6 ms·

I think parts blacklisting (i.e. you report a phone as stolen, all of its OEM parts are blacklisted) is good as an anti-theft measure and achieves the same func

by dannyw 3y ago

I think parts blacklisting (i.e. you report a phone as stolen, all of its OEM parts are blacklisted) is good as an anti-theft measure and achieves the same functionality. I can also understand parts pairing for Face ID for security, and maybe even the battery. I've had aftermarket battery repairs swell up, which is a safety risk. But what Apple is doing is using this as a pretense to lock down repairs.

asddubs 3y ago
I suppose the awkward part of blacklisting is that if a phone isn't immediately reported, someone may sell a stolen part to a repair business, which installs it, and then a week later the customers phone is locked down, through no fault of either the person who had their phone repaired or the repair shop
- AussieWog93 3y ago
  The customer then kicks up a fuss, the repairman realises that the part came from a stolen phone and the supplier of these parts is either reported or blacklisted by the repairman and every other repairman they know.
- rekoil 3y ago
  A repair business doing that wouldn't be in business for long though. There are APIs available for verifying whether FindMy is disabled for the device in question, that might be a better proof that the device is honestly sold to a repair shop for parts. For devices broken enough that they don't turn on there needs to be a way to remove them from FindMy without using the device though... is removing them from the list available at https://appleid.apple.com https://appleid.apple.com enough?
- Dylan16807 3y ago
  That's a situation where some kind of delay could handle it. They don't need to reuse those parts instantly. I doubt the fraction of people that report a theft after months have gone by is very big.
- Gigachad 3y ago
  They would be blacklisted by default when attached to an icloud account and then the user can release the parts by unlinking the device.
jjcon 3y ago
A lot of it is brand protection to be honest. I’ve seen so many cheap “refurbished” iPhones in the past with absolutely terrible cheap parts put in them. For end users this is most immediately apparent when the screens are 3rd party (terrible color, irregular backlighting etc) but these days it is a lot harder to use 3rd party parts. I think there is an argument to be made that these protections preserve the used Apple market because people can actually trust it for the most part (we certainly see that reflected in the prices). I imagine the lifespan of an iPhone is much longer than a comparable (by footprint) android device. I’m my mind right to repair trumps all these upsides but it isn’t as clean as it always seems imo.
- Gigachad 3y ago
  Providing the user with more information is fine and not anti repair imo. If the user boots the phone and sees a bunch of non-genuine warnings, they can know to steer clear of buying the device. The larger issue seems to be where there is calibration info that needs to be set up but only Apple has the software and tools for it.
  - deleted 3y ago
    [deleted]
  - bzzzt 3y ago
    "Providing the user with more information is fine and not anti repair imo. If the user boots the phone and sees a bunch of non-genuine warnings, they can know to steer clear of buying the device." You're assuming a technical, informed and assertive user here. There are lots of people who don't even try to turn off and on the phone when buying. Or fall for bullshit like 'it's normal, just ignore that message'. And what do you do when some repairman used a knockoff battery and is threatening with calling the police if you don't accept and pay for the 'repaired' phone?
  - jjcon 3y ago
    Agreed - I actually think that would solve a lot of this. Apple could put in as many oem checks as they want, hell, even throw a persistent warning in the settings menu or something to inform and even dissuade but they should absolutely allow it at the end of the day.
ricw 3y ago
Same applies to cameras, microphones, touchscreen, screen, buttons, or really any other sensor or chip etc that is powered and can therefore have a sneaky transmitter inserted. I don’t want someone (nsa cough) being able to sneak in their own module to follow my every whereabouts. Yes please. Check every item for authenticity. That’s why I’m an Apple customer. I’d buy android if it weren’t the case.
- fsh 3y ago
  If the NSA wanted access to your phone, they would ask Apple to push a backdoored update. No need for a James Bond level evil maid attack.
  - atraac 3y ago
    They don't need to ask for any backdoor, there are existing solutions already like Pegasus. It was recently used by Polish government ruling party to spy on opposition under the pretense of looking for 'Russian spies'. Considering our not-very-smart government managed to get it, I can bet people who are actually qualified can do much more already.
  - Thorrez 3y ago
    Didn't the FBI ask Apple to do that already and Apple refused? https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_dispute https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_d...
    - ChrisRR 3y ago
      Well those are the ones we hear about. I think there's a lot of state-level spying in many software and hardware devices, but of course we don't hear about it
      - Thorrez 3y ago
        Sure there's a lot of state-level spying. NSO Group et al. That doesn't mean Apple is complicit.
friendzis 3y ago
> I can also understand parts pairing for Face ID for security Can someone elaborate on why parts pairing is needed for biometrics? In my understanding the biometrics module can simply send raw "image" data to the CPU which then performs validation/authentication. Hardware authentication seems to be only necessary if one plans to send some precomputed data. But I don't understand the very reason behind that. To save power you don't want to run biometrics recognition all the time anyway. If the recognition task is so computationally taxing that even the very powerful CPU present in smartphone cannot provide required hard real time guarantees and therefore an ASIC/FPGA/DSP is needed, well... Apple makes custom hardware anyway, so there is no apparent penalty in embedding biometrics accelerator right into the CPU anyway.
- wilg 3y ago
  Biometrics need to be evaluated on a separate computer for security reasons. Sending them to the main CPU is a non-starter. When you do this, the parts must be securely linked otherwise you can swap the biometric system with one that is already unlocked. And, they want to ensure the Face ID dot projection and image captures come from a real camera and projector system, not some device that spoofs them. And in reverse, to prevent intercepting and capturing biometric data.
  - friendzis 3y ago
    > Biometrics need to be evaluated on a separate computer for security reasons. But why? What's the algorithm/architecture here? I am genuinely curios here. I guess we can generalize finger/face readers as multichannel cameras. What do you gain by computing a "hash" of the data (and the associated machinery to send that hash securely) versus simply sending raw data for evaluation at CPU level? In the end the CPU has to trust the data sent by peripheral anyway. I understand the use of separate compute unit when extraction of secrets must be protected, but in this case it is the CPU that protects those secrets anyway.
    - justincormack 3y ago
      The validation is done outside the CPU I believe too, that’s certainly what happens with the fingerprint reader. I think the process is documented in the secure enclave white paper
wilg 3y ago
Blacklisting is much less secure because there is a lag between theft and protection and more intrusive because it requires online activation. Parts pairing seems like a good solution if theft for components is a major issue.
TonyTrapp 3y ago
> I've had aftermarket battery repairs swell up, which is a safety risk. I've had the original, built-in-from-factory battery of a Google Pixel phone swell up. Assuming that this only happens with third-party batteries is something laptop and smartphone manufacturers try to brainwash us into thinking. Buy your third-party battery from a reputable company (not a random seller on Alibaba) and the risk will be the same as buying one from the original device manufacturer.
- Tijdreiziger 3y ago
  When you take your phone to a repair shop, you don’t know if the battery they installed is from a reputable manufacturer or a random Alibaba seller.
  - TonyTrapp 3y ago
    You can always ask. That being said, a good shop will probably not risk its reputation by installing garbage components.
    - Tijdreiziger 3y ago
      Around here most of the third-party repair shops feel pretty sketchy.
benterix 3y ago
> I've had aftermarket battery repairs swell up, which is a safety risk. My friends at support had to deal with dozens of original Apple batteries that swelled up. And, contrary to what people may think, Apple doesn't consider a swollen battery a safety issue.[0] But, for certain models, they would replace it at no fee (although such support programs have ended IIRC). [0] See e.g. here: https://discussions.apple.com/thread/251466658 https://discussions.apple.com/thread/251466658
- HWR_14 3y ago
  They don't consider all swollen batteries to be safety issues. Clearly, what that page is referring to is that a specific product line was having batteries swell up for non-safety reasons. They still got replaced, but it makes sense if Apple knows the cause and it's not safety related.

