Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Planned obsolescence: Apple attacked for the “serialization” of its spare parts

lemonde.fr

Post reply on HN
Print view View original

131–137 of 137 posts

Re: Planned obsolescence: Apple attacked for the “serialization” of its spare parts

#131

Post by realusername »

throwaway290 wrote: post #127
realusername wrote: post #124

Earlier quoted context omitted.

> What if a genuine part is modified. I am not sure it is a solvable problem? Same problem as it is now, nothing changes. > However if you are a phone, how would you distinguish between a legitimate repair and malicious swapping out of parts? Sounds like incompleteness theorem would say you can't If your threat model is malicious swapping parts, an iPhone isn't for you anyway, you need a device more secure than that.…

> Same problem as it is now, nothing changes. Now the phone warns you about a replaced part. Even if it is a genuine one. > If your threat model is malicious swapping parts, an iPhone isn't for you anyway, you need a device more secure than that. This is a thread model of many people in many countries today. Sorry for stupid question but is there a usable phone that is more secure, seriously?

> Now the phone warns you about a replaced part. Even if it is a genuine one.

Yes, and that's a broken behavior.

> This is a thread model of many people in many countries today. Sorry for stupid question but is there a usable phone that is more secure, seriously?

No it's not a threat model of many people. I'm not even aware of such an attack existing publicly, please link relevant media articles of past attempts, including on Android. Targeted attacks go for the software because it's easier and doesn't leave a trace.

> Sorry for stupid question but is there a usable phone that is more secure, seriously?

Publicly you have GrapheneOS, privately you have security firms providing secure systems for high profiles which are targets.

Re: Planned obsolescence: Apple attacked for the “serialization” of its spare parts

#132

Post by throwaway290 »

realusername wrote: post #131
throwaway290 wrote: post #127

Earlier quoted context omitted.

> Same problem as it is now, nothing changes. Now the phone warns you about a replaced part. Even if it is a genuine one. > If your threat model is malicious swapping parts, an iPhone isn't for you anyway, you need a device more secure than that. This is a thread model of many people in many countries today. Sorry for stupid question but is there a usable phone that is more secure, seriously?

> Now the phone warns you about a replaced part. Even if it is a genuine one. Yes, and that's a broken behavior. > This is a thread model of many people in many countries today. Sorry for stupid question but is there a usable phone that is more secure, seriously? No it's not a threat model of many people. I'm not even aware of such an attack existing publicly, please link relevant media articles of past attempts, inc…

> I'm not even aware of such an attack existing publicly, please link relevant media articles of past attempts, including on Android. Targeted attacks go for the software because it's easier and doesn't leave a trace.

Absence of evidence != evidence of absence. It is technically doable and not that difficult, give a minute or two in private with someone's phone.

> Publicly you have GrapheneOS, privately you have security firms providing secure systems for high profiles which are targets.

Does GrapheneOS protect from part replacement?

Also I mean entire populations, such as prosecuted ethnic minorities or people with political views (cf Uighurs or HK freedom supporters). They also need to live a normal life by the way, where they can use the normal apps and not conspicuously juggle two phones all the time.

Re: Planned obsolescence: Apple attacked for the “serialization” of its spare parts

#133

Post by throwaway290 »

realusername wrote: post #130
throwaway290 wrote: post #126

Earlier quoted context omitted.

> They could have also made a complete fake as well instead of a partial fake just by keeping the plastic enclosure, this device isn't exactly complicated. In case of this device, sure. But it would be much more costly and error-prone, build your own PCBs etc. But in case of iPhone we don't worry about them building fakes from scratch, because those would be easy to tell on the spot. We worry about a genuine phone wi…

> But in case of iPhone we don't worry about them building fakes from scratch, because those would be easy to tell on the spot. I suggest having a look to Youtube. Some fake iPhones are so good that unless you have a deep knowledge of the product, you can be fooled. I certainly would be fooled. > As it is now these phones are not so easy to hack without user proactively installing malware and many of them would survi…

I have never seen such a fake and I don't think they are common or even exist, care to link?

