Hacker News Reader

Your entire argument amounts to: Trust Apple and nobody else. What makes you think that's a good idea?

> We're not talking about a dumb mower that is not storing any of your personal information.

Exactly. That's why it's even more important that we be able to repair it ourselves.

> Apple has the absolute right to protect it in order to protect your data, even in the ways that prevents you from repairing your yourself.

There are no absolute rights. There are laws. I trust myself more than Apple and I don't think there's much you can say to convince me otherwise.

> If you want to repair, take it to Apple or if there's no store, mail it in.

Nope. I'd rather not, thanks! That's why we're going to get this law passed.

> Your entire argument amounts to: Trust Apple and nobody else. What makes you think that's a good idea?

I don't trust anyone, but I only want Apple to hold the keys, not all random repair stores. It is a FAR worse idea to force Apple to provide security bypasses.

If security bypasses can be provided securely as LONG as you authorize it on the spot, then heck yes, force Apple to do this. But if they cannot, then nope, they shouldn't be forced.

> Exactly. That's why it's even more important that we be able to repair it ourselves.

I don't think we're disagreeing here, I'm totally on your side that we should be able to repair everything ourselves but I cannot agree with forcing companies to provide security bypasses in a manner that may be done without your knowledge.

> There are no absolute rights. There are laws. I trust myself more than Apple and I don't think there's much you can say to convince me otherwise.

You are correct, I phrased it wrong since there is a clear technical definition of what absolute right means.

I didn't say you shouldn't have the right to repair everything yourself. I'm totally on this but I disagree again on the security components, you should be able to replace it as long as it can be securely does and with information that only you know. Forcing Apple to provide this to repair shops without explicit controls over it, is a bad idea.

> Nope. I'd rather not, thanks! That's why we're going to get this law passed.

I've edited my post after that.

> I don't trust anyone, but I only want Apple to hold the keys, not all random repair stores. It is a FAR worse idea to force Apple to provide security bypasses.

Each customer should hold a personalized key to his own hardware. Then the customer can decide whom he trusts, and give the key to whomever he wants (Apple, some other repair store, do it himself, ...)

The problem is that as long as somebody else holds the key to something you bought, you didn't buy it, you leased it. Or borrowed it. Somebody else can still control it to a greater degree than you yourself. And that somebody now has a monopoly he can use to force thing onto you. Like set prices for repair.

That shouldn't happen.

That's okay as well, the problem is, how do you do this correctly? You cannot store it in the cloud because that's a bad idea. Where else?

If you give someone a key to the device, how does the device itself enforce a time-limited key, especially if the crypto-based components are about to be replaced?

I tend to trust the people that have the most financial incentive to protect my data.

This. Why is it so difficult to understand? We shouldn't trust Apple, Google, Microsoft (...) because they're inherently good. We should trust them because screwing up for them is much more financially risky than keeping up with their security promises. That of course can not include Government interventions, which the companies cannot always reject. Regarding this, I trust Apple more than its competitors, based on recent history. What's the incentive for mom&pop iPhone repair store to keep your phone safe? If your phone is in their control and someone from the FBI shows up commandeering them to modify something on it - they got the tools, so they're legally obliged to do it - what's their weight in opposing such an order?

Trusting apple or other big guys are already hard. The reason is all these companies are bound by law. They get subpoenad all the time.

A more secure etc way could be if they made it impossible for themselves to read your data.

Apple at least has done as much as possible: https://www.youtube.com/watch?v=BLGFriOKz6U

tl;dw the process includes a blender.

> Trust Apple and nobody else.

That's a straw man, you've already trusted Apple. The argument is 'trust no one else' which seems like a good idea.

This. If you dont want apple device, compile aosp from head, or use cyanogenmod or something.

Just because I bought one of their devices doesn't mean that I trust them to be the sole owner of the keys to it.

I want to own those keys. I actually don't want to trust anybody but myself if I can help it.

Among other things, you are missing a point. There are mainstream users, and there are tech savy users. You can repair your device, but a regular user who doesn't know about how electronics work is likely to send their device to a repair center with lowest cost.

Which means hackers could advertise cheap repairs, in exchange for placing malware hardware/software on user device.

I like to see the hardware opensource, as it is immensely valuable, but apple does have a point.

