4 ms·

Oregon's New Right to Repair Law Bans 'Parts Pairing' Restrictions

27 points by divbzero 3y ago

elmerfud 3y ago
I support the right to repair but I'm worried about how this law is written. What exactly do they mean by pairing restrictions. Not in a general sense but in a very specific technical sense this matters. Because sometimes companies put in the restrictions for no reason other than they want you to have to either use their parts or be done by their service center so they can all be "coded" to work together. That is kind of a ridiculous thing because even if parts need to be calibrated to work together they should be able to do their own calibration in order to work together. Now on the other hand there are some very legitimate restrictions here depending on how a device is made and it's design. Even if a device could be made differently in the future if this law is impacting the way a device is now this could have some very serious security implications. For example one of the reasons Apple disables facial unlock when you replace the screen is because the sensors and components in the screen are doing part of that facial recognition and so it needs to be cryptographically secure to speak to the rest of the phone to say it's okay to unlock. Without that level of security someone could simply put in a bogus component and unlock anyone's phone. It is possible Apple could design this differently in the future this is the way it is now and depending on their definition of pairing restrictions this could invalidate the security of a lot of phones in the field. There may be other ways to solve this because in a modern smart device a number of interconnected components may have discrete data on them and they need to speak cryptographically secure between them. Simply replacing one without having a way of updating the keys to work with the others can be a problem. And releasing that method is also a big security problem to just allow anyone to do it. I suppose one way around this would be if you replace the component you can perform a full reset on the device to completely reset all the cryptographic keys to the same but the downside of that would be it invalidates all the data on the device. I want more right to repair but I don't want laws passed without a technical understanding that is going to impact the security of systems as well. We already have governments demanding manufacturers put in back doors to their products we don't need right to repair to turn in to another way to backdoor products.
- joecool1029 3y ago
  > It is possible Apple could design this differently in the future this is the way it is now and depending on their definition of pairing restrictions this could invalidate the security of a lot of phones in the field. Here's how they could do it: Require a device wipe for a security component replacement (touchid/faceid). On initial setup it does it's check/pairing of the newly installed component and works moving forward after which you restore your data from backup. If the component doesn't have Apple's signing key then that security feature has to be disabled. (home buttons without touchid are sold for old devices). They know how to do this, there's no technical reason why they can't. Sell the parts needed. Batteries? I think we need specific regulation here, there's plenty of companies that know how to build decent cellphone packs. Apple cannot arbitrarily decide to throttle performance if the pack delivers to spec and doesn't get outside thermal envelope. Pretty much every other component shouldn't have any restriction, if they want to send a serial validation you can generate a report on device for that's fine. Resellers would actually like this. But it shouldn't disable a loudspeaker if you bought a loudspeaker from a supplier other than Apple.
- m463 3y ago
  Components used to be able to replaced in iphones by third parties. Now that is basically not possible. Apple has eliminated this on purpose. A while back i replaced my iphone 8 screen at a third party repair place. It was great because they could do it in front of me. Apple would not do that, and they would not guarantee the phone wouldn't be wiped. But the ambient light sensor could only be set up by apple. With the third party screen, I could only set the brightness manually.
  - deleted 3y ago
    [deleted]
RcouF1uZ4gsC 3y ago
I wonder if Oregon is a small enough market that Apple just halts all sales in Oregon.
- barryrandall 3y ago
  I wonder if this will be the issue that motivates the federal government to assert and defend its power to regulate interstate commerce.
  - dfe 3y ago
    It very well could be. Legal precedent would be against Oregon. Consider the California CARB (Air Resources Board). There is a specific carve-out in federal law allowing California to have mandates on cars sold in California.
pxmpxm 3y ago
Love it, though I expect a CVE cargo cult army showing up here (something something man in the middle between the board and display something), blissfully oblivious to the fact revenue is the sole motivator behind all of it. I am curious if they have a regulatory carve out - ie the FLIR camera in our car is paired to the ECU for ITAR compliance.