And regarding "payloads", yes but again it's an arms race and it goes away at the next security response. Hardware gives foothold

Re: Planned obsolescence: Apple attacked for the “serialization” of its spare parts

#134

Post by throwaway290 »

circuit10 wrote: post #128
throwaway290 wrote: post #122

Earlier quoted context omitted.

> If you really wanted to do it that much you could just modify the real parts It seems like the phone would alert for any swapped part, no matter genuine or not. Maybe this is why. Makes sense to me now.

I don’t think that’s why, I’ve never heard of that ever happening

Maybe you don't hear about it because it works and so no one attempts it

By the way long ago I got a screen repaired at an unofficial place, on an old iphone, and camera started working incorrectly (focusing issues etc). I kinda suspect they swapped the camera for a different one, if the phone warned me immediately that would have been cool. I heard many similar stories by the way.

Re: Planned obsolescence: Apple attacked for the “serialization” of its spare parts

#135

Post by lostmsu »

2OEH8eoCRo0 wrote: post #2

Interesting bit (translated) : > A practice contrary to the principle of the anti-waste law > In France, serialization is theoretically prohibited, according to Alexandre Isaac. Since the entry into force of the anti-waste law in November 2021, the consumer code mentions that "any technique, including software, by which a marketer aims to make it impossible to repair or recondition a device or to limit the restoratio…

So hypothetically if I get an app into iPhone app store, that is later removed by Apple for "duplicating functionality of the OS" (obviously, incomplete), would the inability to sideload the app from a web site be a violation of this law?

Re: Planned obsolescence: Apple attacked for the “serialization” of its spare parts

#136

Post by okennedy »

chongli wrote: post #52
okennedy wrote: post #19

Earlier quoted context omitted.

There are simple ways to allow hardware changes without losing security. One straightforward idea: Once the phone is unlocked (e.g. by pin code) allow the user to authorize the new hardware. This is effectively what Apple does already. The usual difficulties with asking users to make security choices don't really apply here: Physical changes to the hardware are requires, so security fatigue isn't as big a deal. Maybe…

One straightforward idea: Once the phone is unlocked (e.g. by pin code) allow the user to authorize the new hardware. I don't think most users are capable of auditing their generic hardware to be sure it is free of backdoors.

I'm not convinced that they need to. What threat model are you considering? In this case, the privilege that the user is granting the new hardware is the authority to unlock the phone.

Since the phone has to already be unlocked for this privilege to be granted, it can't be used to bypass authentication.

The hardware is already installed by this point, so if it's 'spying' it can do that. The user's choice has no impact on the hardware's ability to record and/or deliver information.

At best, the replacement hardware would be able to unlock the phone for the attacker at some later time. However, the cost of getting this customized unlocking device into the phone seems high given that the attacker needs physical access to the device to embed the hardware in the first place, and then again at a later time to get into the device.

Re: Planned obsolescence: Apple attacked for the “serialization” of its spare parts

#137

Post by okennedy »

vr46 wrote: post #56
okennedy wrote: post #19

Earlier quoted context omitted.

There are simple ways to allow hardware changes without losing security. One straightforward idea: Once the phone is unlocked (e.g. by pin code) allow the user to authorize the new hardware. This is effectively what Apple does already. The usual difficulties with asking users to make security choices don't really apply here: Physical changes to the hardware are requires, so security fatigue isn't as big a deal. Maybe…

I don't think this is quite that simple, because one user's authority could potential trump everyone else's in a company or group, once a vulnerable device infiltrates the system. Having trusted authorities works well when everyone has to rely on the security of the device. Once you can bypass that authority you effectively have a cheap MITM attack.

You are describing a different class of attacks. If the company owns the device, they should be free to (try to) lock it down all they want. OP is about Apple locking down devices that someone else ostensibly owns.
Post reply on HN