> Spoofs masquerade using confirmed serial numbers. Most Hackintosh users use a plausible, but non-legitimate serial number. The community has found it immoral

> Spoofs masquerade using confirmed serial numbers. Most Hackintosh users use a plausible, but non-legitimate serial number. The community has found it immoral to potentially cause issues to random people by using their device’s serial number and that is why they stay away from it and tutorials typically instruct against it. Doesn’t mean it doesn’t actually happen, but I’ve seen only a handful of people who openly admit to it. > So Apple can maintain this database but they still have the problem of proving that a serial number attestation, sending all the right information, is from that actual hardware and not a spoof of the hardware. It’s actually quite easy for them to infer due to the simple premise that a physical device can’t be in two places at once, coupled with other behaviors and it’s pretty easy to nail down which device attributes are being exploited for this purpose. The only hard part would be to determine which is the actual device and which is the fake one, if there’s no activity that predates the spoofing. All in all it’s a safe assumption that a very low number of devices have their attributes abused for spoofing (easily single digit percentage) and at a certain point Apple might find it more desirable to inconvenience the owners of these “donor devices” by locking things down and having them contact support, than to let the spoofing go on. I think that point might be nearer than we think. Already Apple seems to have no qualms to ban Apple IDs of legitimate customers who entirely legitimately have bought gift cards and loaded them up on their account, on the simple premise that their algorithm flags accounts that top up more than $1k as suspicious. Both Apple Store geniuses and Apple Care support personnel can easily establish in a minute or so if you have possession of the actual physical device and take actions accordingly. > Without intensely protected cryptography like the T1/T2 enclaves, there is nothing legitimate hardware can send that can't be mimicked once the protocol is reversed. True, without a Secure Enclave, device attestation will never be airtight. But it might be that Apple might drop iMessage support for older devices, or more likely, between older and newer devices, in due time like they did with FaceTime. iPhone 5s and newer had them so there aren’t many iPhone left behind if they upgrade the protocol. Same for iPad Air and Apple Watch Series 1. 2016 was the first time MacBooks were introduced with T1, in a few years that’ll be a decade ago. I could see them upgrade the protocol by then and leave older devices behind.