Don’t format a drive of M1 Macs from recovery mode • Hacker News Board

Re: Don’t format a drive of M1 Macs from recovery mode

#121

Post by josephg » Thu, Feb 18, 2021, 5:39 PM UTC

PurpleFoxy wrote: post #78

superhuzza wrote: post #70

Earlier quoted context omitted.

This was a response to a comment about a potential feature as described: "Why does the recovery not just have a button called factory reset which unlinks your apple account, deletes the volume and then sets it all up like new." So yes, it currently does not work like that. But such a feature would allow Macbooks to be easily stolen and reused by others.

The unlink stage would require your password. The recovery partition requires internet to reinstall already.

Yep, just like it does on iPhones - where Apple has a button for this and it’s really easy. I’m sure a lot more iPhones get stolen than laptops every year, and I doubt the factory reset button behind its password prompt makes that any worse.

Re: Don’t format a drive of M1 Macs from recovery mode

#122

Post by sneak » Thu, Feb 18, 2021, 5:42 PM UTC

marcan_42 wrote: post #54

M1 Macs are not like Intel macs, Apple have done a dismal job of documenting them, and their "for users" tooling is still buggy and broken because the launch was clearly rushed. Here is what you need to know to actually understand these things: The SSD has 3 partitions. Each partition is an APFS container. Each container contains multiple APFS volumes. Your OS, and everything you care about, is on the second partitio…

> To do OS reinstalls, you want to be in 1TR.

I think the best bet, security-wise, if you really want to do a full/complete/total OS format/reinstall, is to boot external media, force zeroize all of disk0 (including 1TR), and use DFU mode to restore the .ipsw using Apple Configurator.

This is, of course, way more of a pain in the ass, and requires another computer, and internet access, but hopefully has the added benefit of leaving very little (really, the smallest amount practically possible without disassembly/extreme measures) persistent state on the machine from before the reinstall.

Re: Don’t format a drive of M1 Macs from recovery mode

#123

Post by dsabanin » Thu, Feb 18, 2021, 5:47 PM UTC

southerntofu wrote: post #77

tinyhitman wrote: post #46

Earlier quoted context omitted.

While I'm not disagreeing that this should be possible to (easily) factory reset a device, it also shouldn't be possible for just _anyone_ with physical access to completely reset the device either. Easy resets also mean more interesting to steal

I strongly disagree with your opinion. For economic reason, i'm using (and supporting many users from my neighborhood of) second-hand hardware. Some systems like Apple's make our life incredibly difficult and most times people will just have to pay a shady phone store to have the device they purchased unlocked, adding 20-30€ to the bill. It's important to note that most people are incredibly gullible when it comes to…

You are not making any sense by saying it does not deter anyone from stealing. Sooner or later everyone will know that buying stolen Apple hardware is meaningless, and without a market to sell into, thiefs will be less interested in stealing it.

Re: Don’t format a drive of M1 Macs from recovery mode

#124

Post by sneak » Thu, Feb 18, 2021, 5:51 PM UTC

marban wrote: post #39

IDK but I always just wipe (as in delete all partitions) and do a fresh install on any new MB; and had no issues with the latest Air.

You didn't delete all the partitions, then. If you actually delete all the partitions on an M1 Air, it will not only not boot, it won't boot any external media either, as the firmware is missing. The machine then has to be put into DFU mode and restored from .ipsw via USB, like an iPad or iPhone.

Re: Don’t format a drive of M1 Macs from recovery mode

#125

Post by sneak » Thu, Feb 18, 2021, 5:52 PM UTC

tannhaeuser wrote: post #94

marcan_42 wrote: post #55

Earlier quoted context omitted.

That "bricks" your Mac, and you have to do a DFU restore with Apple Configurator 2 to recover from it. The SSD on these Macs contains system firmware, including the boot picker and recovery mode. Do not wipe the entire top-level block device. They cannot boot from external media, by design. M1 Macs are not PCs, and you shouldn't blindly apply whatever you think you know from the PC world. Their low-level design is mu…

That's scary. Back on my old PowerBook, I saw it as an advantage that OpenFirmware could boot from external devices in the most straightforward way, and could act in target disk mode, and so did Apple. Hearing of all these troubles, I'm genuinely concerned with using MacOS today because of these unknown unknowns. What's the threat that this Apple bossing is supposed to shield against that couldn't be achieved by mere…

Advanced desktop malware, for one. Theft of devices, for another.

Re: Don’t format a drive of M1 Macs from recovery mode

#126

Post by ska » Thu, Feb 18, 2021, 5:54 PM UTC

southerntofu wrote: post #77

tinyhitman wrote: post #46

Earlier quoted context omitted.

