3 ms·

Yeah, extra work for overworked IT departments. I'm sure they'll be happy to add extra work they dont have to do. Ive worked with second hand devices for a lon

Yeah, extra work for overworked IT departments. I'm sure they'll be happy to add extra work they dont have to do. Ive worked with second hand devices for a long time. Ive had many come through that have activation/MDM/etc locks and have tried calling the IT dept they came from and all but about one time they pretty much just laughed at me or just played dumb about it entirely. Apple and other vendors were no help in this as they just tell you to contact the original owner.

jb1991 4y ago
>Yeah, extra work for overworked IT departments. I'm sure they'll be happy to add extra work they dont have to do. But at the benefit of less-burdened security teams, and greatly enhanced peace of mind for users and info-sensitive organizations? You can argue it's taking something highly risky like security and shifting those man hours to something not as threatening.
- imwillofficial 4y ago
  The world changes and so do procedures.
- krolden 4y ago
  Most Security Depts were just fine with HDD/ssd destruction. With new apple machines there is no possibility of this.
  - jb1991 4y ago
    But security is about more than what you do at the end of a machine’s ownership, it’s all the things you have to consider while the machine is out in the world with very sensitive information on it. And now those security departments have much less to worry about because of this security architecture in the chip. As the sibling commenter points out, this should also result in less waste as those drives do not need to be destroyed if the device is properly unlocked.
    - krolden 4y ago
      What information would be recoverable without the storage device? ROM dumps? I doubt the majority of these computers are running any super secret firmware and if they are I assume there would be extra precautions taken when its EoL.
      - katbyte 4y ago
        The problem isn’t retiring devices it is stolen or lost devices. Anything that makes it harder for thieves or protects my data is a huge win for me.
      - jb1991 4y ago
        I'm talking about machines in active use that are out in the world, with their owners -- security teams have much less to worry about than they used to, as the modern Apple security architecture takes much of the burden off them.
  - coder543 4y ago
    > With new apple machines there is no possibility of this. It isn't necessary to destroy the physical media anymore, so that reduction in e-waste is fine with me. Just properly erase the device by clicking the button in settings.
  - can16358p 4y ago
    And there is a perfectly secure way of having FileVault always on by default, and by rotating the keys, you are effectively "destroying" all the data on them anyway, with the bonus of not physically harming anything. Unless, cryptography itself is broken... which would bring much wider-scale problems than destroying information on old drives anyway.
    - katbyte 4y ago
      Without activation lock thieves would be more included to steal MacBooks. I’m all for making it impossible for them to use stolen devices.
      - krolden 4y ago
        They steal them anyway tho.
coder543 4y ago
The only actual step is to click "Erase All Content and Settings", aka. wipe the machine, which is what every sane IT department should do when decommissioning a device. Assuming they're using any kind of MDM solution, they can do it with one click through their MDM. The IT department has no idea what kind of password that user was using, and they have no idea what kind of valuable data is on that machine. If that user's password was just "password" (or sticky-noted next to the trackpad), that IT department is going to get in serious trouble once all that proprietary data ends up in the wrong hands, if they didn't wipe the machine before handing it off to a third party. If wiping the machine before getting rid of it is "extra work", then that IT department isn't doing their jobs to begin with. I'm certain such IT departments exist, but that's not enough of a reason to make theft easier.
- eproxus 4y ago
  That is not enough. You have to remove the device from your iCloud account too. Source: just wiped and sent back a MacBook Air to my old workspace. My colleague finished the macOS setup and logged in with their iCloud account. After resetting it again (to re-do the setup in the way they wanted) it was locked to my account. So not even installing macOS and logging in to iCloud will bind the machine to you. Imagine doing that with a machine you bought second hand and the original owner can’t be reached anymore.
  - madeofpalk 4y ago
    Clicking that button will prompt you through deactivating Activation Lock.
  - coder543 4y ago
    No, that button is enough. That button did not exist on older versions, so you definitely did not click it if it did not work. If you're running the version of macOS that was released over a year ago (Monterey) or running Ventura (released more recently), then the button will exist. https://support.apple.com/en-us/HT208987 https://support.apple.com/en-us/HT208987 "Other ways to disable Activation Lock" "Activation Lock is disabled when you use the Erase All Content and Settings feature." Apple confirms that the feature works exactly as I said and exactly as users expect. I've used it myself, and it does work. Users running software that is several major versions out of date will have a more difficult experience, since that button did not exist, and they would have to first remove Activation Lock before going into Recovery Mode to manually format the Mac. Those are the remaining steps that were linked several comments up from here: https://news.ycombinator.com/item?id=34505523 https://news.ycombinator.com/item?id=34505523 Apple has made the process as easy as it possible can be now, identical to the process used to factory reset an iPhone.
tr81 4y ago
I rather IT is forced to properly reset laptops even if takes longer because there has been too many incidents of data leaks when IT doesn't take time to properly remove data before donating laptops.
aeadio 4y ago
I've worked with some of these responsible recyclers before. Everyone knows the deal. If you want IT asset disposition, it'll nominally cost you -- for pickup and processing, and optional value-adds like secure data destruction certificates. If the assets have remarket value, that can begin to subsidize the cost, easily zeroing it out, or even returning profit to the IT department. Recyclers are happy to pay IT departments to pick up their old Apple equipment -- and they know to ask ahead of time, "are these activation locked?" These recyclers often have vertical integration on the refurbishing side, running an Amazon eCommerce department so they can directly capture that remarket value. And once they've got that going, their bottleneck to growth is how much material they can bring in -- which is never enough. So the recyclers and refurbishers invariably need to buy material from other recyclers. There's an entire economy around selling pallet-fulls of used, minimally-inspected or completely "as is", Apple and PC equipment. Specialized invite-only communities exist for selling this material in bulk, with lots of overseas actors in on the game. Every R2 recycler is involved here, along with lots of actors from India and China in particular. Having seen inside that sausage factory, fraud and theft is a legitimate problem. There's more than a fair share of "don't ask questions". More than a fair share of "yup we're definitely R2 certified, wink wink". More than a fair share of wining and dining the R2 auditors to get that certificate under the table in the first place. I'm gonna go with the GP comment here -- the system is working as intended. Industrialized theft of this sort is much more eminently solvable through technological means than through overstretched law enforcement, especially when a non-negligible amount of material comes from overseas. It's on the IT departments to figure out if they have enough time to activation-unlock their assets before disposition. Do they want to pay the recycler to pick up all that material, or do they want to sell the material and pad their budget? A quick look at the Jamf documentation suggests it's pretty easy to mass unlock these devices, so I'm not buying that it's that much of a strain.
gowld 4y ago
Adding $100 in value for 5 minutes of work seems like a good investment. They could pay gig workers to push the buttons.
vr46 4y ago
Hardware lifecycle process may vary but it still needs to be accounted for. The activation lock removal is hardly an obscure hack, this is a process failure. Good on Apple for making these machines take their secrets to the grave.
wkat4242 4y ago
For IT departments there is a way to request a reset from apple if you have apple enterprise support and can prove that the device is yours. It has to be in DEP or you have to send them an invoice.
simplotek 4y ago
> Yeah, extra work for overworked IT departments. I'm not sure you're being serious. Wiping a laptop before getting rid of it is SOP for a IT department. This is hardly a new requirement. Again, the only people impacted are those who want to leverage their ability to take over a laptop without authorization.