27 points by divbzero 3y ago

I support the right to repair but I'm worried about how this law is written. What exactly do they mean by pairing restrictions. Not in a general sense but in a very specific technical sense this matters. Because sometimes companies put in the restrictions for no reason other than they want you to have to either use their parts or be done by their service center so they can all be "coded" to work together. That is kind of a ridiculous thing because even if parts need to be calibrated to work together they should be able to do their own calibration in order to work together. Now on the other hand there are some very legitimate restrictions here depending on how a device is made and it's design. Even if a device could be made differently in the future if this law is impacting the way a device is now this could have some very serious security implications. For example one of the reasons Apple disables facial unlock when you replace the screen is because the sensors and components in the screen are doing part of that facial recognition and so it needs to be cryptographically secure to speak to the rest of the phone to say it's okay to unlock. Without that level of security someone could simply put in a bogus component and unlock anyone's phone. It is possible Apple could design this differently in the future this is the way it is now and depending on their definition of pairing restrictions this could invalidate the security of a lot of phones in the field. There may be other ways to solve this because in a modern smart device a number of interconnected components may have discrete data on them and they need to speak cryptographically secure between them. Simply replacing one without having a way of updating the keys to work with the others can be a problem. And releasing that method is also a big security problem to just allow anyone to do it. I suppose one way around this would be if you replace the component you can perform a full reset on the device to completely reset all the cryptographic keys to the same but the downside of that would be it invalidates all the data on the device. I want more right to repair but I don't want laws passed without a technical understanding that is going to impact the security of systems as well. We already have governments demanding manufacturers put in back doors to their products we don't need right to repair to turn in to another way to backdoor products.

joecool1029 3y ago
> It is possible Apple could design this differently in the future this is the way it is now and depending on their definition of pairing restrictions this could invalidate the security of a lot of phones in the field. Here's how they could do it: Require a device wipe for a security component replacement (touchid/faceid). On initial setup it does it's check/pairing of the newly installed component and works moving forward after which you restore your data from backup. If the component doesn't have Apple's signing key then that security feature has to be disabled. (home buttons without touchid are sold for old devices). They know how to do this, there's no technical reason why they can't. Sell the parts needed. Batteries? I think we need specific regulation here, there's plenty of companies that know how to build decent cellphone packs. Apple cannot arbitrarily decide to throttle performance if the pack delivers to spec and doesn't get outside thermal envelope. Pretty much every other component shouldn't have any restriction, if they want to send a serial validation you can generate a report on device for that's fine. Resellers would actually like this. But it shouldn't disable a loudspeaker if you bought a loudspeaker from a supplier other than Apple.
m463 3y ago
Components used to be able to replaced in iphones by third parties. Now that is basically not possible. Apple has eliminated this on purpose. A while back i replaced my iphone 8 screen at a third party repair place. It was great because they could do it in front of me. Apple would not do that, and they would not guarantee the phone wouldn't be wiped. But the ambient light sensor could only be set up by apple. With the third party screen, I could only set the brightness manually.
- deleted 3y ago
  [deleted]

RcouF1uZ4gsC 3y ago

I wonder if Oregon is a small enough market that Apple just halts all sales in Oregon.

barryrandall 3y ago
I wonder if this will be the issue that motivates the federal government to assert and defend its power to regulate interstate commerce.
- dfe 3y ago
  It very well could be. Legal precedent would be against Oregon. Consider the California CARB (Air Resources Board). There is a specific carve-out in federal law allowing California to have mandates on cars sold in California.

pxmpxm 3y ago

Love it, though I expect a CVE cargo cult army showing up here (something something man in the middle between the board and display something), blissfully oblivious to the fact revenue is the sole motivator behind all of it. I am curious if they have a regulatory carve out - ie the FLIR camera in our car is paired to the ECU for ITAR compliance.