Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Secure Boot Works on M1 Series Macs

eclecticlight.co

Post reply on HN
Print view View original

51–60 of 117 posts

Re: How Secure Boot Works on M1 Series Macs

#51

Post by lovelyviking »

hraedon wrote: post #43
lovelyviking wrote: post #29

Earlier quoted context omitted.

>It really depends on the threat you are planing against. What about oppressive let's say Russian government while you travel let's say in Ukraine and then occupation occurs. Not a fantastic scenario by the way ... It really doesn't depend on the threat at all. It's about the model of the society you wish to have and what values you promote. It's about who you wish to be responsible : the 'big company' caring about y…

All sentiments like this one and those similar to it elide the facts that 1) we’ve tried relying on “user responsibility” before, and excusing the comically bad outcomes through victim blaming doesn’t change them; and 2) we didn’t get together and vote Apple the only manufacturer of computers. If you don’t like their model, choose someone else. Why should average users who would otherwise be served perfectly well by…

>If you don’t like their model, choose someone else.

Many follow their example and without push back there will be no someone else because average users my not understand consequences unless they are educated by people who do understand them. Like with many other areas requiring certain level of expertise to understand consequences of certain desicions.

> we’ve tried relying on “user responsibility” before, >Why should average users who would otherwise be served perfectly well by Apple’s solution be required to be “responsible”

Do you believe in choice? If you do then average users should have a choice whether to rely on Apple or switch such functionality off. Without having such choice people become less and less responsible. You can say they choose by buying such machines but I do not think this could be qualified as a choice just like accepting EULA. It's not really a choice.

Re: How Secure Boot Works on M1 Series Macs

#52

Post by kmeisthax »

zaxbeast wrote: post #6

completely insecure if you are not the only one with the key

Well, if you want to distrust Apple software you probably shouldn't be trusting their hardware, either.

That being said, I actually think this is a reasonable way to do secure boot. The default OS the device ships with can be validated, but there's still a proper owner override so you can boot into Linux or whatever. They even use the SEP to validate that the owner override has been tripped by the owner. The first user account you make gets handed a key generated by the SEP that can be used to sign kernels, so only that account can actually use the owner override. This is a good way to stop evil-maid attacks in their tracks while still not locking the user out of their property.

My only real complaint is that Apple's gone to great lengths to ensure the iOS side of their business is completely unaffected by owner overrides:

- If you boot into an owner-signed OS volume, macOS disables it's iOS support

- iPad-fused M1s won't generate or respect owner keys

This is silly. If individual iOS applications are sensitive to owner overrides, then they already have devicecheck APIs to get a cryptographic attestation that they haven't been tampered with. The SEP could flag those attestations as coming from an owner-signed kernel and picky banking apps[0] could check for that.

[0] And Pokemon GO, because it's easier to blacklist jailbroken users than to enforce a rate limit on GPS jumps

Re: How Secure Boot Works on M1 Series Macs

#53

Post by afandian »

InvertedRhodium wrote: post #50
judge2020 wrote: post #45

Earlier quoted context omitted.

This has been a thing on iOS since I want to say the iOS 7 days, ie. the introduction of shsh2 blobs, and it ultimately hasn't been an issue.

Unless, of course, you need to perform a low level recovery when Apples servers are unavailable, for whatever reason. Then, it seems that it would be quite the problem.

Or they do the equivalent of forgetting to update a root CA, orphaning your machine, as happened to a family member of mine.

Re: How Secure Boot Works on M1 Series Macs

#54

Post by kmeisthax »

smoldesu wrote: post #42
lovelyviking wrote: post #36

Earlier quoted context omitted.

therefore I've said this before: The full control of devices you own is absolutely essential. It requires a complete transparency of basic components like cpu micro-code, firmware and hardware otherwise it can and will be abused. [0] .. unless everything is absolutely transparent including microcode and hardware it is not acceptable as freedom respecting solution. [1] then I've got unexpected opposition from the one…

marcan seems to be part of a new breed of hacker, less interested in the "why" we do it and more interested in the "how" of it. Works pretty well for tackling a challenge like blindly picking at a black-box ISA/SIP, but I don't think his project has the kind of ideological understanding that keeps the libre desktop alive. Getting it to work is one thing; building a community to maintain your work is another. Unfortun…

You're not giving Hector Marcan enough credit. He was on Team Twiizers and fail0verflow; groups that did a lot of hacking to open up closed systems. It's not like he's unaware of the customer abuse that happens in the proprietary world.

