>seems like it won't work Are you speculating here or do you have some kind of insight?
I think he is speculating, but any work around to bypass the rules related to the security chip would seem unlikely.
Or maybe we're just reading it too literally and the document actually means "when the computer is asleep" but they said "when the lid is closed", thus creating the confusion? But I guess if it's about "sleep" mode, that's too easy to bypass in software without even attacking T2...
"All Mac portables with the Apple T2 Security Chip feature a hardware disconnect that ensures that the microphone is disabled whenever the lid is closed." It's interesting, I don't know if other brands do that?
I wonder how that works for the Mac Mini. I'm honestly not sure if it even has a microphone built in or not.
"All Mac portables with the Apple T2 Security Chip feature a hardware disconnect that ensures that the microphone is disabled whenever the lid is closed." It's interesting, I don't know if other brands do that?
I wish we had a physical switch that cut power to the camera and mic... I worked on some old networking equipment a while back that had a physical fail over switch. If you opened the cover you could watch the connection switch, fun stuff. Also very effective.
Newer Thinkpads have a shutter to cover the camera, but mic still works when covered.
More information on the GID/UID can be found in the iOS Security Guide: > With the exception of the Apple A8 and earlier SoCs, each Secure Enclave generates its own UID (Unique ID) during the manufacturing process. Because the UID is unique to each device and because it’s generated wholly within the Secure Enclave instead of in a manufacturing system outside of the device, the UID isn’t available for access or storag…
[deleted]
The T2 is utilizing a physically unclonable function (PUF) and TRNG to create a public/private device key pair on die. At manufacturing, the T2 exposes the device public key to Apple, Apple signs with a group key posted to their CA. This is why they say they can revoke privileges via the CA. It's unclear to me whether the T2 regenerates this key pair each time it is requested, or whether it is encrypted and stored in memory. In the event the latter is the case, the encryption is being performed inside the secure enclave. "Secure enclave" used here is almost certainly distinct from Intel SGX, ARM TrustZone and the like. The page tables are protected. Row Hammer, Spectre, Meltdown and Foreshadow do not apply to something like T2, as the OS is considered trusted. The fundamental challenge that e.g. Intel's SGX has over this type of architecture is that a dedicated security co-processor doesn't need to maintain speculative execution behaviors necessitated by performance requirements, which expose numerous sidechannel attacks, and likely has minimal need to assume untrusted code operating in the T2 OS.
"All Mac portables with the Apple T2 Security Chip feature a hardware disconnect that ensures that the microphone is disabled whenever the lid is closed." It's interesting, I don't know if other brands do that?
Why you need security chip to ensure that?
If the trigger is mechanical it's ok, but if the trigger is electrical (and handled by some hardware) then the chip is useful.
"All Mac portables with the Apple T2 Security Chip feature a hardware disconnect that ensures that the microphone is disabled whenever the lid is closed." It's interesting, I don't know if other brands do that?
I wish we had a physical switch that cut power to the camera and mic... I worked on some old networking equipment a while back that had a physical fail over switch. If you opened the cover you could watch the connection switch, fun stuff. Also very effective.
They say that "The camera is not disconnected in hardware because its field of view is completely obstructed with the lid closed."
One interesting point in the discussion of UEFI secure boot: it appears there is no way to boot OSes other than Mac OS and Windows without disabling secure boot entirely. > By default, Mac computers supporting secure boot only trust content signed by Apple. However, in order to improve the security of Boot Camp installations, support for secure booting Windows is also provided. The UEFI firmware includes a copy of th…
"it appears there is no way to boot OSes other than Mac OS and Windows without disabling secure boot entirely."
I am personally okay with that, so long as it can be turned off.