by dannyw 3y ago

asddubs 3y ago

I suppose the awkward part of blacklisting is that if a phone isn't immediately reported, someone may sell a stolen part to a repair business, which installs it, and then a week later the customers phone is locked down, through no fault of either the person who had their phone repaired or the repair shop

AussieWog93 3y ago
The customer then kicks up a fuss, the repairman realises that the part came from a stolen phone and the supplier of these parts is either reported or blacklisted by the repairman and every other repairman they know.
rekoil 3y ago
A repair business doing that wouldn't be in business for long though. There are APIs available for verifying whether FindMy is disabled for the device in question, that might be a better proof that the device is honestly sold to a repair shop for parts. For devices broken enough that they don't turn on there needs to be a way to remove them from FindMy without using the device though... is removing them from the list available at https://appleid.apple.com https://appleid.apple.com enough?
Dylan16807 3y ago
That's a situation where some kind of delay could handle it. They don't need to reuse those parts instantly. I doubt the fraction of people that report a theft after months have gone by is very big.
Gigachad 3y ago
They would be blacklisted by default when attached to an icloud account and then the user can release the parts by unlinking the device.

jjcon 3y ago

A lot of it is brand protection to be honest. I’ve seen so many cheap “refurbished” iPhones in the past with absolutely terrible cheap parts put in them. For end users this is most immediately apparent when the screens are 3rd party (terrible color, irregular backlighting etc) but these days it is a lot harder to use 3rd party parts. I think there is an argument to be made that these protections preserve the used Apple market because people can actually trust it for the most part (we certainly see that reflected in the prices). I imagine the lifespan of an iPhone is much longer than a comparable (by footprint) android device. I’m my mind right to repair trumps all these upsides but it isn’t as clean as it always seems imo.

