Hacker News Reader

Comment by Terretta | Hacker News Reader

EDIT: I AM NOT COMPLAINING ABOUT THIS.

I'm responding to parent saying it's not an actual problem:

> So this whole thing seems like a non issue.

...

Apple doesn't seem able to "produce a receipt" if you purchased the MacBook with cash or a discontinued credit card in their store.

I have a lovely pristine 2019 MacBook Pro 16" that I put firmware password on before crossing international borders, before pandemic. The Ventura update broke boot. I have to boot to recovery partition, but cannot. No idea what "this is obvious" firmware pass I came up with.

THIS IS MY FAULT. But a surprisingly expensive fault…

I have the original welcome to new Mac on your Apple ID email a couple days after purchase, the Mac is active in my Find My, the Mac is under AppleCare to me which I have. Apple will not unlock it without receipt, which I do not have, and, no longer having an account with that card provider, cannot produce.

This 2019 MacBook Pro sells used for $4,689 from Apple today:

https://www.apple.com/shop/product/G14X6LL/A/refurbished-16-...

So for me, it's an issue.

// At the same time, this is a reason we provide MacBook Pros to employees: we can take comfort losing one in NYC or Mumbai probably isn't going to compromise company data. This is worth the cost to me personally, and makes me an advocate of Apple's security work.

View on HN

They ask you for an email address when you buy a high ticket price product (which, let's face it, is basically all products).

I understand you're upset, but sadly I have to say to you that this is working as intended.

1) You bought a machine and can't prove it.

2) You enabled authentication which you lost

3) You also lost your backup to the account

How can they help you? How can anyone help you?

You've made it nearly impossible to distinguish yourself from a thief or random stranger.

I'm not upset.

I can prove it to a remarkable degree with the welcome email 3 days after this model was launched.

I didn't lose backup to account. I'd already migrated to the latest M1 MacBook, and my account is fine.

There's appears to me to be no backup to the firmware lock, there is a backup to FileVault, I have file vault.

I get it and am not complaining. But person above me said it wasn't a real problem.

My point is, it can be a $4500 problem for a legitimate purchaser.

Can you sell it to a friend, give him a legitimate receipt (from you) and have him go to Apple? (seems like a hack, but it checks the ownership box for your friend)

This is a good advice to try. Ask someone to buy it from your eBay list. Using that receipt ask Apple to unlock the laptop.

It would seem nearly bonkers that this would work though.

Maybe try and take Apple to small claims court for not honoring the warranty?

Activation Lock creates undue friction during the ownership transfer.

This kind of security should be tied to something like removable storage device where the users data is stored, not the main device itself. That way when the owner dies or loses acess then said owner only loses acess to the data and not the entire device.

IMHO this is Apple trying to force people to purchase new devices and prevent reuse. It doesn't matter what is intended on the surface, but what the actual outcome is. This causes more waste and it's not helpful to the environment. If you are serious about protecting user data tie it to hardware security that can be decoupled from the device itself.

I'm in the business of repairing computers.Apple is setting bad precedence on multiple fronts, More than any other company in existence.

I’d rather not make my belongings such valuable targets for theft

That defeats the entire purpose of the feature. I want my computer to be unusable if stolen.

It's my understanding that the purpose is to protect data. It has a secondary effect of preventing use of the device. The goal of reuse and preventing device use are incompatible.

Activation Lock started on iPhones and the purpose was to discourage theft, as people were having them ripped out of their hands and then sold on.

Everyone supports the concept of reuse.

But most of us don't want to extend the courtesy to petty criminals.

I think this is shortsighted. Criminals might be the target of this policy today, but when these machines are no longer current, the owners of the machines might no longer know or care where the device is, and they will still be unusable. This to me is unacceptable.

As long as the owner can still log in to their iCloud account they can deregister their device. This is a non-issue.

I think its wrong to be dismissive of how inacessible this could become if apple is no longer a company

For almost any other company, I think this would be a reasonable concern.

