“Could you disable your Mac's password?” asked at an Apple store (2018)

I had the same experience at the apple store a few years ago, where they asked me for my password. They insisted they needed it to run "hardware checks." I think I ended up just wiping it before giving it to them.

I wasn't happy about it, so I complained to corporate. I got a voicemail a few days later from a very apologetic store manager, saying that they would review the policy (who knows if they did). Furthermore, they found issues with my logic board, and replaced it (out of warranty) for free. So that was nice. Still wouldn't ever turn in a computer for service without wiping it however.

I too was asked to provide my user (admin) password when getting my MacBook's screen replaced at an Apple Store. I had the same concerns as OP, but I asked if I could set up a new, separate user account with standard permissions (just for them) so that they could verify their work that way.

That was a fine compromise for them, but it did make me wonder how many other, less-savvy customers were providing their main admin passwords in this manner...

If you ever need to swap out a ssd at the Apple store, they won't give you back the old drive and promises you that they'll dispose of it..

I feel like this is a huge security risk if you're doing any kind of IP development.

Last time I turned in my MacBook Pro for repair (battery replacement), I pulled the SSD out ahead of time. They were pretty upset with me for this, but were able to complete the repair just fine.

With the more recent models, the SSD is soldered on and this would have been impossible.

Lenovo does this too. I just wiped my computer and made installing/testing the OS their responsibility.

Considering the recent payout from apple over leaked images from a college woman that was asked to hand over the password for the phone she had serviced it's a pretty atrocious ask for a strictly hardware issue.

This also used to happen with iOS only a few years ago but they improved iOS since to allow all the calibration tools to run without your passcode.

Be good to know if they’ve since fixed Macs in the same way.

Apple can read all of your iMessages and texts out of your non-e2e iCloud Backups, and they can see all of your Photos in your iCloud Photos. iCloud syncs all of your contacts to them, too. iCloud Backup is on by default so it’s safe to say that Apple can read everyone’s iMessages (even despite their claims of e2e encryption, which are now bogus due to the backup backdoor).

Every time you open the App Store, it sends your permanent, unchangeable device serial number to Apple along with your Apple ID, which is tied to your name and address and phone number and payment cards. (You can’t get an Apple ID without a phone number.) Many apps are App Store only, and on iOS it’s all apps.

Having location services on means your exact location is being sent in realtime over the network to Apple constantly (it’s not just passive GPS reception). Launching apps sends identifiers over the network to Apple in realtime (unencrypted, even, so even your ISP can see), so they know what apps you use, and where and when you use them. This all happens even with analytics disabled.

Even if you have iCloud off, using Siri sends your contacts and other data to Apple.

Books and Music track what you listen to, how often, and on which devices, under your Apple ID.

Even if you don’t use Apple for email, iCloud syncs your Mail app recent addresses autocomplete to Apple, who can then see who you correspond with.

All macs and iphones and ipads maintain a persistent 24/7 connection to Apple push servers with a client certificate linked to the hardware serial number of the device. If you aren’t using external VPN hardware at all times, this continuously leaks your city level location and ISP to Apple on a per-serial basis (which is linked to your Apple ID and name due to App Store use above). They know when you leave home and switch to 4G. They know when you arrive at work. They know when you travel to another city, and which hotel you stay in. They get all of this data even with location services off due to the invisible phone-home built in to the OS, and this happens even if you don’t use iCloud or any App Store apps.

Apple’s “commitment to privacy” or whatever presupposes that you don’t need or want privacy from Apple themselves. It is thus entirely natural for Apple staff to continue in this vein, as most Apple customers have surrendered their most private and sensitive data to iCloud and other Apple services already.

(In 2019, they turned over more than 30,000 customer accounts of data to the US federal government under FISA orders (per Apple’s own transparency report on their website), which are not warrants and do not require probable cause. Even if you trust Apple staff completely, there are reasons not to trust the federal investigators to whom they are compelled to leak your data without suspicion of a crime.)