I did a project on John Deere and how they are handling the repair of their tractors. In summary, the software that drives the tractor is a giant black box that the farmers don't own. And they have no way to get around that black box even if something was not wrong.

One example that stood out to me was that a sensor that told the machine something was broken was broken. Due to this, the farmer could not use a perfectly operational tractor for two weeks because there was no way to override the sensor. And the John Deere tech would take two weeks to get out there.

This line sounds like it is directly targeting John Deere and how they handle the manufacture and repair of their tractors. Farmers are actually paying more for ~10-20 year old equipment that can be repaired.

I know WIRED isn't the greatest, but these articles fascinated me. I think after looking at them, that line will make a lot more sense to you.

https://www.wired.com/2015/02/new-high-tech-farm-equipment-n...

https://www.wired.com/2015/04/dmca-ownership-john-deere/

Surely there should be a way to enable hardware repair without giving unfettered access to user data?

I mean, even when I do hand my device to the manufacturer I don't necessarily want to grant them access to my data.

> Surely there should be a way to enable hardware repair without giving unfettered access to user data?

Yes of course, screen/battery/radio etc but suppose we're talking about the TouchID+SoC integrated security component that store your authentication data. Should Apple be forced to provide a security bypass to allow the repair shop to randomly replace this with a different part not authorized by Apple?

There has to be clear definition of what they mean by security bypasses.

I think that it is pretty clear that what they mean with the security bypass is unnecessary software that is only there to prevent you from repairing your product in any way without paying to the manufacturer to do so.

Good luck proving that.

You assume iPhones are currently safe against physical tampering, but I haven't seen any evidence to suggest that is true.

The San Bernardino case was different because he wasn't going to be unlocking his phone any time soon...

They're not safe, nothing is but they're harder because of the secure enclave and so on. Are you going to tell me that it is a good idea to force Apple to offer security bypasses to allow said repairs to Touch ID that should be permitted to pair with the secure enclave that was originally paired with the previous Touch ID sensor only?

I have a feeling I'm overthinking what the article said. I need to look at the law itself.

So Apple engineered a system that can't be repaired without introducing a (mostly irrelevant) vulnerability. This is Apple's fault, they can do better.

Here's an alternate universe: You replace your home button, and now you need to use your PIN to unlock the device and Touch ID is reinitialised.

And in any case, I don't know why we're playing into Apple's security theatre, if there are technically sophisticated adversaries who can invade your personal security trying to hack you, it's game over for you. Nothing Apple does with Touch ID will be relevant.

The Secure Enclave system has yet to be publicly broken. While CCC showed a hack against TouchID in a lab setting, it has not been replicated and is not easy to reproduce.

"Apple has the absolute right to protect it in order to protect your data"

Well, no, they don't have an absolute right, do they? Apple's rights are tempered by law.

I ran out of time to edit my post, I was speaking in general and I forgot the clear definition of absolute rights.

I meant that Apple as a company has obligations to protect you and your data at all costs. State laws should consider the impact of said forced lock bypasses.

So you want only the bad guys and Apple to have the tools.

Nice straw man there, but no one said that.

A key everybody has a copy of is not much of a key.

sure, I trust one party to have the keys to everything... /s

You can buy something else. Giving everybody the key is missing entirely the point of a key.

No, you have misunderstood. It's mandating Apple provide tools that bypass locks that Apple put in place to prevent repair.

Right to repair should only apply to hardware. Anything software related is fair game for hacking/reversing. Otherwise it is like asking Apple to provide the special screwdriver that opens the special screws they designed to keep the world out of their walled garden. Apple should not be compelled to provide that special screwdriver and at the same time no other vendor, who has reversed the design, be prevented from selling it to interested users. You buy that tool, but the moment you apply it to an iPhone, all warranty from Apple is null and void.

User info should be locked away by the entity to whom the information was entrusted in the first place. In this case Apple. Yes, if you buy an iPhone and use it access/generate information then it is by definition already entrusted to Apple. Don't like it? Don't buy an iPhone. Better yet, go use a self-built Linux PC. Forgo smart phones altogether.

No - you've misunderstood- Apple hasn't put any locks in place to prevent repair. Any 'locks' are to prevent compromise.

Except the only lock Apple has placed is to prevent compromising your TouchID/secure enclave data, which is understandable. They're not locking you out of repairing other components like screens, batteries.

You're arguing for security by obscurity.