191–200 of 259 posts
Earlier quoted context omitted.
But you just unlocked it. That's the point. If you can unlock the phone without it then you might as well accept the fingerprint reader.
Maybe I'm not understanding your "attack": are you not saying that the repair shop can replace your phone with a malicious one with your data on it?
I don't have a problem with Apple showing whether the Battery is replaced or using genuine Apple Battery. My problem is that replacement done by Apple is both too costly and too time consuming. Current iPhone X / XS / XR Battery Replacement is $69, which is roughly double the price of being replaced on streets with similar battery. Now of course there are scammers who tries to replace a crappy battery, but going to w…
Maybe it's just me, but $69 for a repair that 1) Apple will stand behind, and 2) will add another two years of life to a $1000 phone, is a pretty good deal. While there are undoubtedly good third-party repair shops, there is also a lot of crap that isn't worth half of what Apple is charging. Subpar work, subpar parts.
"Subpar" is a very mild word to describe what was done there.
Earlier quoted context omitted.
They're claiming the factory wasn't authorized to manufacture the batteries, but that's only because they had an Apple logo on them, so he had them get rid of the logo, which is the only thing that requires them to be "authorized" for. How is that even controversial? It seems to be the opposite of counterfeiting -- making it so the non-Apple battery doesn't have the Apple logo.
Rossman tried to claim that Apple seized the batteries (they didn't: the DHS did, independently of Apple) and claimed they were counterfeit when they weren't. Except he was actually smuggling illicit batteries into the country (willfully obfuscating this fact by hiding the Apple logo) and then making videos claiming that they were completely genuine and Apple didn't want him to have these because Apple personally hat…
Earlier quoted context omitted.
Maybe I'm not understanding your "attack": are you not saying that the repair shop can replace your phone with a malicious one with your data on it?
You give them your phone and and the ability to unlock it, now they can copy all your stuff. The phone they give you back isn't yours, you have been pwned.
Why would I give them that? I'm handing the phone over powered-down and without revealing my passcode.
Earlier quoted context omitted.
> and want an only slightly less great browsing experience You mean far superior because Firefox actually has extensions for their mobile browser?
yeah but if you're running no-script you're not going to have as good of a browsing experience
Earlier quoted context omitted.
Rossman tried to claim that Apple seized the batteries (they didn't: the DHS did, independently of Apple) and claimed they were counterfeit when they weren't. Except he was actually smuggling illicit batteries into the country (willfully obfuscating this fact by hiding the Apple logo) and then making videos claiming that they were completely genuine and Apple didn't want him to have these because Apple personally hat…
They're only illicit if they have the Apple logo on them when they shouldn't, which is the whole point of taking it off.
Earlier quoted context omitted.
What installing a malicious fingerprint scanner buys you is that you can unlock the phone. Which means all you have to do is require the user to unlock the phone (e.g. with a PIN) to activate the new fingerprint scanner. That protects the data that was already on the phone when the new fingerprint scanner is installed. And as for future use of the phone, that's already hopeless, because if you have the capability to…
I am not sure I follow. (Edit: there is more to the threat model than the scenario that the device is being broken into outside of your possession. Consider just a fake part that pretends to authenticate you but sends a fixed fingerprint image or embedding or whatever to your SEP. You wouldn’t know but someone else could get into your device.) But each device has a unique encryption key that is implemented in hardwar…
Which was the second point. They can replace the whole phone and you're in the same situation. Having two components authenticate each other just requires them to replace both.
> The flash storage cannot simply be moved to a new device.
Not the way they've designed it, but there is no security reason not to allow that once the phone has already been unlocked.
Earlier quoted context omitted.
You give them your phone and and the ability to unlock it, now they can copy all your stuff. The phone they give you back isn't yours, you have been pwned.
> the ability to unlock it Why would I give them that? I'm handing the phone over powered-down and without revealing my passcode.
So they can repair your phone.
And they get the same thing when they give you the rogue phone back and you try to unlock it, at which point it sends the PIN to them and they can use it to unlock your original phone and then mount it over the network to display the same data until they've finished copying it.
Earlier quoted context omitted.
They're only illicit if they have the Apple logo on them when they shouldn't, which is the whole point of taking it off.
…but then you can't claim that there were genuine, as Rossman did in his videos.