Given Apple's staggering pile of cash, I think that we'll have decades of warning if they're going to stop existing.

This is really an issue of control. A company that designs and sells computers, which creates a conflict of interest, should not be in the business of controlling access to a computer. That should be handled by the customer. Otherwise they will use the market position to dictate how that control is used. It's a lose across the board, you are not thinking long term.

So how many thefts, home break-ins, violent assaults etc should we tolerate so that in decades to come the devices can still be usable.

Even though at any point said device can be unlocked, transferred, sold etc.

No, it’s even in the name of the feature. Activation Lock.

It is to stop devices being stolen, wiped and re-sold. It is an attempt to allow the legal owner of the device the ability to control who can use it, rather than the possessor of the device having full control who can use it.

Its only purpose is to protect the use of the device by people removing all the software (erasing back to factory defaults) and taking control of the physical device that way.

Activation lock is not the same thing as file system encryption.

> IMHO this is Apple trying to force people to purchase new devices and prevent reuse.

Assuming you know your Apple ID password, disabling Activation Lock takes less than 30 seconds. You can even do it remotely via Find My on the web.

It hasn't exactly curtailed the legitimate iPhone resale market in the ~seven years that it's been on by default, either, though it did produce a dramatic drop in people getting their phone snatched from their pocket[1].

1. https://techcrunch.com/2015/02/11/apples-activation-lock-lea...

Removing it from FindMy definitely doesn't solve firmware.

Just an idea, but, I remember something about T2 macs, and the find my integration and if you put the device into “lost mode” on the web, it sets a (numeric) firmware password as part of the ‘mark as lost’ process.

I think that overrides any user set firmware password, so might allow you to recover it,

Just a thought maybe a little searching can validate it before you might try?

I wouldn’t expect it to, since Activation Lock is tied to an Apple ID and the firmware password is local.

The number of people who manually set firmware passwords on their Mac (i.e. don’t have it set as the result of MDM) instead of just using FileVault these days must be vanishingly small.

> How can they help you? How can anyone help you?

Well, that's the fundamental problem. With open hardware that you fully and completely own when you buy it, such problems are impossible.

The move towards hardware (mostly by Apple but not unique to them) that remains firmly in control of the vendor even after you buy it... is not a good one. It means your ownership is relatively ephemeral, any wrong move (or bug) and it's no longer yours to use.

Not a world I want to live in.

> Well, that's the fundamental problem.

A better problem, some may say, than having a thriving market for stolen laptops.

> Not a world I want to live in.

But a world many may prefer to the world with a thriving market for stolen laptops.

> A better problem, some may say, than having a thriving market for stolen laptops.

Some may say that, because having their laptop stolen is a problem they actually experienced. Having your device remain owned by a vendor, who only "licenses" it for you to use opens up a whole new world of problems, some of which average person can't even imagine.

Isn’t that quite a slippery slope to call it licensing?

> Having your device remain owned by a vendor, who only "licenses" it for you to use opens up a whole new world of problems, some of which average person can't even imagine.

Actually, everyone experiences this right now. Macbooks are working like this. And 99% of people are fine with it. We don't have to imagine anything

> Actually, everyone experiences this right now.

That's not true. I think you're saying that Mac users are already today in an ecosystem where this could bite them hard, that much is true. But nobody gives it any thought until they personally find their multi-thousand dollar device useless and Apple refuses to help even though they totally could if they cared. Only then do they realize what a terrible situation it is.

And yet “average” people buy and sell MacBooks every day without imagining, let alone experiencing those problems.

It is only thieves and ideologues who actually experience any difficulty. And while I’m all for righteous purity, I am also happy knowing that the thief who stole my MacBook from Spaces coworking in San Jose (do not ever use Spaces!) will get nothing for the risk they took, and/or that a buyer taking a too good to be true deal will get a brick.

