Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Exclaves

randomaugustine.medium.com

Post reply on HN
Print view View original

31–40 of 233 posts

Re: Apple Exclaves

#31

Post by vlovich123 »

lern_too_spel wrote: post #22
neom wrote: post #9

I think Steve truly believed at his core, very simply: your laptop is your diary, and they have a responsibility to that. I don't think Tim would be CEO if he didn't believe what Steve did. It's so weird, but I really miss Steve. https://www.youtube.com/watch?v=Ij-jlF98SzA

Steve believed at his core that locking down devices was the best way to extract business value from users. That's why you can't install any apps without telling Apple or get your location without sending it to Apple. He also believed very strongly in good marketing, and he jumped on privacy marketing very quickly after the Facebook - Google privacy spat that coincided with the failure of iTunes Ping.

The company shift to privacy was more about getting pulled in front of Congress over the location data being accessible via USB as part of iTunes backup:

Source: people who were at Apple during that time period.

Example: https://www.nbcnews.com/news/world/government-officials-want...

I think people underestimate how traumatic it was culturally to Apple and how Apple generally experiences comparatively little turnover vs their other major tech peers, so the responses to those traumas linger. Same with the brouhaha over the CSAM tech that they attempted to bundle into the iPhone that ostensibly was trying to preserve your privacy and they instantly got smacked down over it.

Re: Apple Exclaves

#32

Post by vlovich123 »

hedora wrote: post #21
vermilingua wrote: post #12

Earlier quoted context omitted.

This is just plainly false. Passkeys, biometrics, app permissions, and a suite of other user-centric privacy features have clear benefit from strong isolation from an "insecure world" kernel.

How so? Isn’t this just the xkcd authorization model? https://xkcd.com/1200/ I tried to read the article, and know what all the words mean (sel4, enclaves, virtualization primitives, etc.). It all seems very complicated and error prone, but I couldn’t figure out what the attack model is, or what the security objectives are. Eg, what sorts of things run in exclaves, and under what circumstances will a persistent kerne…

The most likely attack model I can imagine is that a jailbroken phone still won’t be able to violate certain functionality (eg a recording LED remains lit, various supervisor functionality can’t be disabled, etc)

Re: Apple Exclaves

#33

Post by baggy_trough »

musicale wrote: post #16
neom wrote: post #9

I think Steve truly believed at his core, very simply: your laptop is your diary, and they have a responsibility to that. I don't think Tim would be CEO if he didn't believe what Steve did. It's so weird, but I really miss Steve. https://www.youtube.com/watch?v=Ij-jlF98SzA

It is weird. Jobs was divisive and (not infrequently) abrasive, and why would you miss a tech billionaire anyway? Yet I also feel indebted to him and to the folks at Apple who helped to produce some of my favorite products like the Mac, the iPod, and the iPad. Jobs also said a lot of things that still resonate with me. Recently Apple introduced a "classic Mac" screensaver that shows how carefully designed the origina…

> why would you miss a tech billionaire anyway

Because we miss new instances of the great products they created to earn all that money.

Re: Apple Exclaves

#35

Post by 6stringmerc »

neom wrote: post #25
musicale wrote: post #16

Earlier quoted context omitted.

It is weird. Jobs was divisive and (not infrequently) abrasive, and why would you miss a tech billionaire anyway? Yet I also feel indebted to him and to the folks at Apple who helped to produce some of my favorite products like the Mac, the iPod, and the iPad. Jobs also said a lot of things that still resonate with me. Recently Apple introduced a "classic Mac" screensaver that shows how carefully designed the origina…

Now that I'm becoming an old man, I've taken the time to go back and listen to him properly, to analize his thoughts and words a bit more contextually, and I've come to believe that Steve Jobs was quite misunderstood, both by us, and by himself. When I miss him I think: his thoughts were so very refined for his time, it is quite incredible and I wish he was around to hear more of them. I guess I'm a fan? Oh well...wo…

I still think about how he tried to cure cancer with crystals and then when that didn’t work he used his wealth to get residency in a different state to jump in line for a transplant and still died before his yacht got completed. I don’t misunderstand him at all. Especially the parking in handicap spaces part. Very easy to understand what kind of person he was through his actions. Perhaps we will never see eye to eye, and I feel posts like yours do deserve legitimate opposition as applicable.

Re: Apple Exclaves

#36

Post by hedora »

timewizard wrote: post #29
hedora wrote: post #21

Earlier quoted context omitted.

How so? Isn’t this just the xkcd authorization model? https://xkcd.com/1200/ I tried to read the article, and know what all the words mean (sel4, enclaves, virtualization primitives, etc.). It all seems very complicated and error prone, but I couldn’t figure out what the attack model is, or what the security objectives are. Eg, what sorts of things run in exclaves, and under what circumstances will a persistent kerne…

What he misses is "tamper evidence." In order to do those things I have to actually steal his laptop. Which would be obvious to him. It also implicates me. If I could just remotely install a driver I don't need to worry about any of that and I can steal remotely and anonymously.

