Hacker News Reader

Comment by icu | Hacker News Reader

This anti consumer approach by Apple is why I refuse to buy anything from them. My last Apple purchase was the iPad Gen 1 as I thought it was a truly remarkable device when it came out but the planned obsolescence was obvious after a few short years.

Recently I had my XPS15 power cord plug break and while I waited for the spare part (that I could repair myself) I had the pleasure of borrowing my partner's MacBook which was an amazing experience compared to Windows. However, that experience is nothing to the cost and pain if something with the hardware goes wrong. Even when I forgot my Apple ID (as it had been so long) it took over a week before Apple deemed it okay for me to recover my password.

I get the seduction of using a snappy beautiful machine and UX, but I just don't think it's worth it tying myself to Apple and being walled in the whole ecosystem upgrade treadmill.

View on HN

> Even when I forgot my Apple ID (as it had been so long) it took over a week before Apple deemed it okay for me to recover my password.

I do not see what is wrong this added security. For something that unlocks basically everything about me, it seems reasonable to not let it be unlocked at a moment’s notice.

From my point of view I believe I can be trusted to reset my Apple ID quickly. I'm very security conscious which is why unlocking my Apple ID does not unlock 'everything about me'. As I mentioned in a previous reply, I get it now... if you did trust Apple with everything about yourself, you would see the delay as reasonable security.

However, I just don't trust Apple that much because they are at the end of the day a huge corporation that couldn't give a monkey's if my data was compromised. I'm a little guy and Apple isn't going to apologise or make it right if something catastrophic happened. The Fappening is case and point. These celebrities trusted Apple and completely outsourced their security only to find their privacy violated in shocking horror.

So, I understand where you're coming from, but it's a step too far for me.

That infamous case was the result of poor password use followed by an unguarded login page with no retry limit. This isn’t meant to victim blame, but it’s to also point out Apple too was a victim on this, they have a far stronger commitment to privacy compared to other companies.

Sure, but these celebrities completely outsourced their security to Apple because they trusted Apple.

"Apple knows best"... but clearly not because Apple should have had rate limiting for password login attempts to stop password brute-forcing attacks.

As for the far stronger commitment to privacy, I'm not so sure. Apple seems reluctant at times to patch zero-days which has been covered on the front page of HN.

>... rate limiting for password login attempts...

Good news then I suppose. They did, that's not what happened. People abused password reset, with the canonical example being Paris Hilton using her dog's name as a security question.

> From my point of view I believe I can be trusted to reset my Apple ID quickly.

A different, devil’s advocate perspective, might be that if you forgot you Apple ID credentials, you should not be trusted to reset your Apple ID. I have passwords from 15+ years ago in my password safe. I have never needed to reset my Apple ID.

The other thing to consider, is whether you’d be happy for an attacker to reset your Apple ID quickly. Apple lose a lot of credibility when iCloud started raining celebrity nudes to 4chan. They care less about you specifically as a user than they do about whole classes of users who’re much more likely to be phished and social engineered than you believe yourself to be…

As mentioned previously, the last Apple product I purchased was the iPad Gen 1 (2010). However, my security consciousness changed post Snowden (2013) and I devoted time and effort to study and implement strong infosec.

This was about when I stopped using my Apple ID (so I'd estimate it's been about 8 years).

That said, bragging that you haven't changed your passwords from 15+ years ago, even if they are securely stored, makes me question how serious you take your security.

I change my passwords regularly, and it's accepted that this is best practice.

As to your comment about an attacker being able to reset my password quickly, I think I should be given the option to if I wanted, or be allowed to provide KYC like passport or driving licence to fast track it.

If I was a celebrity I might want to opt in to 'slow track' plus KYC verification.

My point is about not having the option because it's Apple's way or the highway.

> it's accepted that this is best practice

It is absolutely not, and hasn't been for several years (source; I'm on the industry panel for many security standards). Every serious security standard (NIST, DoD, GCHQ, etc) say that choosing a strong password is important, but that periodically changing it brings at best no benefit.

The overwhelming consensus in security is that using strong cryptographic secrets is the only really secure way to authenticate. Buy some kind of the tamper evident secret store and get on with your life.

If you allow people to opt-out of security, they will do so and then scream when there's a breach that they made inevitable. Look at the discussion around HSTS for as many examples of this as you please; users cannot be trusted with their own security, they will at best leverage outdated and badly wrong guidance from years ago. More often, they will choose Summer2021 as a password and 000000 as a pin.

My experience with not regularly changing passwords is that the security of your login credentials decays over time. If you keep track of when you changed your passwords you will know what time period you were compromised if you check a website like https://haveibeenpwned.com.

If not, you'll might have to trust whatever PR says about when the breach occured.

