions on this: Factory reset should mean 'just like when it came out of the factory brand new'. So no hidden keys, certificates, connections, locks or other dependencies. Either change the definition or do not call it factory reset. If people will not be able to factory reset a device, please explicitly state so in the TOS. Rendering stolen devices useless may be a good thing security wise, but it is horrible for things like the ability to recycle and reuse. There are tons of procedures to make pretty sure devices are wiped completely from any sort of data. Why is this not enough? I have had to destroy thousands of devices that could have a happy second (completely unsupported and no warranty whatosever) life at various projects. I'm not proud of it.
- taneq 5y ago
  > There are tons of procedures to make pretty sure devices are wiped completely from any sort of data. Why is this not enough? It sucks, but it's not enough because it doesn't remove the incentive to steal the device in the first place. If you want someone to plonk down $2k for a fancy phone, you'd better be able to (a) convince them that they'll be able to re-sell it for a good chunk of that amount, and (b) at the same time reassure them that there's no point anyone stealing their expensive new toy, which means they aren't just painting a giant target on their head. If the thousands of devices you mention were legitimately obtained, why were they locked with account credentials that you didn't have? Or were they recovered from dumped recycling or something?
  - b3lvedere 5y ago
    "If the thousands of devices you mention were legitimately obtained, why were they locked with account credentials that you didn't have? Or were they recovered from dumped recycling or something?" Oh that was not only smartphones, but also data carriers like harddisks and usb sticks. Apologies for not clarifying. Nevertheless valid points indeed. Regarding smartphones people just forgot or died. Most of them 'assumed IT would have some way of recovering them so they did not bother'.
raxxorrax 5y ago
Really depends if it really is a good thing. Stolen devices are an edge case and devices bricked because of such protection are probably numerous.
- taneq 5y ago
  Stolen devices are an edge case because it removes the incentive to steal the devices. Back when mobile phones first started becoming popular they were an equally popular smash-and-grab item. Now? Not so much.
  - raxxorrax 5y ago
    But most phones don't have physical reset buttons, so all of them have this kind of protection without the shenanigans of account de-association.
    - swiftcoder 5y ago
      Are there any extant android devices that can't be factory reset from the bootloader menu?
  - AnonHP 5y ago
    Devices are (and have been) stolen and sold to strip them for parts. The value may be lower, but it’s nowhere close to zero.
oyebenny 5y ago
What if this was a dark pattern implemented so that people will generate more useless phones and will have to purchase new ones all the time?
amelius 5y ago
> This is a good thing. Combined with remote lock, it renders stolen devices useless. Perhaps for consumer use. However, we're talking about business use of these devices, but it is clear that these devices are not made for this context where in most cases you don't want the devices tied to a specific person (but rather a specific role). Using Apple and Google devices for work just sucks.
AnonHP 5y ago
> This is a good thing. Combined with remote lock, it renders stolen devices useless. I’ve heard a long, long time ago that the market for stolen devices had switched to stripping them for parts rather than selling them as working replacement devices. From that perspective, activation locks don’t help much. For thieves, even if some parts won’t work, any gain is better than nothing.
- mooman219 5y ago
  I disagree, it sounds like if you steal a device, the best you can do is part it out because of the activation lock. That raises the barrier to entry (must be able to part out the device or add a middle man), lowers the margin per device , making the endeavor much less attractive overall. I'd be willing to wager this reduces stolen devices in aggregate.

mjevans 5y ago

No, it's not a good thing. The Factory Reset process is defective. It SHOULD ask the user if they are selling, giving away, or otherwise disposing of the device; or otherwise just want to remove that device from their account.

marginalia_nu 5y ago
This works well because pickpockets are well known for their inability to tell lies, and would always answer truthfully.
- ben_w 5y ago
  Sarcasm accepted, but you can require the account password to proceed with the reset when the user makes that choice.
  - LeoPanthera 5y ago
    It does. That is exactly what it does.
    - ben_w 5y ago
      Good to know; but why are you and @swiftcoder saying apparently different things? [0] I’m on iOS, so I can’t test this myself. [0] https://news.ycombinator.com/item?id=30777197 https://news.ycombinator.com/item?id=30777197
      - LeoPanthera 5y ago
        He's talking about Android, I'm talking about iOS. I don't know what Android does, and I'm sure that it's device-specific anyway, unlike iPhones.
        ben_w 5y ago
        Ah, I thought what I was responding to was talking about Android. I can see now this was not necessarily the case.
easton 5y ago
It does. "Erase all content and settings" prompts the user to enter their password to disable Find My iPhone, and if you do it through iTunes, once the phone reboots into the clean OS it prompts on the computer to type the credentials in. You could refuse to type the credentials in leaving it locked, but Apple is pretty informative throughout the process. (You can also remove it from Find My iPhone on the web and it unlocks the device even if you don't have it anymore)
- swiftcoder 5y ago
  Note that Android doesn't ask the same thing (and especially not if you initiate factory reset from the bootloader, as tech folks are prone to do).

josefx 5y ago

Couldn't this be done using a reset password shipped with the phone? There is no reason to involve a third party at all.

danuker 5y ago
How would the phone check whether it's stolen, without a third party, and without the user knowing the password (or lock screen pattern)?
- josefx 5y ago
  The thief wouldn't have the reset password?
  - wyattpeak 5y ago
    After two or three years, neither would the owner. Edit: More seriously, if they took this approach, people would regularly lose their codes, which would necessitate a backup means of obtaining it. Which would no doubt require the purchaser log into their Google account. And we're back at square one.
    - josefx 5y ago
      > After two or three years, neither would the owner. It might surprise you, but back before games where always online everyone had to keep track of license keys. Still have a box with all of them. Only those that required feedback from activation servers are now useless because the companies killed the servers.
      - mh- 5y ago
        And I misplaced a few CD keys over the years, and sometimes even repurchased the game for $20-50. Modern phones are closer to $1000.
      - hutzlibu 5y ago
        Some I still have, too. But even back then, I just looked for a key online, than bothered searching. That was way quicker ... you didn't even had to go to any dark sites. Google showed them right upfront. (for single player games)

thaumasiotes 5y ago

> This is a good thing. Combined with remote lock, it renders stolen devices useless. Of course it's not a good thing. What Apple can do to someone else at your request, they can do to you on their own initiative.