Yes, I like this world better than the free-open-insecure alternative.

> And while I’m all for righteous purity, I am also happy knowing that the thief who stole my MacBook from Spaces coworking in San Jose (do not ever use Spaces!) will get nothing for the risk they took, and/or that a buyer taking a too good to be true deal will get a brick.

That might be a minor consolation, but the bigger point is that this will (hopefully) significantly disrupt the market for shady used MacBook sales and thus the incentive to target MacBooks for theft.

There is n=1 up there that someone is not stealing his laptop. He just forgot his firmware password. His Find My account still showing the device, but Apple doesn’t want to unlock it because he lost his receipt.

It's unfortunate, for sure, but the warnings are abundant; in not so many words don't forget these passwords or the consequences will be dire. Losing receipts for big ticket items is, I'm afraid to say, irresponsible. File the hard copy, or scan and save in multiple secure locations. The burden of proof of ownership is on the owner, it cannot be any other way. Heck, I'm sure a credit card receipt would do. Find it on a bank statement and go to small claims in the worst case.

Sure. And that sucks. But do is it worth incentivizing the theft of n = many laptops?

This is the government encryption backdoor all over again. There is no such thing as a security backdoor that can be used only by good guys. If Apple can’t determine someone is the legitimate owner of a locked device, they have two choices: allow thieves to unlock devices, resulting in more theft. Or decline to unlock for some legitimate owners who chose to lock their device and not take precautions.

It’s a tough choice, but I think Apple is making the right one here. You may disagree, and that’s fine.

Ok, so what is the metric Apple should use for deciding whether someone has lost their password or someone has stolen a laptop?

Or should Apple just remove the activation lock feature, that was added specifically in response to large amounts of theft because we don’t think those thefts are going to happen any more?

If you own a car and by some bizarre sequence of events all evidence that you own it has vanished, and then you lock yourself out, you might have a hard time getting a locksmith to unlock it for you. Police might even get upset if they see you trying to break into it! This doesn't seem very relevant to whether or not you "own" the car or "only license it." Granted, there is probably some "last resort" where you go to a judge or something, but I bet if you got an order from a judge for Apple to unlock your laptop they would do it!

In my experience, and FWIW, locksmiths do not bother asking for ID when defeating the lock on your car or house.

I had to present ID when a locksmith drilled my lock in Sweden.

He took down the details of it.

While unfortunate for any affected individuals, still IMHO a much smaller problem than a few companies have basically full control over all computers people use.

That's much more dangerous for the society than a few thieves making a buck.

Are you not free to simply not use find my/activation lock?

I haven’t used Asahi yet but the way I understand it you can install Asahi right away and the hardware is forever yours to control.

And if you are worried about Apple one day remotely adding a lock to your Asahi laptop you can probably block those requests proactively on a network level anyways

I tend to agree, but that's not really one of the options on the table for this particular discussion.

The main corrolarry is your user account.

One could convincingly argue that dead accounts are e-waste.

The main reason I guess we don't say that is because we have expiration policies.

But if you lose access to your, say, facebook account with 100GiB of uploaded content, then that content is going to be sitting consuming at least 300GiB of media (replication, backups etc;).

Thus: is that a problem?

I see a device like this as an extension of my self, having it "open for all" is not desirable; I want to knowingly give it to someone.

If someone takes it, or I do not unlock it, then I don't want the possibility for it to unlock. I paid for it, it's mine, in perpetuity until I say otherwise, even if I'm dead: since as I mentioned it's an extension of me... it is dead too.

> I paid for it, it's mine

Funny misconception, that. You paid for it, but Apple controls it. You trust Apple to do the right thing, but you cannot prove that they do. You cannot hold them accountable for doing the right thing, either.

So, how can you trust it as an extension of your self? I understand your argument, but you've based it on a misconception if you think you're the ultimate user with the greatest authority over your device. Apple makes the rules, the only thing you do as a user is agree to play by them.

