5 ms·

Apple’s Activation Lock lead to a substantial drop in smartphone theft worldwide. That’s something worthy of consideration. Apple must not re-incentivize phone

Apple’s Activation Lock lead to a substantial drop in smartphone theft worldwide. That’s something worthy of consideration. Apple must not re-incentivize phone theft to harvest parts. https://techcrunch.com/2015/02/11/apples-activation-lock-leads-to-big-drops-in-smartphone-theft-worldwide/ https://techcrunch.com/2015/02/11/apples-activation-lock-lea...

freedomben 4y ago
This is a really good point. Thanks for sharing. I'm highly critical of Apple for their practices, but this is great food for thought. I'm gonna have to marinade that for a bit and re-evaluate my position. Could they still do it for Apple official parts without locking out 3rd parties? i.e. if an official screen that was previously registered to a different phone, then lock it out. If it's never been registered, then allow it?
ChuckNorris89 4y ago
But what if I want to transplant a part from my old phone to a phone same model that I both legitimately own? Why should Apple be the one to stop me? Why not let the user enable/disable the SW lock, like a lo-jack? Do you live in an area where phone theft is rampant? Ok, then leave SW lock enabled on your phone's parts. Do you want to legitimately transplant parts off your old phone to your new phone? Then let the user disable the SW lock after entering their PIN or Face-ID or whatever. It's not like this is some super-complex problem Apple couldn't solve with a few line of code to have the best of bot worlds if they really wanted to.
- noptd 4y ago
  Exactly, it's such an easy problem to solve if you're actually interested in solving it which makes it quite obvious that Apple isn't.
cruano 4y ago
I got mugged a couple years ago, or attempted to: The thief asked for my phone, saw it was an iPhone and just gave it back. That to me is worth the whole phone bricking thing. And it's also not like I've gone through a bunch of them, I got a 6S on release and a 12 pro when I felt it couldn't play video games anymore.
- bogwog 4y ago
  For ~$90 I can buy a screen programmer online to transfer serial numbers between screens and bypass the locking thing. If I buy a phone with a broken screen online for cheap, I can put your good one on it (by writing the serial number from the cracked screen onto the stolen screen) and then resell it as a fully functional refurbished/used iPhone for a decent profit. ...and if I'm too lazy to do that, I can still sell it for parts online since less lazy people who know how to do that will buy it for the same reason.
altairprime 4y ago
It also considerably reduces the ability of nation-state attackers to replace parts with modified hardware without your knowledge, as Apple can detect and terminate misuse of the tool that creates new cryptographic signing keys for the pairing of phone and part. We saw signed-pairing appear with the Touch ID system in response to Apple learning of nation-state attacks on the iPhone that used hardware modifications. To date, no HN discussion of this crypto-pairing of the phone to its parts has revealed an alternative solution that would be effective at Apple’s scale for preventing phones from being hacked by a parts swap while also allowing any part to be swapped in — not to mention while providing the anti-theft benefits described upthread. I’d love to see a viable alternative solution described, if anyone has one.
- jorvi 4y ago
  > To date, no HN discussion of this crypto-pairing of the phone to its parts has revealed an alternative solution that would be effective at Apple’s scale for preventing phones from being hacked by a parts swap while also allowing any part to be swapped in Random-ass repair shops are not going to expend the effort of putting in fake parts to hack you to.. hack a couple of thousand dollars off of your account and then get caught due to it easily being traceable to the repair shop? The only people who need protection from hardware-swap hacks are people like journalists. And if you are one, you shouldn’t be giving people physical access to your device regardless. Here is a simple solution: give the normal user (after a passcode unlock) a pop-up: ‘your X has been replaced. Do you wish to authorize this new part for use with your iPhone?’. Make it so that if your phone is set to the new Lockdown mode, you cannot authorize any new parts.
  - altairprime 4y ago
    Anyone crossing a border where a nation state takes physical possession of their device is, currently, protected. The US border authorities have a very awful policy of storing data they’ve stolen for up to 15 years, and other US federal authorities have been previously caught using hardware modifications to hack devices. Anyone within 100 miles of a US border is subject to seizure and search under US law, which is approximately one-fifth of the country, including SF tech workers and NYC fintech workers. These protections apply to considerably more of one country’s populace than would benefit from off-market parts being usable at third-party repair shops. I appreciate Apple’s choice to prioritize in this regard, but I’d still like to see if tech can overcome this barrier without sacrificing that safety.
noptd 4y ago
Activation lock is effectively a remote kill switch, which have nothing to do with the topic at hand.

freedomben 4y ago

This is a really good point. Thanks for sharing. I'm highly critical of Apple for their practices, but this is great food for thought. I'm gonna have to marinade that for a bit and re-evaluate my position. Could they still do it for Apple official parts without locking out 3rd parties? i.e. if an official screen that was previously registered to a different phone, then lock it out. If it's never been registered, then allow it?

