5 ms·
This tweet has made the rounds, but it’s wrong in its claims about Secure Boot. Your claim that protection against physical presence is novel to ARM Apple devic
by legalcorrection 5y ago
This tweet has made the rounds, but it’s wrong in its claims about Secure Boot. Your claim that protection against physical presence is novel to ARM Apple devices is also mistaken. See my comments in a previous thread:
https://news.ycombinator.com/item?id=30738720 https://news.ycombinator.com/item?id=30738720
https://news.ycombinator.com/item?id=30738679 https://news.ycombinator.com/item?id=30738679
Extracting the relevant bits and cleaning them up:
Macs/iOS devices and PCs—through the Secure Enclave and TPM/Secure Boot/Bitlocker, respectively—offer really good protection against physical access attacks. They verify the integrity of boot components and are only able to decrypt the system volume if they detect an untampered boot chain. Further, they can lock down direct memory access to protect powered-on systems from bypasses to user authentication. This is why nowadays, if a thief steals your laptop and you had the hard drive encryption with hardware security features on (on Windows, if you set up with a Microsoft Account, this is enabled without any further action by the user), you can feel fairly secure that even a technically savvy thief cannot access your data.
And:
This tweet is wrong when it claims that Secure Boot does not protect against physical presence attacks. This misunderstands the point of Secure Boot.
Secure Boot can indeed be disabled, but that will change the TPM PCR values, so assuming a standard BitLocker configuration, the TPM will fail to unlock the BitLocker key. So if you try to disable Secure Boot on such a machine, you will be unable to boot or otherwise access that volume (even with another machine) unless you have the BitLocker recovery key.
- deleted 5y ago[deleted]
- GeekyBear 5y ago>on Windows, if you set up with a Microsoft Account, this is enabled What if the user is sane?
- legalcorrection 5y ago>What if the user is sane? I assume you mean by not using a Microsoft Account to sign in to the machine. In that case, you literally just right click on the OS drive and click Turn On Bitlocker. It asks you where to save a recovery key and then you’re good to go.
- GeekyBear 5y agoOn the ARM Mac, you are secure by default, without handing your disk recovery key to Microsoft by default.
- legalcorrection 5y agoSecure against what? Security isn’t a free floating quantity, it only exists in relation to particular threat models. Microsoft has, I think rightly, calculated that the risk of losing access their data is worse for most users than the risk that the government gets a warrant for their recovery key. And if you want to protect against the government, then it’s really easy to set up Bitlocker to not backup to MS. You can change the key with one or two commands, or with a GUI, even if you use a Microsoft account to sign in. In any case, I’m not saying the Bitlocker design is perfect. There are good arguments to be made in favor of the iOS or Mac models (which are slightly different, even to each other). Microsoft also has the unenviable problem of dealing with shitty OEMs with buggy firmwares that change the PCR values unexpectedly, locking users out of their data and requiring a recovery key. But your original claim—that physical attack protection is novel to ARM-based Apple devices—is just completely wrong.
- GeekyBear 5y agoSorry, but a system with that many caveats, is not the same thing.
- legalcorrection 5y agoLol it doesn’t have “many caveats” at all. But go ahead and keep spreading false information if you want.
- smoldesu 5y agoCan you prove that Apple doesn't have recovery keys/backdoor access, or is that conjecture?
- 5y ago
- nottorp 5y agoPhysical presence attacks against your mac studio that just sits on your desk in your presumably locked house, yeah. Useful.
- legalcorrection 5y agoNot a crazy thing tbh. Say you and your wife exchange some nudes, maybe make a sex tape (bad idea, but people do it). You put it on your Mac. Many people would rather have everything in their house stolen than let those nudes fall into the wrong hands. But yes, the more typical scenario envisioned when developing these systems is laptop theft, unattended office PCs (e.g. theft or snooping by contractors), etc.
- wongarsu 5y agoIf you use that Mac Studio for work that's a valid attack scenario. In a targeted attack it isn't unheard of that hackers do physical attacks as part of the attack chain.
- foobiekr 5y agoEvil maid attacks are real.
- sgarman 5y agoI had filevault enabled on every mac I owned for this reason - but now it's not clear to me if I still need to do that with the new macs. Does the current defaults prevent someone from ripping out the drive and reading it or do you still need to turn filevault on?
- gjsman-1000 5y agoFalse. Windows Home does not come with encryption, Windows Pro has it but it is optional and disabled by default. Also, Secure Boot uses generic keys which some Linux distributions are also signed with, so if I steal a piece of hardware, there is a 90%+ chance I can just boot Linux and dump the disk contents unencrypted. And if it is encrypted, I could still boot Linux leaving Secure Boot intact, and try glitching the TPM which has been well-documented as quite possible.
- legalcorrection 5y agoNot quite. Windows Home automatically enables disk encryption if you sign in with a Microsoft account (and the device has a TPM 2.0 and Secure Boot). But yes, full BitLocker functionality, such as setting up alternative decryption methods (e.g. requiring a PIN or usb key), is only available on Windows Pro and higher.
- GeekyBear 5y agoWhat happened to there not being many caveats?
- legalcorrection 5y ago>ARM Macs have a new security feature we haven't seen previously. They are built to resist attackers who have physical access to the hardware. That’s what you said and it’s completely and unequivocally false. No caveats.
- gjsman-1000 5y agoActually there is a caveat. With Windows laptops, rven if you cant read the data, you can wipe them and start fresh. M1 Macs are locked to their owner if left in Lost Mode and are always broadcasting Find My signals when on in that situation.
- legalcorrection 5y ago