3 ms·

Physical possession is a good enough high bar. But remotely enabling this feature with just a serial number sounds incredibly invasive, and a very serious breac

Physical possession is a good enough high bar. But remotely enabling this feature with just a serial number sounds incredibly invasive, and a very serious breach of trust. Even if Apple are "the good guys" (now), we know they can be compelled by governments to do things quietly (see the push notifications thing that came up recently). So simply having the ability to remotely push software or configuration changes to any machine targeted by just a serial number is a big security hole. This is very disappointing...

danaris 3y ago
Is it a remote push? Or is it that the MBP "phones home" on first boot, and gets the signal that it belongs to the Expedia MDM group? Naturally, that's not great either, but it's not quite the same kind of "not great".
- angulardragon03 3y ago
  Second one. It’s also not secret - you are greeted with a prompt, which you must accept, to complete enrolment (although granted you can’t use the device without accepting). Essentially, the device phones home during setup, and asks Apple whether it’s in Apple Business/School Manager. If it is, and it’s assigned to an MDM, Apple will let it know the host name of that server to try and prompt the user to enroll into.
ziml77 3y ago
Would you prefer the company that owns the device burn something like this into UEFI to handle MDM instead?
- gigel82 3y ago
  Yes. That significantly raises the barrier, and reduces the risk of accidental enrollment. And once that's burned into the UEFI, I'd like it plastered all over; maybe as part of the boot logo "This device belongs to Expedia"; there will be no risk of someone buying the device (perhaps on the used market) and not realize they don't own it. Of course, there should also be an un-enrollment option for when companies decommission devices so they can be reused instead of just trashed, but that's an environmental concern not a security one.

danaris 3y ago

Is it a remote push? Or is it that the MBP "phones home" on first boot, and gets the signal that it belongs to the Expedia MDM group? Naturally, that's not great either, but it's not quite the same kind of "not great".

angulardragon03 3y ago
Second one. It’s also not secret - you are greeted with a prompt, which you must accept, to complete enrolment (although granted you can’t use the device without accepting). Essentially, the device phones home during setup, and asks Apple whether it’s in Apple Business/School Manager. If it is, and it’s assigned to an MDM, Apple will let it know the host name of that server to try and prompt the user to enroll into.

ziml77 3y ago

Would you prefer the company that owns the device burn something like this into UEFI to handle MDM instead?

gigel82 3y ago
Yes. That significantly raises the barrier, and reduces the risk of accidental enrollment. And once that's burned into the UEFI, I'd like it plastered all over; maybe as part of the boot logo "This device belongs to Expedia"; there will be no risk of someone buying the device (perhaps on the used market) and not realize they don't own it. Of course, there should also be an un-enrollment option for when companies decommission devices so they can be reused instead of just trashed, but that's an environmental concern not a security one.