No, the great thing is that even apple can’t do everything with your device! If it’s encrypted they (presumably) can’t access that data at all.

Unlocking a device by apple has no bad incentives associated, at the very worst case someone else can use your owned device without access to any of your data, aka stealing. And that assumes that apple will corruptly open it for someone else which they have zero interest in and that just accounts for regular old stealing with a billion dollar company’s help?

you really think apple doesnt have a way to completely wipe your device without your permission?

> If it’s encrypted they (presumably) can’t access that data at all.

We just have to trust their implementation, which is conveniently proprietary and unaccountable.

> And that assumes that apple will corruptly open it for someone else which they have zero interest in

Are you sure about that? They very publicly gave the Chinese government control over Chinese iCloud data a few years ago. That, and they've been part of PRISM for the better half of a decade now. When a company has a working relationship with multiple sovereign governments, I'm not sure you can strongman the "Apple will save us" argument.

This is also a problem with Google, Microsoft, Amazon, 95% of cell carriers, most cable companies and your laptop manufacturer (regardless of company). Apple knows you feel insecure about this, so they market their products/services to you with this in mind. News flash: does anyone really think the largest company in America (let alone the world) isn't in kahoots with the American government? Microsoft was. Google was. IBM was. And Apple is bigger than them all.

Encryption is great. Mixing it with snake oil isn't. People are correct to call out Apple's failures to protect their users in this conversation, because their track record isn't very benevolent.

> We just have to trust their implementation, which is conveniently proprietary and unaccountable.

I also have to trust Debian, as I can’t audit millions of lines of code.

You really have no choice but to trust your OS vendor. If you don’t, find another vendor.

That's where the transparency part comes in. Nobody reads every line of code, but feasibly anyone could read any part of it. Patches are examined as they roll in. Really the software distribution model is no different than trusting your apps to auto-update properly.

Apple doesn't have accountability. It's not that nobody wants to prove them right, it's that their system has been deliberately designed so that no one can.

Does it really matter that you can read any line if you can’t verify whether the binary you download is truly made from said sources? There is always some trust at some level, whether it is some debian server or apple is just another question.

It only bothers me when the publisher-in-question is a cardholding member of PRISM, without two cents of developer goodwill to their name. I'm normally more generous with small-timers, but try to stick to OSS all the same.

At the same time, it hardly disincentivizes thief from laying their hands on apple devices. With that in mind I’m not sure whether this is not a worthy tradeoff.

As noted in the article, this is more-or-less an issue with corporate/biz MDM solutions.

A corporation buying hardware from another corporation. The “user” here is and was never in control of the hardware. The only human beings close to that role are the IT department.

Like it or not there are legitimate reasons corps do this. HIPAA, SOC, PCI, good old fashioned responsibility, etc. Apple isn’t the only vendor that sells systems and hardware locked in this fashion.

The reason we’re talking about this and not anyone else:

1) Apple is one of the world’a most valuable companies.

2) There is a tiny but very loud minority of people who have a seething, irrational hatred of them and cannot ever acknowledge anything positive about them.

3) Their solution for this is actually implemented well and can’t be bypassed.

I understand your point but we’ve gotten here for valid reasons - “XYZ employee gets laptop with 100m SSNs stolen”, etc.

Speaking more broadly, you are aware that with Apple Silicon they had a massive opportunity to do as you say and “own” user hardware, right? It would have been trivial for them to utilize all of this to prevent alternate OS installation. Even if they did lock out alternate OS installation they’d lose what, 0.5% of sales from the people ranting about Apple on HN that were never really going to buy Apple anyway?

Yet here we are with Asahi Linux.

> I understand your point but we’ve gotten here for valid reasons - “XYZ employee gets laptop with 100m SSNs stolen”, etc.

That's not the reason you're prevented from resetting the laptop.

> With open hardware that you fully and completely own when you buy it, such problems are impossible.

