Hacker News Reader

I took his point to be that Apple encourages you to go the insecure route and just trust them instead of teaching their customers good security awareness. Apple doesn't suggest to you to wipe your phone, they tell you to just trust them.

A better analogy from the physical world would be a locksmith who tells you to just leave your keys under the door mat for him so that he can come in and do the work when you aren't home.

And plenty of people would be willing to make that trade-off on security for convenience. (This is locksmith right? Like...you realize if he actually cared he could get in your house without keys?) Others wouldn't. Depends how sensitive your personal information is; or in the locksmith analogy, to what extent you consider your valuables irreplaceable. Seems kind of silly to expect every layperson to operate to the same security standards as a security professional. My mother does not have credentials to dozens of business systems on her phone; she has pictures of her cats and maybe a credit card account stored somewhere.

The locksmith analogy breaks down fast: the locksmith can enter into your house if he really tries, but Apple can not enter into your phone without your help (if it can, it's utterly broken)

Remember Apple (the organization, not some random 'Genius') has code that runs as root on all Apple devices and can remotely update that code.

> but Apple can not enter into your phone without your help

Of course Apple can - that is why the FBI asked them to do just that. Apple won't as a matter of principle, not due to any technological limitation.

> Of course Apple can - that is why the FBI asked them to do just that.

If they can, it's broken. Do not buy those devices.

You are hopelessly naive. Do you have some method for independently verifying Microsoft and Google cannot remotely access their respective consumer OS's that you'd like to share with us?

Your analogy isn't correct.

It's more akin to leaving the car keys with the manufacturer when you are getting your car serviced.

...with all your personal information (bank info, passwords, etc.) written down on a notebook left on the seat of the car? Then yes, the car analogy works.

And you can choose to take those personal items out.

Choice which is not offered to you by Apple. They are neither explaining what it means to give them the unlocked phone nor telling you that you have the option to wipe out the phone before handing it to them.

You are supposed to know that beforehand, and they are even discorauging you to consider that there are some issues with handing over an unlocked phone, which means 95% of their userbase are not aware that there are security implications.

The Apple Genius should tell the customer:

You have two options: either you give me you unlocked iPhone and I, and any of my colleagues, could steal any information from your device, or you backup and wipe the phone before giving it to us.

That is, Apple should make very clear what it means giving an unlocked phone to an untrusted third-party - even when that party happens to work for Apple.

Let's not forget that, by definition, Apple the company is also an untrusted third-party (not only the Apple employees).

> Let's not forget that, by definition, Apple the company is also an untrusted third-party

Maybe in theory. In practice, the devices trust all software updates signed by Apple's certificates. Who knows what other trusted diagnostic hardware exists 'at the back' referred to in the article.

>The author himself points out in the article that Apple provides you with the necessary tools to hand Apple support a completely wiped phone as they diagnose your issue and then recover it again at home. If his point is simply that this process is inconvenient and the state of the art should be better, then I think it's a pretty weak point.

An anecdote from a long time Nexus owner: last year my Nexus lost the ability to charge via its USB port. After a short while on the phone with Google (who, contrary to other anecdotes I've read here, does have good customer service in my experience), they overnighted me a brand new phone at no charge. They too provided me instructions on wiping my phone before sending it back, but they also provided me a brand new device without ever having to hand over my old one for evaluation first. It was easy enough to setup the new phone, since my old one had plenty of charge when the new phone arrived the next day.

Does Apple do this? Is it a requirement to bring your phone into an Apple store or ship it to get replacement equipment? If they provide similar service as Google gave me, this seems more like a complaint about Apple Stores or their employees, and not Apple.

You can call and get a new phone, and send your old phone back in the same box.

I think the author's main point is that Apple's process violates the principle of least privilege. Technicians shouldn't require access to the software in order to repair a hardware problem.

> plumber

Is Apple support bonded and insured, so the risk to the customer is limited? Do they follow a code of ethics[1] that creates requirements to, for example:

    ...act as a trustworthy and fiduciary agent
    for each employer or client, shall seek
    no favors and shall not profit or misuse
    confidential client or employer information.

[1] https://www.aspe.org/codeofethics

This is similar to a fundamental disconnect that I've observed between lawmakers and tech guys.

Tech guy: "This process is obviously broken. Any cop could spy on me with this!"

Lawmaker: "Oh, don't worry. There's a law forbidding that."

I'm under the impression that some lawmakers actually think that a law forbidding snooping will keep snoops out.