jb1991 4y ago

>Yeah, extra work for overworked IT departments. I'm sure they'll be happy to add extra work they dont have to do. But at the benefit of less-burdened security teams, and greatly enhanced peace of mind for users and info-sensitive organizations? You can argue it's taking something highly risky like security and shifting those man hours to something not as threatening.

imwillofficial 4y ago
The world changes and so do procedures.
krolden 4y ago
Most Security Depts were just fine with HDD/ssd destruction. With new apple machines there is no possibility of this.
- jb1991 4y ago
  But security is about more than what you do at the end of a machine’s ownership, it’s all the things you have to consider while the machine is out in the world with very sensitive information on it. And now those security departments have much less to worry about because of this security architecture in the chip. As the sibling commenter points out, this should also result in less waste as those drives do not need to be destroyed if the device is properly unlocked.
  - krolden 4y ago
    What information would be recoverable without the storage device? ROM dumps? I doubt the majority of these computers are running any super secret firmware and if they are I assume there would be extra precautions taken when its EoL.
    - katbyte 4y ago
      The problem isn’t retiring devices it is stolen or lost devices. Anything that makes it harder for thieves or protects my data is a huge win for me.
    - jb1991 4y ago
      I'm talking about machines in active use that are out in the world, with their owners -- security teams have much less to worry about than they used to, as the modern Apple security architecture takes much of the burden off them.
- coder543 4y ago
  > With new apple machines there is no possibility of this. It isn't necessary to destroy the physical media anymore, so that reduction in e-waste is fine with me. Just properly erase the device by clicking the button in settings.
- can16358p 4y ago
  And there is a perfectly secure way of having FileVault always on by default, and by rotating the keys, you are effectively "destroying" all the data on them anyway, with the bonus of not physically harming anything. Unless, cryptography itself is broken... which would bring much wider-scale problems than destroying information on old drives anyway.
  - katbyte 4y ago
    Without activation lock thieves would be more included to steal MacBooks. I’m all for making it impossible for them to use stolen devices.
    - krolden 4y ago
      They steal them anyway tho.