Gigachad 3y ago
Providing the user with more information is fine and not anti repair imo. If the user boots the phone and sees a bunch of non-genuine warnings, they can know to steer clear of buying the device. The larger issue seems to be where there is calibration info that needs to be set up but only Apple has the software and tools for it.
- deleted 3y ago
  [deleted]
- bzzzt 3y ago
  "Providing the user with more information is fine and not anti repair imo. If the user boots the phone and sees a bunch of non-genuine warnings, they can know to steer clear of buying the device." You're assuming a technical, informed and assertive user here. There are lots of people who don't even try to turn off and on the phone when buying. Or fall for bullshit like 'it's normal, just ignore that message'. And what do you do when some repairman used a knockoff battery and is threatening with calling the police if you don't accept and pay for the 'repaired' phone?
- jjcon 3y ago
  Agreed - I actually think that would solve a lot of this. Apple could put in as many oem checks as they want, hell, even throw a persistent warning in the settings menu or something to inform and even dissuade but they should absolutely allow it at the end of the day.

ricw 3y ago

Same applies to cameras, microphones, touchscreen, screen, buttons, or really any other sensor or chip etc that is powered and can therefore have a sneaky transmitter inserted. I don’t want someone (nsa cough) being able to sneak in their own module to follow my every whereabouts. Yes please. Check every item for authenticity. That’s why I’m an Apple customer. I’d buy android if it weren’t the case.

fsh 3y ago
If the NSA wanted access to your phone, they would ask Apple to push a backdoored update. No need for a James Bond level evil maid attack.
- atraac 3y ago
  They don't need to ask for any backdoor, there are existing solutions already like Pegasus. It was recently used by Polish government ruling party to spy on opposition under the pretense of looking for 'Russian spies'. Considering our not-very-smart government managed to get it, I can bet people who are actually qualified can do much more already.
- Thorrez 3y ago
  Didn't the FBI ask Apple to do that already and Apple refused? https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_dispute https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_d...
  - ChrisRR 3y ago
    Well those are the ones we hear about. I think there's a lot of state-level spying in many software and hardware devices, but of course we don't hear about it
    - Thorrez 3y ago
      Sure there's a lot of state-level spying. NSO Group et al. That doesn't mean Apple is complicit.

friendzis 3y ago

> I can also understand parts pairing for Face ID for security Can someone elaborate on why parts pairing is needed for biometrics? In my understanding the biometrics module can simply send raw "image" data to the CPU which then performs validation/authentication. Hardware authentication seems to be only necessary if one plans to send some precomputed data. But I don't understand the very reason behind that. To save power you don't want to run biometrics recognition all the time anyway. If the recognition task is so computationally taxing that even the very powerful CPU present in smartphone cannot provide required hard real time guarantees and therefore an ASIC/FPGA/DSP is needed, well... Apple makes custom hardware anyway, so there is no apparent penalty in embedding biometrics accelerator right into the CPU anyway.

wilg 3y ago
Biometrics need to be evaluated on a separate computer for security reasons. Sending them to the main CPU is a non-starter. When you do this, the parts must be securely linked otherwise you can swap the biometric system with one that is already unlocked. And, they want to ensure the Face ID dot projection and image captures come from a real camera and projector system, not some device that spoofs them. And in reverse, to prevent intercepting and capturing biometric data.
- friendzis 3y ago
  > Biometrics need to be evaluated on a separate computer for security reasons. But why? What's the algorithm/architecture here? I am genuinely curios here. I guess we can generalize finger/face readers as multichannel cameras. What do you gain by computing a "hash" of the data (and the associated machinery to send that hash securely) versus simply sending raw data for evaluation at CPU level? In the end the CPU has to trust the data sent by peripheral anyway. I understand the use of separate compute unit when extraction of secrets must be protected, but in this case it is the CPU that protects those secrets anyway.
  - justincormack 3y ago
    The validation is done outside the CPU I believe too, that’s certainly what happens with the fingerprint reader. I think the process is documented in the secure enclave white paper

wilg 3y ago

Blacklisting is much less secure because there is a lag between theft and protection and more intrusive because it requires online activation. Parts pairing seems like a good solution if theft for components is a major issue.

TonyTrapp 3y ago

> I've had aftermarket battery repairs swell up, which is a safety risk. I've had the original, built-in-from-factory battery of a Google Pixel phone swell up. Assuming that this only happens with third-party batteries is something laptop and smartphone manufacturers try to brainwash us into thinking. Buy your third-party battery from a reputable company (not a random seller on Alibaba) and the risk will be the same as buying one from the original device manufacturer.

Tijdreiziger 3y ago
When you take your phone to a repair shop, you don’t know if the battery they installed is from a reputable manufacturer or a random Alibaba seller.
- TonyTrapp 3y ago
  You can always ask. That being said, a good shop will probably not risk its reputation by installing garbage components.
  - Tijdreiziger 3y ago
    Around here most of the third-party repair shops feel pretty sketchy.

benterix 3y ago

> I've had aftermarket battery repairs swell up, which is a safety risk. My friends at support had to deal with dozens of original Apple batteries that swelled up. And, contrary to what people may think, Apple doesn't consider a swollen battery a safety issue.[0] But, for certain models, they would replace it at no fee (although such support programs have ended IIRC). [0] See e.g. here: https://discussions.apple.com/thread/251466658 https://discussions.apple.com/thread/251466658

HWR_14 3y ago
They don't consider all swollen batteries to be safety issues. Clearly, what that page is referring to is that a specific product line was having batteries swell up for non-safety reasons. They still got replaced, but it makes sense if Apple knows the cause and it's not safety related.