LeoPanthera 5y ago
Yes. And your cellular provider could send text messages "from" you. Your email host could randomly delete all your emails. Your credit card provider could buy stuff on your account. But they don't because they're all enormous companies with thousands of employees. The negative PR would be instant and overwhelming, and the sheer amount of staff would render trying to do it secretly, ineffective. There is cautious, and there is paranoid.
- thaumasiotes 5y ago
  > Your credit card provider could buy stuff on your account. This example is unlike the others; your credit card provider already buys everything that goes on your account. For that to make any sense, they'd need to convince you to pay them "back". > But they don't because they're all enormous companies with thousands of employees. The negative PR would be instant and overwhelming, and the sheer amount of staff would render trying to do it secretly, ineffective. And this is just untrue. Nobody even remembers Amazon retroactively deleting sold copies of 1984 from their customers' internet-connected Kindles. We're swimming in devices that the manufacturer won't let us access right now, but the PR hit from doing what they're already doing is too large for them to... continue doing it?
  - butlerm 5y ago
    Credit card providers not only do not buy anything that goes on your account, they do not pay for anything that goes on your account. They transfer funds for purchases that you make, and make payments on your behalf. As such they are neither the buyer nor the payor in any credit card transaction.
    - 5y ago

b3lvedere 5y ago

"This is a good thing. Combined with remote lock, it renders stolen devices useless." My personal opinions on this: Factory reset should mean 'just like when it came out of the factory brand new'. So no hidden keys, certificates, connections, locks or other dependencies. Either change the definition or do not call it factory reset. If people will not be able to factory reset a device, please explicitly state so in the TOS. Rendering stolen devices useless may be a good thing security wise, but it is horrible for things like the ability to recycle and reuse. There are tons of procedures to make pretty sure devices are wiped completely from any sort of data. Why is this not enough? I have had to destroy thousands of devices that could have a happy second (completely unsupported and no warranty whatosever) life at various projects. I'm not proud of it.

taneq 5y ago
> There are tons of procedures to make pretty sure devices are wiped completely from any sort of data. Why is this not enough? It sucks, but it's not enough because it doesn't remove the incentive to steal the device in the first place. If you want someone to plonk down $2k for a fancy phone, you'd better be able to (a) convince them that they'll be able to re-sell it for a good chunk of that amount, and (b) at the same time reassure them that there's no point anyone stealing their expensive new toy, which means they aren't just painting a giant target on their head. If the thousands of devices you mention were legitimately obtained, why were they locked with account credentials that you didn't have? Or were they recovered from dumped recycling or something?
- b3lvedere 5y ago
  "If the thousands of devices you mention were legitimately obtained, why were they locked with account credentials that you didn't have? Or were they recovered from dumped recycling or something?" Oh that was not only smartphones, but also data carriers like harddisks and usb sticks. Apologies for not clarifying. Nevertheless valid points indeed. Regarding smartphones people just forgot or died. Most of them 'assumed IT would have some way of recovering them so they did not bother'.

raxxorrax 5y ago

Really depends if it really is a good thing. Stolen devices are an edge case and devices bricked because of such protection are probably numerous.

taneq 5y ago
Stolen devices are an edge case because it removes the incentive to steal the devices. Back when mobile phones first started becoming popular they were an equally popular smash-and-grab item. Now? Not so much.
- raxxorrax 5y ago
  But most phones don't have physical reset buttons, so all of them have this kind of protection without the shenanigans of account de-association.
  - swiftcoder 5y ago
    Are there any extant android devices that can't be factory reset from the bootloader menu?
- AnonHP 5y ago
  Devices are (and have been) stolen and sold to strip them for parts. The value may be lower, but it’s nowhere close to zero.

oyebenny 5y ago

What if this was a dark pattern implemented so that people will generate more useless phones and will have to purchase new ones all the time?

amelius 5y ago

> This is a good thing. Combined with remote lock, it renders stolen devices useless. Perhaps for consumer use. However, we're talking about business use of these devices, but it is clear that these devices are not made for this context where in most cases you don't want the devices tied to a specific person (but rather a specific role). Using Apple and Google devices for work just sucks.

AnonHP 5y ago

> This is a good thing. Combined with remote lock, it renders stolen devices useless. I’ve heard a long, long time ago that the market for stolen devices had switched to stripping them for parts rather than selling them as working replacement devices. From that perspective, activation locks don’t help much. For thieves, even if some parts won’t work, any gain is better than nothing.

mooman219 5y ago
I disagree, it sounds like if you steal a device, the best you can do is part it out because of the activation lock. That raises the barrier to entry (must be able to part out the device or add a middle man), lowers the margin per device , making the endeavor much less attractive overall. I'd be willing to wager this reduces stolen devices in aggregate.