I don't see why, in principle, you couldn't have open hardware that provided the same capability to brick the device for unauthorised users. In which case you would be just as SOL if you forgot the credentials to that, too.

> With open hardware that you fully and completely own when you buy it

Unless you lose the password to unlock the BIOS.

Which is not resettable via the (now very old) method of removing the CMOS battery or shorting a jumper on the motherboard for at least a decade.

(I had this issue on a HP Elitebook 8440p from 2011)

> With open hardware that you fully and completely own when you buy it, such problems are impossible.

I don’t understand. If you have open hardware that you have full control over, choose to lock it down to make it impossible to factory reset the device without a password, and then forget that password, how does having open hardware help?

If you say “there always should be a way to factory reset the device without a password” you are giving up a feature that Apple provides: making it less worthwhile to steal Apple devices.

Open hardware doesn’t change this at all.

Either you have an activation lock like feature or you do not.

If your hardware has a path that allows a random person to circumvent it, then by definition it does not have an activation lock.

This isn’t an open vs closed hardware question. This “does this feature exist”, and your argument is that it should not. This is spite of the fact that activation lock was a feature introduced specifically in response to high rates of theft, and its introduction immediately reducing that theft.

Activation lock is a feature that people want, but again activation lock is either there or it is not. If your “open” hardware includes a mechanism that bypasses an ownership lock then by definition the lock is not a functional if feature.

A company can make an open laptop that has an activation system that requires an authentication in or to do a full device reset, or to replace the firmware. But if that lock is in place, it can’t let you flash a new firmware on or reset it, because again that defeats the purpose.

> How can they help you? How can anyone help you?

They literally can, but are choosing not to. If there is concern about stolen devices, then there could be a way for victims of theft to submit such information to apple and then when someone wants to purchase a used laptop they could check whether it's stolen. They could also provide a mechanism by which a laptop could be submitted for unlocking and sits in the request queue for three months pending someone saying "that's mine!"

At the end of the day it's bullshit that functional laptops are going into the trash stream for artificial reasons. There should be a tax of 10x the highest global retail price of the device assessed against the manufacturer.

Why that the device is listed in his My Find account not a proof of the ownership?

My folks also bought a Mac from an Apple Store with an active credit card. When the laptop was stolen and recovered by the police, it had some kind of boot lock on it.

They refused acknowledgement of the credit card because they say it could’ve been stolen and they refused state ID as it could’ve been stolen or forged. They refused acknowledgement of documentation from the police. They said it was my folks fault for putting the boot lock on as it warns you, but my folks weren’t the ones who did that. I didn’t even know that boot lock existed until then. This experience was in the same original Apple store my folks purchased the computer, which is why I presumed state ID and original credit card would’ve been adequate.

Unfortunately my folks had made themselves indistinguishable from foreign intelligence. The amusing thing is that if they're so worried about forged government ID's and stolen credit cards, then how on earth can they trust a receipt? Unlike a government ID, your face isn't on it.

You can probably get your old card issuer to pull up your statement. I’ve done similar stuff in the past with closed brokerage accounts. It may be an involved process and take a while to reach the right person but worth a try at least!

How are they supposed to produce the receipt? You’re supposed to have it. They gave it to your hand or send it to you over email.

Are you suggesting their system did not record the sale? I agree that OP should have the receipt but I'm quite sure Apple has the data for that sale somewhere.

I am suggesting that if I bring a laptop and ask them to produce a receipt of its purchase it’d not prove that I purchased the laptop. Anyone could do it and then use that receipt to say they bought it in the first place.

OP bought it with a credit card, I'd be surprised if there was no record of any name, address or ZIP code attached to the purchase.

Indeed. The receipt should serve as proof of purchase from the purchaser to the vendor. I'm sure Apple does have proof on their side, likely even tied to the serial number, credit card, Apple ID, etc., but going to an Apple Store and asking them to verify your identity and connect the dots... that's probably out of scope for their everyday support. OP would need to work with a higher tier of support to reestablish ownership and receipt, which maybe isn't unreasonable to do.

