Hacker News Reader

Comment by gepeto42 | Hacker News Reader

Or, you could make your device supervised via MDM or Apple Device Configurator, and disable "Allow devices to pair with other computers". This will generate a keypair on the machine running Device Configurator + the iPhone, and no other USB data connection will be allowed - you won't get prompted for "Trust" at all (except for CarPlay etc.).

On top of that, since iOS 11 (or maybe 10), trusting a USB device requires the passcode by default, so even having your phone ripped out of your hands unlocked does not lead to the ability to take a USB backup directly anymore.

View on HN

> Or, you could make your device supervised via MDM or Apple Device Configurator, ...

I haven't looked into this so I apologize if it's an easily answered question but... is this (MDM/ADC) something an individual can do for their own devices? I know it can be done at the organizational level for, e.g., employer-owned devices, but how hard is this for Joe Blow to set up for, say, his kids' iPads and iPhones?

Yes. This is a very old article I had written back in the iOS 9 days, it still mostly applies.

A few warnings:

1 - Changing an iOS device to "Supervised" will wipe it (so you can't supervise someone else's device and data).

2 - Backing up iOS devices over USB after requires that you keep the keypair, and makes restoring to new devices much more complicated. I would not recommend relying on USB backups if using this method unless you play around and understand it well.

3 - Be sure you set the profile to be removable only by wiping the device, or using Device Configurator, otherwise, the profile could be deleted to enable USB.

4 - One could wipe the keys completely to be sure that NO machine has USB access to the phone, meaning it would need to be restored to factory defaults for USB to work again.

https://blog.rapid7.com/2015/11/26/reduced-annoyances-and-in...

Configurator is awesome, especially for VPN profiles. But do note that many of its features can only deploy to managed devices under an Apple enterprise cert.

Reply on news.ycombinator.com