I agree that strong passwords and cryptographic storage is the way to go, but I think you go too far when you say "users cannot be trusted with their own security" because some can. I think it really depends on who your users are.

Why does the time period matter when each credential should have a unique password anyways? Is knowing time of a breach important important when the only way you’ll know is through a website like the one you linked or when your credential is used unauthorized ?

Also I personally think users absolutely cannot be trusted. At all. There should be a minimum viable security model for all users regardless of what their threat models should be. (I.e not allowing easily guessable passwords, enforcing a password over X length , forcing capitalized characters and symbols).

One other thing to keep in mind, a lot of the time users (including me) couldn't give a fuck about the security of your website/webapp/mobileapp.

If you force me to register an account to do what I need to do, and I'm never planning on returning anyway - you'll get my "default shit site password" and if you demand a deliverable email with confirmation, you'll get a throwaway-able email. I have a "spare" gmail account which I'll use with the "plus addressing" thing, so you'll likely get random-looking-string+sitename@gmail.com and the equivalent of Password123! - and I don't use that email for anything else. I'll filter mail with that +sitename to spam if/when it starts getting spam, since spammers know that trick and remove it - eventually I just throw away that gmail account and start a new one.

Occasionally that bites me in the ass. Back when this stupid new "text messaging on the web" site started, you know, the one with the best and the fail whale, I was curious and set up an account (at least as much to squat my username as anything else). A few years later and I'm actually using and socialising there, late one night my account starts sending açai berry spam. Because my shit password was shit. (Luckly, they just send a half a dozen spam tweets, and didn't p0wn the account by changing the password/email on me...)

One nice thing about password managers, at least you can search and find all the services you used a shitpassword on, and do an audit of whether you care enough to upgrade the password or delete that service's account.

> they will choose Summer2021 as a password

A few years ago when we started implementing the revision of NIST 800-63B we started checking user passwords against breach lists by hash.

In a company of just a few hundred people, two unrelated employees had chosen exactly the same compromised password. After forcing a change, we asked them what their old password was.

Summer2018! was chosen independently by two people in a smallish company who had never met.

I did an audit once where security confidently told us that there were no weak passwords given out by the helpdesk. When we actually tested hashes, we determined that there were a ton of the usual suspects. When we chatted up some helpdesk people over lunch, it turned out the problem was that they gave good passwords whenever someone from security asked because otherwise those jerks would scream at you. Everyone else in the company got easy passwords because it lowered call volumes.

They literally were checking group membership as part of their reset script and giving the user the type of password which was most likely to get them to go away.

Your case has a significant difference: trained IT staff choosing weak passwords for convenience is much worse than “normal” users independently choosing weak credentials despite yearly training.

That said, the root cause is the same: humans cannot remember computationally-secure credentials. We need something else. Pushing for “stronger passwords” is folly.

> The Fappening is case and point. These celebrities trusted Apple and completely outsourced their security only to find their privacy violated in shocking horror.

The fappening happened because people got spearphished into sending others their account passwords. That jump started the 2FA push, but there is not much a company can do if you willingly give your authentication details to someone else. If anything, the fact that apple does not allow passwords to be reset haphazardly and makes you wait 7 days means they go out of their way to prevent regular people from being victims, possibly a result of the fappening.

But their products are so blingy and fast! /s

It's a magician trick. Distract you with one hand while performing the trick with the other. Watch the dazzling performance while they further lock down your device.

> However, that experience is nothing to the cost and pain if something with the hardware goes wrong.

I have never been able to understand that. I can appreciate conviction of not using any manufacturer's products as some kind of a political statement, but this?

How often does something with your hardware goes wrong? I assume it's single-ish number of events per year, but you choose to suffer every day for the experience you deem subpar in a windows device?

Fair point. It's not just this, it's the lack of being able to upgrade. I guess I'm just old and remember when I did my first upgrade from a 14.4k modem to a 33.6k modem and how much faster it was (lol). This is why my next laptop won't be another XPS, but will be a Framework laptop.

I would have bought the Framework laptop now if it wasn't for the fact that they don't ship to the UK (yet) and there's no 15" version.

Yeah, in my youth all my PCs were built by hand from the components (due to cost reasons more than anything else).

But now I feel that this is not such an easy task anymore as components have to be carefully selected to not introduce a bottleneck somewhere by accident and I feel I just don't have the time for this.

>This anti consumer approach by Apple is why I refuse to buy anything from them.

What is anti-consumer about this? I am a consumer and active user of these products and I want this posture when it comes to the security of my devices. I don't want just anyone to be able to tamper with the hardware of my phone nor do I want anyone to be able to access my Apple ID or other info without some kind of time delay for me to take action to secure it.

I couldn't really understand comments like yours until I read a comment by saagarjha above which summed it up nicely by saying, "The conflict occurs for the parts where people do feel like they can make better decisions than Apple, but they can't because Apple won't let them."