This is probably right.

Apple business has told me no guarantees but as a company owner I could possibly get an exception through our company's Enterprise Support, which, as a user of that service, I have observed being more empowered than the consumer channel.

Whether that might work or not, it's likely not available to casual purchasers.

Exactly. And most likely in a DB column directly connected to the serial number.

In this case it seems like Apple has more than enough information to verify that Terretta is the valid owner of this computer, and so they should unlock it. Whether this goes via "reissue the receipt, then unlock it" or just "unlock it" isn't important.

I agree on that point, but not on the one where Apple should give him the original proof of purchase.

Apple knows the time and place of each product (SN) they sell, and they know who activated it to their account. They should certainly be technically able to produce the receipt at the time of sale but also a duplicate later.

> Apple doesn't seem able to "produce a receipt" if you purchased the MacBook with cash or a discontinued credit card in their store.

I'm not sure if this is standard policy or a fluke. If true then Apple should absolutely not demand that proof of purchase back from the owner at any point. I can't imagine how it's legal to sell that in a store and not provide proof of purchase but that's a different matter.

> They should certainly be technically able to produce the receipt at the time of sale but also a duplicate later.

For privacy reasons, they might not legally be allowed to keep purchase history around forever.

I don't read the parent as wanting support going back indefinitely; 2019 to 2023 is well within when the company should have sale records. You generally need to keep them for at least seven years from when you file taxes, which might be more like eight years from the sale: https://www.nolo.com/legal-encyclopedia/how-long-should-you-...

The IRS recommends keeping records for 7 years. That's long enough.

The paper receipt most likely doesn't have any information (his name, email, etc) that identifies him as the actual person that was in the store that day and made the purchase. He said he purchased with cash or a card he doesn't have anymore.

Surely you can see how just handing out a generic receipt to whomever shows up and asks for it is a real issue.

Lesson here is, for ANY merchant: pay with a credit card, have the receipt emailed to you if possible. If not take a picture with your cell phone of the receipt, _on the spot_. That's it, you are future proofed.

I can't stop laughing at the shit apple users justify and put themselves through. You should be able to wipe everything clean and reinstall the OS without the need of any fancy firmware nonsense. But apple convinced their mac users that that's ancient tech and they need firmware passwords now( lol).

This is a silly idea but wanted to throw it out there anyway: What if you listed the laptop for sale on eBay, then bought it back using a friend or another account? Could that be used as "proof of sale" for Apple to unlock it?

This is brilliant. Hopefully it's not that easy. Worth the ebay fee to try!

looking forward to your blog post with the story up on HN :)

Isn’t listing stolen laptops on eBay the exact thing purported to be the problem?

If thieves can just list on eBay and tell user to take the receipt to Apple…

Pretty sure they wouldn't let you walk out of a store without issuing a receipt regardless of mode of payment used

You linked to an M1 model, but apple did not make these in 2019.

You're right. Wrong link.

Damn. Are you going to continue being an Apple customer?

Yes. Since this was refused, I've bought two new iPad Pros, two new MacBook Airs, a MacBook M1 Pro, and now the new M2 Pro, from the same store.

I like that I can't get into it. It gives me comfort employee machines with company IP cannot be readily compromised.

What happened to you really sucks and I am sure you took away a lesson or two from it. But you have a really good point... "if it didn't work for me then I'm sure it won't work for an actual criminal" it's a good point.

In a way, you pen-tested Apple's anti-fraud processes... although at your own expense ;)

OT, but I find this fascinating: did you buy all of those computers for yourself? If so, why do you need to upgrade them so frequently?

This amounts to not owning the device in my book.

How so? The owner set a password that they cannot remember.

The vendor can reset it, but wouldn't, and can block the device at will (say if reported stolen with a receipt).

Reply on news.ycombinator.com