ChuckNorris89 4y ago

But what if I want to transplant a part from my old phone to a phone same model that I both legitimately own? Why should Apple be the one to stop me? Why not let the user enable/disable the SW lock, like a lo-jack? Do you live in an area where phone theft is rampant? Ok, then leave SW lock enabled on your phone's parts. Do you want to legitimately transplant parts off your old phone to your new phone? Then let the user disable the SW lock after entering their PIN or Face-ID or whatever. It's not like this is some super-complex problem Apple couldn't solve with a few line of code to have the best of bot worlds if they really wanted to.

noptd 4y ago
Exactly, it's such an easy problem to solve if you're actually interested in solving it which makes it quite obvious that Apple isn't.

cruano 4y ago

I got mugged a couple years ago, or attempted to: The thief asked for my phone, saw it was an iPhone and just gave it back. That to me is worth the whole phone bricking thing. And it's also not like I've gone through a bunch of them, I got a 6S on release and a 12 pro when I felt it couldn't play video games anymore.

bogwog 4y ago
For ~$90 I can buy a screen programmer online to transfer serial numbers between screens and bypass the locking thing. If I buy a phone with a broken screen online for cheap, I can put your good one on it (by writing the serial number from the cracked screen onto the stolen screen) and then resell it as a fully functional refurbished/used iPhone for a decent profit. ...and if I'm too lazy to do that, I can still sell it for parts online since less lazy people who know how to do that will buy it for the same reason.

altairprime 4y ago

It also considerably reduces the ability of nation-state attackers to replace parts with modified hardware without your knowledge, as Apple can detect and terminate misuse of the tool that creates new cryptographic signing keys for the pairing of phone and part. We saw signed-pairing appear with the Touch ID system in response to Apple learning of nation-state attacks on the iPhone that used hardware modifications. To date, no HN discussion of this crypto-pairing of the phone to its parts has revealed an alternative solution that would be effective at Apple’s scale for preventing phones from being hacked by a parts swap while also allowing any part to be swapped in — not to mention while providing the anti-theft benefits described upthread. I’d love to see a viable alternative solution described, if anyone has one.

jorvi 4y ago
> To date, no HN discussion of this crypto-pairing of the phone to its parts has revealed an alternative solution that would be effective at Apple’s scale for preventing phones from being hacked by a parts swap while also allowing any part to be swapped in Random-ass repair shops are not going to expend the effort of putting in fake parts to hack you to.. hack a couple of thousand dollars off of your account and then get caught due to it easily being traceable to the repair shop? The only people who need protection from hardware-swap hacks are people like journalists. And if you are one, you shouldn’t be giving people physical access to your device regardless. Here is a simple solution: give the normal user (after a passcode unlock) a pop-up: ‘your X has been replaced. Do you wish to authorize this new part for use with your iPhone?’. Make it so that if your phone is set to the new Lockdown mode, you cannot authorize any new parts.
- altairprime 4y ago
  Anyone crossing a border where a nation state takes physical possession of their device is, currently, protected. The US border authorities have a very awful policy of storing data they’ve stolen for up to 15 years, and other US federal authorities have been previously caught using hardware modifications to hack devices. Anyone within 100 miles of a US border is subject to seizure and search under US law, which is approximately one-fifth of the country, including SF tech workers and NYC fintech workers. These protections apply to considerably more of one country’s populace than would benefit from off-market parts being usable at third-party repair shops. I appreciate Apple’s choice to prioritize in this regard, but I’d still like to see if tech can overcome this barrier without sacrificing that safety.

noptd 4y ago

Activation lock is effectively a remote kill switch, which have nothing to do with the topic at hand.