Hacker News Reader

Comment by pathartl | Hacker News Reader

I feel like there's some sort of middle ground here. If a device is still registered to the original owner, notify the original owner and give them a grace period where they can permanently lock down the device. After that grace period, the device automatically unlocks. Having to provide the sale receipt feels more like vendor lock in than actual security.

View on HN

If Apple sent such emails out, that would just make it very easy to phish the original owner.

Nah, send it out via notifications on other macOS or iOS systems. Have it available in Find My.

That’s already being phished despite being in Find My. A local iPhone users Facebook group here regularly gets posts of “I lost my iPhone and then got a text from Apple to find it by clicking this link, should I?”, text sent by the thieves.

Adding a similar real interface (even if delivered by Find My and not texts) would just make phishing more successful. That’s why Apple Support/2FA prompts are verbose popups on every device you own at the same time.

So the answer to thwarting crime is just to have every device lucked and make the machines completely useless? Which just indirectly makes transferring the device to legitimate next owners harder?

I get it, people are conditioned to vendor lock in because of cell phones. In reality it's incredibly wasteful. I'm still not convinced the current way of doing things is best for the consumer.

It makes transferring the device to a new owner slightly harder. But it takes two minutes to remove the activation lock. If the trade-off is protecting owner privacy/disincentivizing thieves and forcing sellers to make a two-minute config chance, it think it's worthwhile.

How completely useless? If you bought a locked phone (Android included!) or Apple device from someone, you just ask them to remove & unlock it. At worst they recover their Apple ID and then remove it. Otherwise, you get your money back (almost sure a court will side with you if necessary).

That only works for people who have another Apple device. A lot of people just own one Apple device – their phone. So you would have to send out an email for this to work, in the general case.

Apple has no problem building features assuming people have more than one Apple device. Hell, AirPods can't update unless someone has an iPhone.

We're talking about a proposal that you are putting forward as a good idea. I pointed out that the proposal won't work for users who have only one Apple device. You've responded by suggesting that Apple wouldn't care. Well, maybe they wouldn't – I don't know – but don't you care? If so, how would you solve the problem?

No, I don't care. If an Apple user signs up for Find My on their laptop, then their laptop is stolen and they don't try to use Find My to recover it... I don't know man. It's a "we've tried nothing and we're all out of ideas" situation. Meanwhile it provides the benefit where if you're sold a machine and the original seller can't be contacted to unlock it, it gets automatically unlocked some timespan later. It's not perfect, but it's better than the current situation.

I guess at some point this is a subjective value judgment that's not worth arguing about, but help me to understand this. If you bought an Apple laptop, would you be more worried about (a) the laptop being stolen, or (b) an indirect recipient of the laptop being unable to use it because they couldn't contact you in order to unlock it? For me it's pretty clearly (a). If I want to sell the laptop, I can easily reset it and do so. If you think about it from the point of view of Apple customers (which is hopefully what Apple is doing), then the choice is pretty clear.

As someone with a single apple device (laptop) that's not really an option, is it?

Reply on news.ycombinator.com