4 ms·

I've asked this 3 times across the various threads on this, and have yet to get a 100% confirmed "you are right" answer because I don't know the specifics and I

I've asked this 3 times across the various threads on this, and have yet to get a 100% confirmed "you are right" answer because I don't know the specifics and I haven't come into anybody who has taken the time to research the answer: When you log in to iMessage and the various underlying protocols/services, you do it with an Apple ID. Is that Apple ID tied in a one-to-many (but you need at least one) fashion of registered, active, non-flaged-stolen, checked-for-legitimacy hardware IDs/serial #s? If it isn't, why doesn't Apple do this? Don't they have a database of every device they've sold? Why would their APIs that handle auth accept something that looks a real serial # instead of an actually real validated serial #? Why don't they check "is this device sitting on a shelf un-sold or does it belong to this account, activated"?

crazygringo 3y ago
It's a good question. On a previous thread, someone here mentioned that it allows for Hackintoshes. As long as the people using fake serials are a small group of hackers, developers, etc. who are hardcore Apple fans in the first place and merely building things for personal use, I can see Apple intentionally turning a blind eye. But once that starts getting abused to build a consumer product at scale, it becomes a whole different story. And I have to imagine it becomes difficult when dealing with old devices, 99% of which have long since been thrown out or recycled, and those serial numbers are ripe for re-use, but there are still people using 10-year-old iPads.
unshavedyak 3y ago
I’ve had this same question. I use beeper because I’m an Apple user and want access to what I pay for. I’m confused by the pathway where paying apple can be skipped.
- georgespencer 3y ago
  > want access to what I pay for You do not pay for this. You would like to, I’m sure.
  - unshavedyak 3y ago
    I pay for iMessage, I mean. Which is to say, it’s part of the system that users buy. Part of iOS. Etc edit: I mean hell, i certainly don't pay Apple for hardware. You might argue i do, but i don't actually have access to the hardware - right? It's not like a PC where each component has value to me, that it's documented and hackable, etc. Nono, you buy the suite - everything, when you buy an iPhone. If not for iOS, iPhone is a nearly useless undocumented brick.
dgbarnes 3y ago
I would suspect that it's because for older devices without hardware crypto processors/certs it's impossible to distinguish between a real device and a Hackintosh (or Beeper client) that's spoofing a serial number. So while validating against a known list makes things harder, it's still not truly "secure" in the sense that older, yet still supported devices (like the 2015 MBP that I had up until about a year ago) aren't able to prove that they're actually the device, since they don't have a way of signing that proof in a way that Apple can verify.
jauntywundrkind 3y ago
Microsoft is the company trying the hardest to force users to dial back to Microsoft before using their products, as far as I know. Quite a wide base of users detest the process & loath it. It feels incredibly tacky & I would not recommend Apple lower themselves so. And it's still nowhere near what you are asking for. What exactly is "validating" a serial number? Are you saying users need to present receipt of purchase? Does the store need to provide proof? Maybe Apple validates by getting access to you bank statements? How are these proof of sales tied to individual specific devices? This feels like clutching for certainty. Maybe Apple can have such a tight & narrow sales model, can get every cell phone company managing their inventory with vastly tighter inventory control (tracking which specific devices are ss) than anyone has ever done before. Maybe Apple can pull it off. Should they? Do they want to be subject to various governments asking who bought which device? Do they want to spend the time updating & maintaining these listings? Are they ok pissing off devs hackers & other enthusiasts who get steamrolled by these changes? Apple can form & deploy the Imperial Royal Guard over their products if they really wanted to, I have scant doubts, but the costs of forming that chain of control, cost of maintaining that database, and the liability of owning such rich data about their users in the current legal climate all seem like colossal prices to pay.
- nixgeek 3y ago
  Apple devices already phone home when you reimage them - Activation Lock - this already causes some headaches when your MDM doesn’t consider the implications: https://learn.jamf.com/bundle/jamf-now-documentation/page/Using_Activation_Lock_Bypass.html https://learn.jamf.com/bundle/jamf-now-documentation/page/Us...
not_your_vase 3y ago
> If it isn't, why doesn't Apple do this Not sure if there would be any real benefit in that. Consider the over-abused Macs at university campuses as an example, used by 10s-100s of persons/day, each potentially logging in with their own user ID. Suddenly their ID is tied to a legit HW, if it wasn't the case already. Of course, technically, Apple could ban the IDs or these computers... but why would they?
- refulgentis 3y ago
  I think you're right -- You piqued my curiosity with your example, though. 10-100s of people logging into the same Mac with their Apple ID? Is that possible? I thought there was a 1:1 mapping of, say, Apple ID signed into ID : *NIX account. Does OS X have something more ephemeral these days? That would be fantastic for shared computing.
  - PrimeMcFly 3y ago
    I don't think they meant 10-100s of people logging in simultaneously.
  - lxgr 3y ago
    Having hundreds or even tens of thousands of Unix accounts on a single system is not a problem in corporate or institutional environments since macOS integrates with LDAP and Active Directory via Open Directory. I was able to log in to any of the Macs in the computer rooms on campus at my university using my regular Unix username and password. UIDs go as high as 2 billion on macOS as well (they're signed 32 bit integers), which should fit even the largest institutions even without aliasing of local UIDs to directory server names.