I understand now the difference is that you're willing to trust that Apple knows best for you, whereas I trust myself to know what's best for me. I accept that you see this as pro-consumer from your point of view, but from my point of view surely you can see it's not? We just want different things.

What helped me get it was your point about security and that you'll have a different attack surface and will have made different security trade offs to me. Thanks for sharing your point of view, I appreciate it.

Yeah the problem is the “anti-consumer” hyperbole. For some people it’s just not for them, doesn’t line up with what they want from a device. I’m not sure why that needs to be anything more than preference.

I agree it's a preference... but I wouldn't go so far as to describe anti-consumer as hyperbole.

Hyperbole is making something sound more impressive than it is, and anti-consumer is not being favorable to consumers.

Some people, like myself, will find Apple approaches not being favorable... the scales of control being tipped too far to Apple than to them. That's not making it sound more impressive than it is. Apple is a behemoth of a corporation and I am orders of magnitude less powerful.

Anyhow, you do you, and I'll do me, it's a free country and if Apple products are perfect for you, c'est la vie!

But with that measure every company on this earth is anti consumer because there will always be some people who won't find their practices acceptable. Maybe you should say "anti my interests"

It's very favorable for lots of consumers who have made a different decision than you. I would go so far as to say that you are in the significant minority, and that doing what you want would be damaging and anti-consumer in the main.

To use my new favorite analogy, one should not be required to fully disassemble and evaluate their cars running gear in order to drive safely.

While your general point is understandable, it's not really that my position is that I trust that Apple knows what's best for me and, if that's what you took away, then you've misunderstood my point. My point is that Apple has engineered their device in a way that guarantees the chain of trust for the hardware components. That is a position that I understand and agree with because there's no way to compromise that position. I also understand that this makes things harder for third-party repair shops but it doesn't invalidate their ability at all so long as they're willing to jump through the hoops necessary to be in that chain of trust. I know what's best for me and what's best for me is a phone that I can trust the components. It doesn't matter to me whether that's Apple or a third-party. I'm not sure how that translates to "Apple knows what's best for me" instead of "Apple has created a device that, in principle, allows for fewer attack vectors". It wouldn't matter to me who did this. It only matters to me that there's no way to bypass this.

It would be the same as me hiring a security company to protect any other assets I have. I can either hire freelancers or I can hire a company that promises to run background checks on all its employees. That doesn't mean they know what's best for me but it does mean that I trust them to not hire someone who's been in jail for burglary.

Right, I got your point.

However, I'm not so certain Apple has engineered their devices in a way that guarantees the chain of trust for the hardware components.

I would wager major governments have the ability to carry out interdiction operations.

My threat model isn't the Five Eyes (FVEY), it's everything besides them because no one can protect themselves when the NSA flagrantly subverts the Constitution and get away with it. The FVEY work in concert to get around each other's laws so yeah, good luck stopping that.

>...in a way that guarantees the chain of trust for the hardware components

What is your evidence for, or specific concern about, this? Apple has provided a ton of documentation around their hardware security and operate a bug-bounty program as well as a security research device program. I'm struggling to find any real argument beyond "I just don't trust them" here.

Snowden documents suggest that Apple is a part of PRISM.

Super Micro (Apple uses their blades) https://www.bloomberg.com/features/2021-supermicro/

Ah yes, the big Bloomberg lie that keeps on giving. If you dig a little farther into this, you'll discover that it's mostly just Bloomberg writers circularly citing each other. They're ignoring the mountain of actual security professionals who work at the companies in question and ask for any real evidence. There is no proof, other than people trying to scare you to sell subscriptions or build their brand.

Edit: see the previous HN discussion on this travesty https://news.ycombinator.com/item?id=26149885

>the whole ecosystem upgrade treadmill

I haven't noticed that as a user of Apple phones and laptops. The 4 year old iphone SE is working fine with the latest OS. I stopped using the 2013 macbook air because it was kind of falling apart a bit, not due to any weirdness from Apple. I'm not even sure what the "ecosystem upgrade treadmill" is.

I did have the issue of the screen of the SE being harder to replace than the 5 because it has a fingerprint scanner that can access your credit cards. I can understand Apple having security standards for that. The local repair shop still does it but it's £50 with an official part rather than £20 with some Chinese knock off.

Um, what upgrade treadmill? This argument is so tiresome.

Apple's products consistently last longer and hold their value much longer than the competition. That is the exact opposite of an "upgrade treadmill". I've used various Apple devices for as long as 8 years or so, then sold them to others who kept using them.

In addition, this entire thread just blew up today:

https://appleinsider.com/articles/21/11/09/upcoming-apple-so...

Reply on news.ycombinator.com