Oregon's New Right to Repair Law Bans 'Parts Pairing' Restrictions

I support the right to repair but I'm worried about how this law is written. What exactly do they mean by pairing restrictions. Not in a general sense but in a very specific technical sense this matters. Because sometimes companies put in the restrictions for no reason other than they want you to have to either use their parts or be done by their service center so they can all be "coded" to work together. That is kind of a ridiculous thing because even if parts need to be calibrated to work together they should be able to do their own calibration in order to work together.

Now on the other hand there are some very legitimate restrictions here depending on how a device is made and it's design. Even if a device could be made differently in the future if this law is impacting the way a device is now this could have some very serious security implications. For example one of the reasons Apple disables facial unlock when you replace the screen is because the sensors and components in the screen are doing part of that facial recognition and so it needs to be cryptographically secure to speak to the rest of the phone to say it's okay to unlock. Without that level of security someone could simply put in a bogus component and unlock anyone's phone. It is possible Apple could design this differently in the future this is the way it is now and depending on their definition of pairing restrictions this could invalidate the security of a lot of phones in the field.

There may be other ways to solve this because in a modern smart device a number of interconnected components may have discrete data on them and they need to speak cryptographically secure between them. Simply replacing one without having a way of updating the keys to work with the others can be a problem. And releasing that method is also a big security problem to just allow anyone to do it. I suppose one way around this would be if you replace the component you can perform a full reset on the device to completely reset all the cryptographic keys to the same but the downside of that would be it invalidates all the data on the device.

I want more right to repair but I don't want laws passed without a technical understanding that is going to impact the security of systems as well. We already have governments demanding manufacturers put in back doors to their products we don't need right to repair to turn in to another way to backdoor products.

Love it, though I expect a CVE cargo cult army showing up here (something something man in the middle between the board and display something), blissfully oblivious to the fact revenue is the sole motivator behind all of it.

I am curious if they have a regulatory carve out - ie the FLIR camera in our car is paired to the ECU for ITAR compliance.

I wonder if Oregon is a small enough market that Apple just halts all sales in Oregon.