    - Terretta 3y ago
      OK, but those aren't AppleIDs?
      - dangus 3y ago
callalex 3y ago
How would this work with the used market?
lxgr 3y ago
> Don't they have a database of every device they've sold? A database isn't enough. They'd also need a way for that device to attest its identity to Apple, and serial numbers can be relatively easily copied (or sometimes even brute-forced). This should be possible for newer devices using Apple's own chips, but I believe that at least non-T1/T2 Intel Macs lack any such capability. > Why don't they check "is this device sitting on a shelf un-sold or does it belong to this account, activated"? How would they know this? I highly doubt that every retailer in the world reports sold devices' serial numbers to Apple.
- willstrafach 3y ago
  iOS devices must be activated to use them. This is indeed stored in a database. AppleCare and third-party repair centers can query activation information using GSX. You are correct about pre-T1 Intel Macs though. Apple will have a blind spot by design, until support is dropped for old machines.
1123581321 3y ago
Spoofs masquerade using confirmed serial numbers. In the case of Hackintoshes you manually repeat activation until you get a valid serial number; I don't know what Beeper's implementation does. So Apple can maintain this database but they still have the problem of proving that a serial number attestation, sending all the right information, is from that actual hardware and not a spoof of the hardware. Without intensely protected cryptography like the T1/T2 enclaves, there is nothing legitimate hardware can send that can't be mimicked once the protocol is reversed. Maintaining a stricter database of unsold and destroyed products can only slow down activation, not stop it. That means Apple would have to use other means to determine whether an attestation is valid like number of sign-ins, locations, the user trying to sign in, etc. If it enforces any of these, it will lock out and anger more legitimate users than it will block Hackintoshes and Android iMessage clients. Hopefully that makes sense. Apologies if this is a repeat of previous answers.
- turquoisevar 3y ago
  > Spoofs masquerade using confirmed serial numbers. Most Hackintosh users use a plausible, but non-legitimate serial number. The community has found it immoral to potentially cause issues to random people by using their device’s serial number and that is why they stay away from it and tutorials typically instruct against it. Doesn’t mean it doesn’t actually happen, but I’ve seen only a handful of people who openly admit to it. > So Apple can maintain this database but they still have the problem of proving that a serial number attestation, sending all the right information, is from that actual hardware and not a spoof of the hardware. It’s actually quite easy for them to infer due to the simple premise that a physical device can’t be in two places at once, coupled with other behaviors and it’s pretty easy to nail down which device attributes are being exploited for this purpose. The only hard part would be to determine which is the actual device and which is the fake one, if there’s no activity that predates the spoofing. All in all it’s a safe assumption that a very low number of devices have their attributes abused for spoofing (easily single digit percentage) and at a certain point Apple might find it more desirable to inconvenience the owners of these “donor devices” by locking things down and having them contact support, than to let the spoofing go on. I think that point might be nearer than we think. Already Apple seems to have no qualms to ban Apple IDs of legitimate customers who entirely legitimately have bought gift cards and loaded them up on their account, on the simple premise that their algorithm flags accounts that top up more than $1k as suspicious. Both Apple Store geniuses and Apple Care support personnel can easily establish in a minute or so if you have possession of the actual physical device and take actions accordingly. > Without intensely protected cryptography like the T1/T2 enclaves, there is nothing legitimate hardware can send that can't be mimicked once the protocol is reversed. True, without a Secure Enclave, device attestation will never be airtight. But it might be that Apple might drop iMessage support for older devices, or more likely, between older and newer devices, in due time like they did with FaceTime. iPhone 5s and newer had them so there aren’t many iPhone left behind if they upgrade the protocol. Same for iPad Air and Apple Watch Series 1. 2016 was the first time MacBooks were introduced with T1, in a few years that’ll be a decade ago. I could see them upgrade the protocol by then and leave older devices behind.
turquoisevar 3y ago
It is. Apple essentially uses a scoring model. The legitimacy of your device is only one part of the score; your Apple ID and its history and standing is another. Those and other factors are calculated into a score, and if you meet the threshold, you can use iMessage. Think of it as a credit score. Before the Beeper saga, I haven’t looked into it since Hackintosh users have found that Apple will allow you to use iMessage with clearly spoofed device attributes as long as your Apple ID is in good standing and not brand new. Why they did is anyone’s guess. The leading theory has always been that, based on your Apple ID activity, they considered you a valuable customer. They didn’t think it was worth the hassle and potential backlash to block you despite using spoofed device attributes. But it’s just that, a theory. And nothing is stopping Apple from tweaking its score threshold.
- andrewmcwatters 3y ago
  They can also false positive your account, which I’ve personally seen. It’s incredible because the software doesn’t tell you what’s going on. The backend just rejects you.
  - turquoisevar 3y ago
    I’m sure false positives happen, that’s inevitable. Them not telling you anything other than to contact CS is pretty standard practice. You don’t want malicious actors that are poking and prodding to take notes. But CS tends to be pretty friendly about it, even when you clearly tried to pass off a BS serial as real, so there’s that.

