Comment by oneplane | Hacker News Reader

Comment by oneplane | Hacker News Reader

This has got to be one extremely expensive toolchain and supply chain redesign to do, but since they have done it a few times before (instead of incremental changes) I suppose the money department has worked out when it is feasible to do that kind of thing while keeping the people in charge happy.

I'm curious to see if this is a 'test' to see if this doesn't have too many downsides, I imagine ingress area increasing this much might be a point of worry (well, there are flexible seals for that now), and instead of having a one-way stack you now have a two-way stack so tooling and workstations around that (even if we just think in terms of assembly and rework) are going to be a PITA to convert or completely replace.

Either this will be a success and allow for the architectural change to be applied to other products, or it's a medium-success in which this only works for specific parts/antenna/power envelope configurations and we won't see this design in other form factors.

What does itch a little is iFixit whining about the parts needing be a signed set to work together. Nobody has come up with a better integrity protection method, and no-protection isn't an option either for the ecosystem. Besides, instead of having a 'safe' and 'unsafe' option for which practically no user will ever be able to make an informed decision, you can simply choose not to buy it if this is a feature you seriously despise.

I disagree that integrity protection is necessary across many components of the phone.

There should be integrity protection on the SoC, and then all other components should be untrusted.

Sure, that means someone can proxy the fingerprint sensor or put on a fake screen that shows a fake consent dialogue. But I think that is an acceptable risk - after all, you can never protect against someone making an entirely new device that just happens to look like an iPhone.

> But I think that is an acceptable risk

And I think it is unacceptable.

That doesn't mean that you also have to think the same thing, but I would rather not have that option taken away from me. I also don't think that you have made a case for any similar-security implementation for integrity protection.

I think distributed trust is the only way to make trustworthy components, and the only known-good way to do that is using PKI, and the only proven way to do that is to have a CA.

> [..] after all, you can never protect against [..]

That's the kind of thinking that gets you stuck in "we have already lost so we should stop trying".

If you can make sure that your finger print never leaves the secure enclave, and you can make sure that the Secure Enclave cannot be replaced, you can trust the device a whole lot more than a fake security measure that can be circumvented at every stage. What is the point of an insecure security control? You don't send your passwords plain-text over the internet, do you? Just because TLS is imperfect, and your CA store can be compromised, and your screen might be recorded using a camera and a telescope doesn't mean that therefore we should stop improving TLS...

> And I think it is unacceptable.

If you're uncomfortable with the idea of buying potentially backdoored hardware, what makes you comfortable using backdoored software? I don't understand the "hardware matters but software doesn't" threat model. It certainly doesn't benefit you in any pragmatic sense, the best it will do is give you warm fuzzies while Apple adds your OCSP data to a running tab for your iCloud account.

Because unless you go collect some sand and make your own wafers etc. you have to put some trust somewhere. I trust a relationship between me and a manufacturer of choice more than an adversary. Keep in mind that trust does not equal blind trust. I trust an Apple SoC and Apple SEP more than say, a RockChip SoC or a MediaTek SEP. And I trust a finger print reader that does not transmit actual fingerprints to the application processor more than a finger print reader that does.

If you are really on the spectrum of 'trust nobody', then what are you doing here on the internet? You had to trust your GPU, your window manager, your browser, the network stack, your internet provider, the server this site runs on, the people who own it etc.

> after all, you can never protect against someone making an entirely new device that just happens to look like an iPhone.

The specific threat being protected against (leaving aside the increased safety of iPhone users by making the stolen parts market untenable) is your phone, that you recognize and use as your phone and which contains your confidential material and credentials, having internal components swapped out while unattended.

It is indeed a protection against evil maid attacks as well as the industrialised version of shipment interception.

It's probably also some form of PR and brand protection, and part of platform security as a whole.

I doubt that any commercial company would find the side-effect of less end-user tampering a true downside; if the device says "I have been tampered with", that's a very clear signal that someone coming in for some warranty repair has some explaining to do.

I am reminded of Mr. Fart's Favorite Colors - https://medium.com/@blakeross/mr-fart-s-favorite-colors-3177... ( 2016 - https://news.ycombinator.com/item?id=11231631 67 comments)

> There should be integrity protection on the SoC

And even that should be possible to disable the same way Android allows bootloader unlocks.

Redesigning iPhone to be repairable means that Apple can have a higher tolerance for part failure. That in turn means that they can reduce quality controls and put cheaper parts into their phones. It probably pays for itself

Reply on news.ycombinator.com