Comment by ChuckNorris89 | Hacker News Reader

Comment by ChuckNorris89 | Hacker News Reader

>Apple has completely redesigned the internals of the iPhone 14 to make it easier to repair HN: <crickets>

Easier for who? Quote from the video:

"We're hearing reports of Apple continuing on the hostile path of pairing parts to the phone, requiring activation of the back glass after installation. Why in the world would you need permission to install a sheet of glass?! Using software to prevent the replacement of components with aftermarket parts gets a big thumbs-dwon from us."

Let's call it like it is. Apple is not doing you a favor for easier repairability, they're doing their bottom line a favor. If they actually cared, they wouldn't be so hostile to software lock you out of replacing a bloody glass panel.

The internal design is still greatly thought out though. I've been asking myself for years: why can't phone makers make phones with a mid frame that allow both sides to be easily swapped out, instead of one or another. Seems like Apple has cracked it. I hope other phone makers copy this minus the SW locks.

Apple’s Activation Lock lead to a substantial drop in smartphone theft worldwide. That’s something worthy of consideration. Apple must not re-incentivize phone theft to harvest parts.

https://techcrunch.com/2015/02/11/apples-activation-lock-lea...

This is a really good point. Thanks for sharing. I'm highly critical of Apple for their practices, but this is great food for thought. I'm gonna have to marinade that for a bit and re-evaluate my position.

Could they still do it for Apple official parts without locking out 3rd parties? i.e. if an official screen that was previously registered to a different phone, then lock it out. If it's never been registered, then allow it?

But what if I want to transplant a part from my old phone to a phone same model that I both legitimately own? Why should Apple be the one to stop me? Why not let the user enable/disable the SW lock, like a lo-jack?

Do you live in an area where phone theft is rampant? Ok, then leave SW lock enabled on your phone's parts.

Do you want to legitimately transplant parts off your old phone to your new phone? Then let the user disable the SW lock after entering their PIN or Face-ID or whatever.

It's not like this is some super-complex problem Apple couldn't solve with a few line of code to have the best of bot worlds if they really wanted to.

Exactly, it's such an easy problem to solve if you're actually interested in solving it which makes it quite obvious that Apple isn't.

I got mugged a couple years ago, or attempted to: The thief asked for my phone, saw it was an iPhone and just gave it back.

That to me is worth the whole phone bricking thing. And it's also not like I've gone through a bunch of them, I got a 6S on release and a 12 pro when I felt it couldn't play video games anymore.

For ~$90 I can buy a screen programmer online to transfer serial numbers between screens and bypass the locking thing. If I buy a phone with a broken screen online for cheap, I can put your good one on it (by writing the serial number from the cracked screen onto the stolen screen) and then resell it as a fully functional refurbished/used iPhone for a decent profit.

...and if I'm too lazy to do that, I can still sell it for parts online since less lazy people who know how to do that will buy it for the same reason.

It also considerably reduces the ability of nation-state attackers to replace parts with modified hardware without your knowledge, as Apple can detect and terminate misuse of the tool that creates new cryptographic signing keys for the pairing of phone and part. We saw signed-pairing appear with the Touch ID system in response to Apple learning of nation-state attacks on the iPhone that used hardware modifications.

To date, no HN discussion of this crypto-pairing of the phone to its parts has revealed an alternative solution that would be effective at Apple’s scale for preventing phones from being hacked by a parts swap while also allowing any part to be swapped in — not to mention while providing the anti-theft benefits described upthread. I’d love to see a viable alternative solution described, if anyone has one.

> To date, no HN discussion of this crypto-pairing of the phone to its parts has revealed an alternative solution that would be effective at Apple’s scale for preventing phones from being hacked by a parts swap while also allowing any part to be swapped in

Random-ass repair shops are not going to expend the effort of putting in fake parts to hack you to.. hack a couple of thousand dollars off of your account and then get caught due to it easily being traceable to the repair shop?

The only people who need protection from hardware-swap hacks are people like journalists. And if you are one, you shouldn’t be giving people physical access to your device regardless.

Here is a simple solution: give the normal user (after a passcode unlock) a pop-up: ‘your X has been replaced. Do you wish to authorize this new part for use with your iPhone?’.

Make it so that if your phone is set to the new Lockdown mode, you cannot authorize any new parts.

Anyone crossing a border where a nation state takes physical possession of their device is, currently, protected. The US border authorities have a very awful policy of storing data they’ve stolen for up to 15 years, and other US federal authorities have been previously caught using hardware modifications to hack devices. Anyone within 100 miles of a US border is subject to seizure and search under US law, which is approximately one-fifth of the country, including SF tech workers and NYC fintech workers.