crazygringo 3y ago

It's a good question. On a previous thread, someone here mentioned that it allows for Hackintoshes. As long as the people using fake serials are a small group of hackers, developers, etc. who are hardcore Apple fans in the first place and merely building things for personal use, I can see Apple intentionally turning a blind eye. But once that starts getting abused to build a consumer product at scale, it becomes a whole different story. And I have to imagine it becomes difficult when dealing with old devices, 99% of which have long since been thrown out or recycled, and those serial numbers are ripe for re-use, but there are still people using 10-year-old iPads.

unshavedyak 3y ago

I’ve had this same question. I use beeper because I’m an Apple user and want access to what I pay for. I’m confused by the pathway where paying apple can be skipped.

georgespencer 3y ago
> want access to what I pay for You do not pay for this. You would like to, I’m sure.
- unshavedyak 3y ago
  I pay for iMessage, I mean. Which is to say, it’s part of the system that users buy. Part of iOS. Etc edit: I mean hell, i certainly don't pay Apple for hardware. You might argue i do, but i don't actually have access to the hardware - right? It's not like a PC where each component has value to me, that it's documented and hackable, etc. Nono, you buy the suite - everything, when you buy an iPhone. If not for iOS, iPhone is a nearly useless undocumented brick.

dgbarnes 3y ago

I would suspect that it's because for older devices without hardware crypto processors/certs it's impossible to distinguish between a real device and a Hackintosh (or Beeper client) that's spoofing a serial number. So while validating against a known list makes things harder, it's still not truly "secure" in the sense that older, yet still supported devices (like the 2015 MBP that I had up until about a year ago) aren't able to prove that they're actually the device, since they don't have a way of signing that proof in a way that Apple can verify.