The "look beyond freedom" quote probably should also be looked at with the context that he's talking about the FSF, which has an odd habit of being extremely absolutist in ways that actually hurt the user. Like, they'll point out that Wi-Fi cards with proprietary firmware are bad, but then endorse very similar hardware where the firmware blob is in ROM or some features are lasered off just to conform to the "proprietary ROMs don't count" rule. Marcan is arguing for creating a gradual sliding scale of "proprietary, user-hostile, and/or insecure" to "Free, user-respecting, and/or secure" and then looking at the trade-offs between them, rather than just creating a really high bar based on what made sense in the late 1980s and sticking to it forever.

Re: How Secure Boot Works on M1 Series Macs

#55

Post by smoldesu »

hraedon wrote: post #43
lovelyviking wrote: post #29

Earlier quoted context omitted.

>It really depends on the threat you are planing against. What about oppressive let's say Russian government while you travel let's say in Ukraine and then occupation occurs. Not a fantastic scenario by the way ... It really doesn't depend on the threat at all. It's about the model of the society you wish to have and what values you promote. It's about who you wish to be responsible : the 'big company' caring about y…

All sentiments like this one and those similar to it elide the facts that 1) we’ve tried relying on “user responsibility” before, and excusing the comically bad outcomes through victim blaming doesn’t change them; and 2) we didn’t get together and vote Apple the only manufacturer of computers. If you don’t like their model, choose someone else. Why should average users who would otherwise be served perfectly well by…

User responsibility and device safety are not mutually exclusive. You can keep the iPhone exactly as-is and add a developer mode that would pretty much shut up every nerd this side of the Mississippi.

Re: How Secure Boot Works on M1 Series Macs

#56

Post by smoldesu »

kmeisthax wrote: post #54
smoldesu wrote: post #42

Earlier quoted context omitted.

marcan seems to be part of a new breed of hacker, less interested in the "why" we do it and more interested in the "how" of it. Works pretty well for tackling a challenge like blindly picking at a black-box ISA/SIP, but I don't think his project has the kind of ideological understanding that keeps the libre desktop alive. Getting it to work is one thing; building a community to maintain your work is another. Unfortun…

You're not giving Hector Marcan enough credit. He was on Team Twiizers and fail0verflow; groups that did a lot of hacking to open up closed systems. It's not like he's unaware of the customer abuse that happens in the proprietary world. The "look beyond freedom" quote probably should also be looked at with the context that he's talking about the FSF, which has an odd habit of being extremely absolutist in ways that a…

I'm giving the dude all the credit he deserves. fail0verflow is amazing, the stuff they did with Nvidia Tegra/Nintendo Switch was nothing short of miraculous and insane; that doesn't change the cards at the table though, and it doesn't make me any less skeptical of where all this leads. Again, I've got no intention of stopping people who are making progress, even if it's progress I disagree with, but he still has to prove himself here, and I'm not entirely confident that we're going to end up with "Linux, but on the M1" without a number of asterisks trailing the statement. That was the case with the Switch, that was the case with the PS4, and it's unfortunately crawling in that direction for the M1 as well.

Re: How Secure Boot Works on M1 Series Macs

#57

Post by cmurf »

lovelyviking wrote: post #26
xoa wrote: post #23

Earlier quoted context omitted.

For the record, I'm in favor of legal mandate that hardware owners have the buy-time option to enable adding their own keys to any root trust stores on their devices. However, that'd be in addition to Apple's keys and wouldn't be about the security of Apple's keys, because Apple is part of the fundamental trust foundation if you buy a Mac or iDevice. Period. The devices are massively vertically integrated, right down…

>If you completely don't trust Apple, then you absolutely should not use their hardware at all. So some level "trust Apple" is simply a security axiom on this platform. It is not about trusting Apple or any other company for that matter. It is about tendency and attempt to make it a norm/legalize to sell personal computers without respecting right of the owner to have a full control over their own computer. If owner…

I agree it's "your own device", but Apple's EULA makes it really clear it's only your own device insofar as you can choose to destroy it. They retain a residual right over the hardware, a partial ownership if you will, when it comes to what software is on it. You aren't buying hardware. You're buying an experience. You don't have the right to experience arbitrary software running on it, even if you trust it.