coder543 4y ago

The only actual step is to click "Erase All Content and Settings", aka. wipe the machine, which is what every sane IT department should do when decommissioning a device. Assuming they're using any kind of MDM solution, they can do it with one click through their MDM. The IT department has no idea what kind of password that user was using, and they have no idea what kind of valuable data is on that machine. If that user's password was just "password" (or sticky-noted next to the trackpad), that IT department is going to get in serious trouble once all that proprietary data ends up in the wrong hands, if they didn't wipe the machine before handing it off to a third party. If wiping the machine before getting rid of it is "extra work", then that IT department isn't doing their jobs to begin with. I'm certain such IT departments exist, but that's not enough of a reason to make theft easier.

eproxus 4y ago
That is not enough. You have to remove the device from your iCloud account too. Source: just wiped and sent back a MacBook Air to my old workspace. My colleague finished the macOS setup and logged in with their iCloud account. After resetting it again (to re-do the setup in the way they wanted) it was locked to my account. So not even installing macOS and logging in to iCloud will bind the machine to you. Imagine doing that with a machine you bought second hand and the original owner can’t be reached anymore.
- madeofpalk 4y ago
  Clicking that button will prompt you through deactivating Activation Lock.
- coder543 4y ago
  No, that button is enough. That button did not exist on older versions, so you definitely did not click it if it did not work. If you're running the version of macOS that was released over a year ago (Monterey) or running Ventura (released more recently), then the button will exist. https://support.apple.com/en-us/HT208987 https://support.apple.com/en-us/HT208987 "Other ways to disable Activation Lock" "Activation Lock is disabled when you use the Erase All Content and Settings feature." Apple confirms that the feature works exactly as I said and exactly as users expect. I've used it myself, and it does work. Users running software that is several major versions out of date will have a more difficult experience, since that button did not exist, and they would have to first remove Activation Lock before going into Recovery Mode to manually format the Mac. Those are the remaining steps that were linked several comments up from here: https://news.ycombinator.com/item?id=34505523 https://news.ycombinator.com/item?id=34505523 Apple has made the process as easy as it possible can be now, identical to the process used to factory reset an iPhone.

tr81 4y ago

I rather IT is forced to properly reset laptops even if takes longer because there has been too many incidents of data leaks when IT doesn't take time to properly remove data before donating laptops.

aeadio 4y ago

I've worked with some of these responsible recyclers before. Everyone knows the deal. If you want IT asset disposition, it'll nominally cost you -- for pickup and processing, and optional value-adds like secure data destruction certificates. If the assets have remarket value, that can begin to subsidize the cost, easily zeroing it out, or even returning profit to the IT department. Recyclers are happy to pay IT departments to pick up their old Apple equipment -- and they know to ask ahead of time, "are these activation locked?" These recyclers often have vertical integration on the refurbishing side, running an Amazon eCommerce department so they can directly capture that remarket value. And once they've got that going, their bottleneck to growth is how much material they can bring in -- which is never enough. So the recyclers and refurbishers invariably need to buy material from other recyclers. There's an entire economy around selling pallet-fulls of used, minimally-inspected or completely "as is", Apple and PC equipment. Specialized invite-only communities exist for selling this material in bulk, with lots of overseas actors in on the game. Every R2 recycler is involved here, along with lots of actors from India and China in particular. Having seen inside that sausage factory, fraud and theft is a legitimate problem. There's more than a fair share of "don't ask questions". More than a fair share of "yup we're definitely R2 certified, wink wink". More than a fair share of wining and dining the R2 auditors to get that certificate under the table in the first place. I'm gonna go with the GP comment here -- the system is working as intended. Industrialized theft of this sort is much more eminently solvable through technological means than through overstretched law enforcement, especially when a non-negligible amount of material comes from overseas. It's on the IT departments to figure out if they have enough time to activation-unlock their assets before disposition. Do they want to pay the recycler to pick up all that material, or do they want to sell the material and pad their budget? A quick look at the Jamf documentation suggests it's pretty easy to mass unlock these devices, so I'm not buying that it's that much of a strain.

gowld 4y ago

Adding $100 in value for 5 minutes of work seems like a good investment. They could pay gig workers to push the buttons.

vr46 4y ago

Hardware lifecycle process may vary but it still needs to be accounted for. The activation lock removal is hardly an obscure hack, this is a process failure. Good on Apple for making these machines take their secrets to the grave.

wkat4242 4y ago

For IT departments there is a way to request a reset from apple if you have apple enterprise support and can prove that the device is yours. It has to be in DEP or you have to send them an invoice.

simplotek 4y ago

> Yeah, extra work for overworked IT departments. I'm not sure you're being serious. Wiping a laptop before getting rid of it is SOP for a IT department. This is hardly a new requirement. Again, the only people impacted are those who want to leverage their ability to take over a laptop without authorization.