jauntywundrkind 3y ago

Microsoft is the company trying the hardest to force users to dial back to Microsoft before using their products, as far as I know. Quite a wide base of users detest the process & loath it. It feels incredibly tacky & I would not recommend Apple lower themselves so. And it's still nowhere near what you are asking for. What exactly is "validating" a serial number? Are you saying users need to present receipt of purchase? Does the store need to provide proof? Maybe Apple validates by getting access to you bank statements? How are these proof of sales tied to individual specific devices? This feels like clutching for certainty. Maybe Apple can have such a tight & narrow sales model, can get every cell phone company managing their inventory with vastly tighter inventory control (tracking which specific devices are ss) than anyone has ever done before. Maybe Apple can pull it off. Should they? Do they want to be subject to various governments asking who bought which device? Do they want to spend the time updating & maintaining these listings? Are they ok pissing off devs hackers & other enthusiasts who get steamrolled by these changes? Apple can form & deploy the Imperial Royal Guard over their products if they really wanted to, I have scant doubts, but the costs of forming that chain of control, cost of maintaining that database, and the liability of owning such rich data about their users in the current legal climate all seem like colossal prices to pay.

nixgeek 3y ago
Apple devices already phone home when you reimage them - Activation Lock - this already causes some headaches when your MDM doesn’t consider the implications: https://learn.jamf.com/bundle/jamf-now-documentation/page/Using_Activation_Lock_Bypass.html https://learn.jamf.com/bundle/jamf-now-documentation/page/Us...

not_your_vase 3y ago

> If it isn't, why doesn't Apple do this Not sure if there would be any real benefit in that. Consider the over-abused Macs at university campuses as an example, used by 10s-100s of persons/day, each potentially logging in with their own user ID. Suddenly their ID is tied to a legit HW, if it wasn't the case already. Of course, technically, Apple could ban the IDs or these computers... but why would they?

refulgentis 3y ago
I think you're right -- You piqued my curiosity with your example, though. 10-100s of people logging into the same Mac with their Apple ID? Is that possible? I thought there was a 1:1 mapping of, say, Apple ID signed into ID : *NIX account. Does OS X have something more ephemeral these days? That would be fantastic for shared computing.
- PrimeMcFly 3y ago
  I don't think they meant 10-100s of people logging in simultaneously.
- lxgr 3y ago
  Having hundreds or even tens of thousands of Unix accounts on a single system is not a problem in corporate or institutional environments since macOS integrates with LDAP and Active Directory via Open Directory. I was able to log in to any of the Macs in the computer rooms on campus at my university using my regular Unix username and password. UIDs go as high as 2 billion on macOS as well (they're signed 32 bit integers), which should fit even the largest institutions even without aliasing of local UIDs to directory server names.
  - Terretta 3y ago
    OK, but those aren't AppleIDs?
    - dangus 3y ago

callalex 3y ago

How would this work with the used market?

lxgr 3y ago

> Don't they have a database of every device they've sold? A database isn't enough. They'd also need a way for that device to attest its identity to Apple, and serial numbers can be relatively easily copied (or sometimes even brute-forced). This should be possible for newer devices using Apple's own chips, but I believe that at least non-T1/T2 Intel Macs lack any such capability. > Why don't they check "is this device sitting on a shelf un-sold or does it belong to this account, activated"? How would they know this? I highly doubt that every retailer in the world reports sold devices' serial numbers to Apple.

willstrafach 3y ago
iOS devices must be activated to use them. This is indeed stored in a database. AppleCare and third-party repair centers can query activation information using GSX. You are correct about pre-T1 Intel Macs though. Apple will have a blind spot by design, until support is dropped for old machines.

