Hacker News Reader

Comment by lloeki | Hacker News Reader

> and prefer hardware with replaceable storage like M.2 slots.

I'm not sure how that would have accomplished anything (except a smaller repair bill, but that was footed by the warranty) in this story: either the logic board died and since the storage is encrypted at rest with the key stored in the Secure Enclave, the data is not recoverable; and if the storage is dead, well, the data is gone. Either way the data is as good as gone.

So either way, one lesson. Backup. Twice.

(Also, a brand new laptop has just as much chance of being stolen or suffering water damage or mistaken file erasure or a thousand other things that would destroy the data. Two months without backup is lunacy)

View on HN

So many people are making the encryption point, and that seems nonresponsive to me. I mean, the whole point here is a demand for Apple to change their board design. If we're going to do that, it's not at all unreasonable to demand that they also support some form of key escrow or user-managed key storage. The software part of the puzzle is significantly cheaper to implement, especially given that all they need to do is copy one of the gazillion variants already shipping.

The drive encryption design is a holdover from iOS, and... a Macbook isn't a phone. People do very different thing with them (the linked article is by a video producer!) and need different solutions.

> since the storage is encrypted at rest with the key stored in the Secure Enclave

Bitlocker on W10 allows you to export the long key it to a file or printer. I've used this to swap SSDs from family members laptops with out much friction. This makes for simple upgrades or getting them going quickly after a failure. Perhaps Apple's implementation is different, but it doesn't need to be.

> (Also, a brand new laptop has just as much chance of being stolen or suffering water damage or mistaken file erasure or a thousand other things that would destroy the data. Two months without backup is lunacy)

For laptops used mostly at home, it's surprisingly difficult to kill the SSD inside them. Everyone's risk is different.

What's encryption got to do with the "logic board" (whatever that is)?

Encryption is done using a key. You are the owner of the machine, so you have the key. Just use that key to decrypt your files. Simple.

#justapplethings

The whole premise of the T2/Secure Enclave (or TPMs or whatever name is fancied this day if you want to talk non-Apple lingo) is that the disk encryption key (or other private key kind of secrets) cannot be extracted, not by malware, not by knowing your password, not by electronic microscope, not -ever-.

There's data on my machine that I'd like to be that well protected, but... certainly not all of it.

There's no reason you wouldn't have access to the encryption key, though. In a sensible system it would be derivable from your password and data on the drive.

Reply on news.ycombinator.com