These protections apply to considerably more of one country’s populace than would benefit from off-market parts being usable at third-party repair shops. I appreciate Apple’s choice to prioritize in this regard, but I’d still like to see if tech can overcome this barrier without sacrificing that safety.

> Anyone crossing a border where a nation state takes physical possession of their device is, currently, protected.

Assuming you are a normal person, you already are. Rapidly click the lock button 5 times and they cannot extract any data with normal means. If you are someone worthy of nation-state attention, why are you crossing the border without a wiped device, as has been the adviced standard practice for years?

Again: these draconian repair protections should be tied to Lockdown mode. There is no reason to destroy repairability to protect a tiny group that isn’t giving their device out for repairs anyway if they’re following opsec.

I have no faith in the ability of nation-states to accurately determine that I am not a criminal, and the authorities in my home nation-state are known around the world for both their excessive violence and their unannounced home invasions, in which (for example) scenario reaching for my phone would result in me being killed. Those protections benefit me and others like me especially, and I’m comfortable paying a few more dollars for authorized repairs to retain them. I appreciate that you do not see the need for those protections for yourself, but the convenience you seek comes at the cost of the safety it provides others. I remain unpersuaded.

> I have no faith in the ability of nation-states to accurately determine that I am not a criminal

No state will burn extremely expensive tools like Pegasus on a garden-variety criminal.

I’m very conscious of my privacy and device security myself, but I’m also aware that I do not warrant high-cost surveillance. Most people are in that boat. You can model your threats accordingly.

The "your X has been replaced" pop-up doesn't handle the situation where an attacker knows your passcode.

I think you might also be failing to account for situations where you aren't in possession of your phone for an hour or two. Imagine if police in a foreign country take your phone for a couple of hours and then give it back to you. Or you leave your phone in a hotel room to charge for a few hours. Or your phone gets "misplaced" for an hour after going through the airport x-ray machine.

There are many targets other than journalists too, such as people in the USA who develop export controlled technologies, certain tech company employees, defense contractor employees, other government employees, etc. I don't think you can expect every potential target to constantly set their iphone to lockdown mode.

> The "your X has been replaced" pop-up doesn't handle the situation where an attacker knows your passcode.

If this is the case, they can add their own fingerprint or face (alternate look feature) to your iPhone. You’re thoroughly pwned at that point, no hardware swaps necessary.

> I think you might also be failing to account for situations where you aren't in possession of your phone for an hour or two

If I came back to my unattended phone after 2 hours and it was giving me a pop-up about a swapped part, I would never trust that phone again.

> I don't think you can expect every potential target to constantly set their iphone to lockdown mode.

If they are that much of an attractive target, their organizations would be stupid not to enforce it. I know that Lockheed used to give personnel that was China-bound a throwaway laptop and would shred it the moment they returned to the USA.

>You’re thoroughly pwned at that point, no hardware swaps necessary.

Exactly. It boggles my mind the amount of mental gymnastics Apple apologetics will go through to try to justify Apple's anti-consumer anti-repair practices of software locking replacement parts.

Activation lock is effectively a remote kill switch, which have nothing to do with the topic at hand.

Sort of. You can still buy replacement parts from Apple as part of the repair program. This would, in theory, make repairing the iPhone 14 a lot easier than it has been in the past.

No, this still doesn't mean you can go get the cheapest replacement option you can on Alibaba but the repair is STILL easier, even if you still have to buy from Apple. For certain replacement parts I can see this being important, like anything involved in Face ID or Touch ID.

Credit where credit is due, let's hope it continues in the right direction.

>For certain replacement parts I can see this being important, like anything involved in Face ID or Touch ID.

Those are secure elements. The back glass is not a secure element. That's just vendor lock-in malice for the sake of profiteering.

Edit: Since I can reply to your comments below, your argument fails flat because:

1) SW lock-outs also apply to genuine apple parts, not just aftermarket ones

2) If the user's ability to verify the originality of the parts installed in their phone was the real reason, they Apple could just have a prompt for the user that the new part is not genuine instead of completely locking it out.

There's a charitable interpretation. Customers can now verify that the replacements are genuine Apple parts.

I wasn't arguing that the back glass was a secure element. I said it makes sense for certain replacement parts and then gave examples of those surrounding Face ID and Touch ID.

I would agree with you that the back glass is not one of those things. But as another person said, it is nice to know that they're official Apple products as that does matter to some people.

> why can't phone makers make phones with a mid frame that allow both sides to be easily swapped out,

Midframe based based construction was standard for most premium smartphones 2010-2015, after that two piece construction, and "bathtub" took over for economic reasons, and because of MBA people wanting to parrot Apple's engineering in everything.

Reply on news.ycombinator.com