1123581321 3y ago

Spoofs masquerade using confirmed serial numbers. In the case of Hackintoshes you manually repeat activation until you get a valid serial number; I don't know what Beeper's implementation does. So Apple can maintain this database but they still have the problem of proving that a serial number attestation, sending all the right information, is from that actual hardware and not a spoof of the hardware. Without intensely protected cryptography like the T1/T2 enclaves, there is nothing legitimate hardware can send that can't be mimicked once the protocol is reversed. Maintaining a stricter database of unsold and destroyed products can only slow down activation, not stop it. That means Apple would have to use other means to determine whether an attestation is valid like number of sign-ins, locations, the user trying to sign in, etc. If it enforces any of these, it will lock out and anger more legitimate users than it will block Hackintoshes and Android iMessage clients. Hopefully that makes sense. Apologies if this is a repeat of previous answers.

turquoisevar 3y ago
> Spoofs masquerade using confirmed serial numbers. Most Hackintosh users use a plausible, but non-legitimate serial number. The community has found it immoral to potentially cause issues to random people by using their device’s serial number and that is why they stay away from it and tutorials typically instruct against it. Doesn’t mean it doesn’t actually happen, but I’ve seen only a handful of people who openly admit to it. > So Apple can maintain this database but they still have the problem of proving that a serial number attestation, sending all the right information, is from that actual hardware and not a spoof of the hardware. It’s actually quite easy for them to infer due to the simple premise that a physical device can’t be in two places at once, coupled with other behaviors and it’s pretty easy to nail down which device attributes are being exploited for this purpose. The only hard part would be to determine which is the actual device and which is the fake one, if there’s no activity that predates the spoofing. All in all it’s a safe assumption that a very low number of devices have their attributes abused for spoofing (easily single digit percentage) and at a certain point Apple might find it more desirable to inconvenience the owners of these “donor devices” by locking things down and having them contact support, than to let the spoofing go on. I think that point might be nearer than we think. Already Apple seems to have no qualms to ban Apple IDs of legitimate customers who entirely legitimately have bought gift cards and loaded them up on their account, on the simple premise that their algorithm flags accounts that top up more than $1k as suspicious. Both Apple Store geniuses and Apple Care support personnel can easily establish in a minute or so if you have possession of the actual physical device and take actions accordingly. > Without intensely protected cryptography like the T1/T2 enclaves, there is nothing legitimate hardware can send that can't be mimicked once the protocol is reversed. True, without a Secure Enclave, device attestation will never be airtight. But it might be that Apple might drop iMessage support for older devices, or more likely, between older and newer devices, in due time like they did with FaceTime. iPhone 5s and newer had them so there aren’t many iPhone left behind if they upgrade the protocol. Same for iPad Air and Apple Watch Series 1. 2016 was the first time MacBooks were introduced with T1, in a few years that’ll be a decade ago. I could see them upgrade the protocol by then and leave older devices behind.

turquoisevar 3y ago

It is. Apple essentially uses a scoring model. The legitimacy of your device is only one part of the score; your Apple ID and its history and standing is another. Those and other factors are calculated into a score, and if you meet the threshold, you can use iMessage. Think of it as a credit score. Before the Beeper saga, I haven’t looked into it since Hackintosh users have found that Apple will allow you to use iMessage with clearly spoofed device attributes as long as your Apple ID is in good standing and not brand new. Why they did is anyone’s guess. The leading theory has always been that, based on your Apple ID activity, they considered you a valuable customer. They didn’t think it was worth the hassle and potential backlash to block you despite using spoofed device attributes. But it’s just that, a theory. And nothing is stopping Apple from tweaking its score threshold.

andrewmcwatters 3y ago
They can also false positive your account, which I’ve personally seen. It’s incredible because the software doesn’t tell you what’s going on. The backend just rejects you.
- turquoisevar 3y ago
  I’m sure false positives happen, that’s inevitable. Them not telling you anything other than to contact CS is pretty standard practice. You don’t want malicious actors that are poking and prodding to take notes. But CS tends to be pretty friendly about it, even when you clearly tried to pass off a BS serial as real, so there’s that.