We need to have a serious chat about iPhone repairability. We judged the phones of yesteryear by how easy they were to take apart—screws, glues, how hard it was…
Mfs out here want to install their bootleg faceid in my phone at their sketchy self repair place so they can sell my data and break its security. Let’s not pretend ifixit isn’t the exact same rent seeking that apple is, they just want to be the middle man
Those “bootleg” screens often are genuine, but Apple makes features not work unless paired. You can literally swap the screens of two fresh out of the box iPhones and they won’t work. Swap them back, they work fine. Don’t defend their practices, and don’t believe the lies about repair they’ve been feeding you for years.
often are genuine, but Apple makes features not work unless paired
Because unless you pair the screen, the device has no way to know it’s genuine. If it’s not, it could implement any number of attacks, including keyloggers, screen stealers, etc
don’t believe
Why shouldn’t I? No one has given an argument that you can actually secure these peripherals without software locks, I bought my iPhone and MacBook because they offer security, even when I run Linux on it my MacBook has far superior boot security (the only thing apple has engineering control over in that use case) than any intel machines I’ve used
Also lol that article, you know the difference between one incident and a pervasive effort to mine your privacy for profit
Why isn’t purchasing the part through Apple enough?
And also Is the consumer not allowed to assume the risk of going through after market repair that you seem to be concerned about?
This issue has always been about Apple trying to force older iPhones into obsolescence. They want the freedom to eventually say that no more parts exist for that device so you’ll have to upgrade. If repair shops can leverage broken phones to repair other phones, that extends the life of the device part Apples plans.
Most people will continue using older phones as long as they can because they don’t need the latest phone.
Um how exactly do you think these “rogue devices” would exfiltrate that data? Do you think iOS is providing Internet access to the faceID module or the display? Or do you think these devices somehow contain an entire wifi chipset to connect to the Internet to exfiltrate your data without anyone noticing an entire extra SoC soldered onto the part?
Please provide any argument as to why you think these could exfiltrate data over these interfaces? Unless you think iOS’s security is so poor that it lets any hardware device that’s attached to it get full network access? (Which I’m pretty sure is not physically even possible in most cases since those connectors are only capable of sending the type of data across for that particular sensor.)
To exfiltrate the login password from a keylogger on a macbook, for example, you need to have some software running on the cpu as well as the keyboard itself. This makes it very difficult to do in reality, as you have to infect both devices and if you do not have physical access, your exploit needs to be done across the keyboard interface, which makes it very hard to do in practice. Swapping any random keyboard in that could potentially be malicious introduces two issues, as now the keyboard itself may have a keylogger, as well as opening the possibility of exploiting some vulnerability in the cpu from the keyboard itself. You therefore open two attack surfaces that were previously closed, which is highly significant.
If you think keyloggers require software running on your physical keyboards you’re in for a rude awakening.
Keyloggers are almost always at a pure software level and are conceptually simple to make. So simple that in fact, it’s the same thing as running a regular application with background shortcuts. The only thing that is different is that regular apps aren’t saving/recording anything, they’re just listening for you to press cmd+whatever.
It takes maybe ~10-15 minutes to make a keylogger in Python that could run on any computer, mac, windows, or Linux. Maybe a little longer if you wanted to use a compiled language and properly hide it.
If a lock is broken, then you might call a locksmith to fix or replace it. This is something that happens frequently and isn’t as absurd as you make it out to be.
Mfs out here want to install their bootleg faceid in my phone at their sketchy self repair place so they can sell my data and break its security. Let’s not pretend ifixit isn’t the exact same rent seeking that apple is, they just want to be the middle man
You know what’s funny? It’s not the independent repair shops stealing your data, it’s the “official” ones. https://www.theverge.com/2021/6/7/22522560/apple-repair-multimillion-iphone-nude-photos-privacy-settlement-pegatron
Those “bootleg” screens often are genuine, but Apple makes features not work unless paired. You can literally swap the screens of two fresh out of the box iPhones and they won’t work. Swap them back, they work fine. Don’t defend their practices, and don’t believe the lies about repair they’ve been feeding you for years.
Because unless you pair the screen, the device has no way to know it’s genuine. If it’s not, it could implement any number of attacks, including keyloggers, screen stealers, etc
Why shouldn’t I? No one has given an argument that you can actually secure these peripherals without software locks, I bought my iPhone and MacBook because they offer security, even when I run Linux on it my MacBook has far superior boot security (the only thing apple has engineering control over in that use case) than any intel machines I’ve used
Also lol that article, you know the difference between one incident and a pervasive effort to mine your privacy for profit
Anything to defend the people who make your favorite magic rectangle amirite
No, give me the argument that you can secure these interfaces, some of which provide biometric security, without verifying vendor origin in software
Why isn’t purchasing the part through Apple enough?
And also Is the consumer not allowed to assume the risk of going through after market repair that you seem to be concerned about?
This issue has always been about Apple trying to force older iPhones into obsolescence. They want the freedom to eventually say that no more parts exist for that device so you’ll have to upgrade. If repair shops can leverage broken phones to repair other phones, that extends the life of the device part Apples plans.
Most people will continue using older phones as long as they can because they don’t need the latest phone.
Um how exactly do you think these “rogue devices” would exfiltrate that data? Do you think iOS is providing Internet access to the faceID module or the display? Or do you think these devices somehow contain an entire wifi chipset to connect to the Internet to exfiltrate your data without anyone noticing an entire extra SoC soldered onto the part?
Please provide any argument as to why you think these could exfiltrate data over these interfaces? Unless you think iOS’s security is so poor that it lets any hardware device that’s attached to it get full network access? (Which I’m pretty sure is not physically even possible in most cases since those connectors are only capable of sending the type of data across for that particular sensor.)
To exfiltrate the login password from a keylogger on a macbook, for example, you need to have some software running on the cpu as well as the keyboard itself. This makes it very difficult to do in reality, as you have to infect both devices and if you do not have physical access, your exploit needs to be done across the keyboard interface, which makes it very hard to do in practice. Swapping any random keyboard in that could potentially be malicious introduces two issues, as now the keyboard itself may have a keylogger, as well as opening the possibility of exploiting some vulnerability in the cpu from the keyboard itself. You therefore open two attack surfaces that were previously closed, which is highly significant.
If you think keyloggers require software running on your physical keyboards you’re in for a rude awakening.
Keyloggers are almost always at a pure software level and are conceptually simple to make. So simple that in fact, it’s the same thing as running a regular application with background shortcuts. The only thing that is different is that regular apps aren’t saving/recording anything, they’re just listening for you to press cmd+whatever.
It takes maybe ~10-15 minutes to make a keylogger in Python that could run on any computer, mac, windows, or Linux. Maybe a little longer if you wanted to use a compiled language and properly hide it.
Sorry to burst your bubble.
And what does that have to do with the risk of a screen repair?
I can also install a key logger on Linux and I can also freely change the SSD to anything I buy on the internet.
And yet somehow people still use computers!? Madness.
Do you really think that replacing FaceID suddenly gives thieves unfettered access to your phone?
So then you’ll let me change the locks on your front door to one I choose?
If a lock is broken, then you might call a locksmith to fix or replace it. This is something that happens frequently and isn’t as absurd as you make it out to be.