3 ms·

I don’t like saying this, but the way solutions like this are presented makes me really uneasy. I think it’s a laudable effort, and it’s noble that the authors

I don’t like saying this, but the way solutions like this are presented makes me really uneasy. I think it’s a laudable effort, and it’s noble that the authors want to reduce e-waste, but I feel like they should make really clear right at the outset that at least some of the features they take for granted are negated by this. I’m thinking most specifically about the integrity and security guarantees around enclaves and official vendor patch support (i.e. the things most users wouldn’t realise were missing and could endanger them). I would assume once this ships it’ll be able to update same as any other linux device (with security and feature patches), but the average user may not realise how much those updates were protecting them. There’s also likely to be a very vulnerable gap between Linux and the hardware elements that will need to remain open because that’s what the exploit relied on in the first place (in this case, checkra1n, if I’m reading it correctly).

hsbauauvhabzb 4y ago
Can you provide any case studies where enthusiast ports of embedded devices were exploited en masse in the way you seem concerned about?
- highwaylights 4y ago
  I feel like this is a bad faith argument. Enthusiast ports are already niche, and therefore not lucrative targets. This project has stated that a long term goal is keeping the many iPads that have fallen out of support in service. If they’re successful in that goal, it’s no longer niche, and therefore is more worthy of a target for attacking.
  - hsbauauvhabzb 4y ago
    Do you believe this would ever become mainstream enough for that to happen? Malware on macOS is fairly rare despite a significant market share.
trasz 4y ago
Aren't security enclaves used mostly for things like banking apps, instead of the parts of security that actually matter to end users?
- Gigachad 4y ago
  Not sure about you, but I'd say banking apps being more secure is a benefit to me. Its were stuff like the encryption keys for FaceID sit. It's pretty much the only reason that while plenty of iPhone low level exploits get found, none of them ever expose your encryption key.

hsbauauvhabzb 4y ago

Can you provide any case studies where enthusiast ports of embedded devices were exploited en masse in the way you seem concerned about?

highwaylights 4y ago
I feel like this is a bad faith argument. Enthusiast ports are already niche, and therefore not lucrative targets. This project has stated that a long term goal is keeping the many iPads that have fallen out of support in service. If they’re successful in that goal, it’s no longer niche, and therefore is more worthy of a target for attacking.
- hsbauauvhabzb 4y ago
  Do you believe this would ever become mainstream enough for that to happen? Malware on macOS is fairly rare despite a significant market share.

trasz 4y ago

Aren't security enclaves used mostly for things like banking apps, instead of the parts of security that actually matter to end users?

Gigachad 4y ago
Not sure about you, but I'd say banking apps being more secure is a benefit to me. Its were stuff like the encryption keys for FaceID sit. It's pretty much the only reason that while plenty of iPhone low level exploits get found, none of them ever expose your encryption key.