While I'm not disagreeing that this should be possible to (easily) factory reset a device, it also shouldn't be possible for just _anyone_ with physical access to completely reset the device either. Easy resets also mean more interesting to steal

I strongly disagree with your opinion. For economic reason, i'm using (and supporting many users from my neighborhood of) second-hand hardware. Some systems like Apple's make our life incredibly difficult and most times people will just have to pay a shady phone store to have the device they purchased unlocked, adding 20-30€ to the bill. It's important to note that most people are incredibly gullible when it comes to…

> and does not deter anyone from stealing.

This statement appears to be false, which I guess is the entire point.

People absolutely should be able to sell a device second hand, so perhaps re-authentication should be easier and more obvious, but making stolen equipment harder to sell is a net win.

Re: Don’t format a drive of M1 Macs from recovery mode

#127

Post by liminalsunset » Thu, Feb 18, 2021, 5:56 PM UTC

PurpleFoxy wrote: post #43

digi59404 wrote: post #25

This is because the author didn't delete the entire volume group. You have to delete the whole volume group, i.e. erase the entire drive and it's partitions to reinstall OSX. This isn't new with the M1 Macs. This has been a thing since they introduced APFS. When they went into disk utility after the cli - Then they could delete everything and kick off the OSX Install. If the APFS Volume Group still exists the install…

I was kind of shocked at how hard it is to factory reset a MacBook. I had one at work and I had to pass it on and the guide is a multi step process which I messed up the first time and ended up reinstalling with my user account still there. Had to start again which takes hours. Why does the recovery not just have a button called factory reset which unlinks your apple account, deletes the volume and then sets it all u…

There actually is a way to do this easily, and it only seems to work if you have FileVault enabled.

Boot into recovery, when it asks for a password say youve forgotten it, you don't have a key, and click the resulting "Erase Mac" button. This will erase the drive properly removing the partitions, iirc.

Re: Don’t format a drive of M1 Macs from recovery mode

#128

Post by liminalsunset » Thu, Feb 18, 2021, 5:58 PM UTC

Jonnax wrote: post #28

liminalsunset wrote: post #13

Big Sur appears to have introduced several new security features that complicate this process. I attempted a wipe on my 2019 16" Intel MBP to upgrade to Big Sur.... and after this, it required you to do something like sign in with a user to disable startup security, because it would not trust its own official Big Sur installer due to signatures maybe.

I think the reasoning is that it's to prevent a stolen laptop from being stolen, wiped and resold without the owner allowing it through their credentials. I remember a poster on HN saying that after some exploit for the T2 security chip came out, they were making money from being paid by thieves to use the exploit to wipe the devices. Of course they said they don't ask any questions which as we all know is an iron cl…

Wanted to clarify that this wasn't the Apple ID activation lock screen. This was asking for my regular user password for an account that had been deleted from the system. Activation Lock only runs when the system is doing the first use setup.

Re: Don’t format a drive of M1 Macs from recovery mode

#129

Post by tehwebguy » Thu, Feb 18, 2021, 6:16 PM UTC

digi59404 wrote: post #25

This is because the author didn't delete the entire volume group. You have to delete the whole volume group, i.e. erase the entire drive and it's partitions to reinstall OSX. This isn't new with the M1 Macs. This has been a thing since they introduced APFS. When they went into disk utility after the cli - Then they could delete everything and kick off the OSX Install. If the APFS Volume Group still exists the install…

Finally sold our old 12" MacBooks on eBay earlier this year and had to format them all. Made the same mistake with the first one, total nightmare. Once I realized the issue the other 2 were a breeze. Seems like a super obvious place to have a big warning message!

Re: Don’t format a drive of M1 Macs from recovery mode

#130

Post by kstrauser » Thu, Feb 18, 2021, 6:33 PM UTC

crististm wrote: post #101

southerntofu wrote: post #89

Earlier quoted context omitted.

> Who is going to walk a away with my fridge? People would steal your wallet, your jewelry... There's a lot more value to be extracted from a stolen credit card than from a "smart" phone. > It's great that you have a niche use case, but that doesn't make your case the priority over the main use cases. You're taking it the other way around. The common use case for first-world software developers is the niche use case…

Think of it as a 'fuck you' to the thief and whoever might get the brick. Maybe you get that, otherwise you can be bitter all you want about the inequality and how stealing will resolve that.

More practically, I want to remove the financial incentive from stealing my phone. I want a thief to see it and think "why bother, I can't get anything for it".