It's one of the reasons I'm not using Apple products anymore.

Re: How Secure Boot Works on M1 Series Macs

#58

Post by throwawayay02 »

jahewson wrote: post #46
lovelyviking wrote: post #26

Earlier quoted context omitted.

>If you completely don't trust Apple, then you absolutely should not use their hardware at all. So some level "trust Apple" is simply a security axiom on this platform. It is not about trusting Apple or any other company for that matter. It is about tendency and attempt to make it a norm/legalize to sell personal computers without respecting right of the owner to have a full control over their own computer. If owner…

> Company goes away We’re talking about Apple, one of the most valuable companies in the world, sat on over $100bn in cash just “going away”, in what, the lifetime of a laptop? For me that’s 3-5 years, for others maybe 10. That’s an absurd premise. The probability of that is so close to zero it doesn’t bear consideration.

What if it's broken by legislators and the pieces are named something differently. Want to bet no apple.com links get broken? And their certificates?

The point is, if I want to buy a personal computer and stuff it in the closet for 50 years to use later, that's between me and the creator. Not Tim Cook.

Re: How Secure Boot Works on M1 Series Macs

#59

Post by lovelyviking »

mlyle wrote: post #49
lovelyviking wrote: post #32

Earlier quoted context omitted.

How about much simpler scenario, no threat at all. Just dumb bug in software that puts your computer in DFU mode that says, please connect it to another Mac. Nice isn't it? And then you should run and find 'another mac'. What if there are no other macs around? What if you travel and have no connection to the internet or it's limited ? This is not a hypothetical situation, this is exactly what have happened in my case…

> Just dumb bug in software that puts your computer in DFU mode that says, please connect it to another Mac. Nice isn't it? And then you should run and find 'another mac'. If your fundamental firmware-stuff is screwed up on any platform, you are going to have a bad time. Being able to plug into an off-the-shelf machine and fix it, or to plug into another PC running special software, is much better than I'm accustomed…

>If your fundamental firmware-stuff is screwed up on any platform

Sure I just have an impression after some googling that this DFU happens much more frequently then one would expect. Certainly I didn't expect it to happen in the first day after purchase but it did. So perhaps this pleasing 'much better' ability to fix it by just connecting it with another device that you probably do not possess(in my case) comes with another pleasure of having to do it more frequently. If that is the case then I really prefer the state to which you are accustomed to.

Re: How Secure Boot Works on M1 Series Macs

#60

Post by mlyle »

lovelyviking wrote: post #59
mlyle wrote: post #49

Earlier quoted context omitted.

> Just dumb bug in software that puts your computer in DFU mode that says, please connect it to another Mac. Nice isn't it? And then you should run and find 'another mac'. If your fundamental firmware-stuff is screwed up on any platform, you are going to have a bad time. Being able to plug into an off-the-shelf machine and fix it, or to plug into another PC running special software, is much better than I'm accustomed…

>If your fundamental firmware-stuff is screwed up on any platform Sure I just have an impression after some googling that this DFU happens much more frequently then one would expect. Certainly I didn't expect it to happen in the first day after purchase but it did. So perhaps this pleasing 'much better' ability to fix it by just connecting it with another device that you probably do not possess(in my case) comes with…

I have never had to deal with firmware on Apple hardware (excepting "zapping the PRAM" on classic Macs). I've had to deal with it dozens of times on other platforms.

We have 3 Apple Silicon based Macs in the house, and there's 4-5 others that I support. So far 0 incidents in about 3 device years. I don't think it's tremendously common like you imply.

In the same time period, I built two Ryzen machines, and had to swap in older processors to run BIOS updates on each, and the laptops in my wife's classroom all decided to take themselves out of service for an hour one day to do BIOS updates that were delivered by Windows update and then only triggered on the second reboot after update when we all thought we were safe.

Post reply on HN