Can’t you just remotely install a keylogger (e.g. a modified version of zoom)?

Re: Apple Exclaves

#37

Post by hedora »

vlovich123 wrote: post #32
hedora wrote: post #21

Earlier quoted context omitted.

How so? Isn’t this just the xkcd authorization model? https://xkcd.com/1200/ I tried to read the article, and know what all the words mean (sel4, enclaves, virtualization primitives, etc.). It all seems very complicated and error prone, but I couldn’t figure out what the attack model is, or what the security objectives are. Eg, what sorts of things run in exclaves, and under what circumstances will a persistent kerne…

The most likely attack model I can imagine is that a jailbroken phone still won’t be able to violate certain functionality (eg a recording LED remains lit, various supervisor functionality can’t be disabled, etc)

Oh; so the camera LED and camera data path would run a remote attestation protocol with the exclave, and the exclave would make sure the led is on whenever it’s forwarding on data from the camera?

(Though I’m not convinced that will actually work on modern apple devices, where the led is pixels that run through the compositor — I guess the video driver stack and window managers are also exclaves in this world?)

Re: Apple Exclaves

#38

Post by wtallis »

akyuu wrote: post #11

I wonder how this will affect macOS security, since SPTM is not used according to Apple documentation: https://support.apple.com/guide/security/operating-system-in... For now, I think existing exclaves such as the one that displays the camera indicator do not really apply to macOS (since MacBooks have dedicated hardware for that), but in the future there might be exclaves that do.

> since SPTM is not used according to Apple documentation:

Try reading that footnote again:

> Note 2: Page Protection Layer (PPL) and Secure Page Table Monitor (SPTM) enforce the execution of signed and trusted code on all platforms with the exception of macOS (because macOS is designed to run any code). All of the other security properties, including the protection of page tables, are present across all supported platforms.

It doesn't say macOS doesn't use SPTM. It says macOS doesn't use SPTM to prevent running unsigned code, since macOS is supposed to allow unsigned code (after the user jumps through some hoops).

Re: Apple Exclaves

#39

Post by lxgr »

hedora wrote: post #21
vermilingua wrote: post #12

Earlier quoted context omitted.

This is just plainly false. Passkeys, biometrics, app permissions, and a suite of other user-centric privacy features have clear benefit from strong isolation from an "insecure world" kernel.

How so? Isn’t this just the xkcd authorization model? https://xkcd.com/1200/ I tried to read the article, and know what all the words mean (sel4, enclaves, virtualization primitives, etc.). It all seems very complicated and error prone, but I couldn’t figure out what the attack model is, or what the security objectives are. Eg, what sorts of things run in exclaves, and under what circumstances will a persistent kerne…

Delegating key derivation and/or password validation, combined with secure UI state indication, to a more secure execution environment can be a big win for security, for example.

I could imagine a passkey implementation with some extensions that allow securely presenting what the user is consenting to and how ("enter your payments PIN or password now to confirm a payment of $x to merchant y").

It's of course even better to do that in tamper-proof security coprocessors such as Apple's secure enclave, but TEEs have the big advantage of having access to much more memory and faster processing, which allows doing more complicated things there more easily.

They can also always lean on the secure hardware for actual key management, but handle more complex user interface operations in an environment that's still more secure than the main OS.

Android has supported something just like that years ago with "protected confirmation" [1], but unfortunately it's only available on Pixel phones and hasn't really been picked up by app developers as a result; the situation for Apple is of course very different, so I have some hopes that if they launch something comparable it could actually see some adoption.

[1] https://android-developers.googleblog.com/2018/10/android-pr...

Re: Apple Exclaves

#40

Post by lxgr »

hedora wrote: post #37
vlovich123 wrote: post #32

Earlier quoted context omitted.

The most likely attack model I can imagine is that a jailbroken phone still won’t be able to violate certain functionality (eg a recording LED remains lit, various supervisor functionality can’t be disabled, etc)

Oh; so the camera LED and camera data path would run a remote attestation protocol with the exclave, and the exclave would make sure the led is on whenever it’s forwarding on data from the camera? (Though I’m not convinced that will actually work on modern apple devices, where the led is pixels that run through the compositor — I guess the video driver stack and window managers are also exclaves in this world?)

I'm not sure how complex modern display controllers are, but I could imagine a simple priority hardware overlay functionality that an exclave has access to (similar to the dedicated "cursor overlay" functionality some older GPUs had, as far as I understand).

Once you have that, you can take the idea further: Displaying an indicator that confirms that all your keystrokes are going to an exclave validating your password, for example.

The much-hated touch bar actually enabled just that, for Apple Pay payments, as far as I remember: It could display something like "touch to confirm payment of $x" on its own screen in a way that was impossible to manipulate from macOS – now here's an opportunity to bring that level of security back without requiring a dedicated display or taking away people's beloved function keys.

Post reply on HN