Hacker News Reader

Comment by BiteCode_dev | Hacker News Reader

PRISM didn't kill companies, Apple home button scandal didn't touch it, sony infecting its users with a rootkit didn't make it sell less playstations, HP lying cartridges had no impact on its long term business...

Fines and green washing are budgeted and only a small fractions of the profit they make by misbehaving.

On this very site you can read regularly people telling you we should forget about the MS of the past because now they are good guys. So they can get away with corruption, sabotage, monopoly abuse, insulting the competition, stealing, lying, patent trolling, etc. No problem. Bill Gates is a wonderful person and a great philanthropist nowadays.

The corporations and billionaires have found the recipe to get away with everything. The humans were always hackable.

View on HN

Not so sure about HP. I mean yeah, their inkjet ploy still pays for itself I suppose, but at this point I consider home photo printing as basically dead, killed by greed, and those printer divisions as little more than autonomous external marketing divisions for those ubiquitous b/w Brother boxes.

I can see the other things but "Apple home button scandal" either does not belong in the same league or there might be something I do not know about. Can you expand a little bit on your thinking?

When Apple introduced a fingerprint unlock in the home button, it wanted to keep the fingerprint scans secure. The security chip that stores the fingerprint scans needs to verify that the home button's fingerprint scanner is trustworthy, to prevent man in the middle attacks.

However, when an unauthorized or unofficial button is used as a replacement for repair, the phone will permanently brick itself. No warning is given that the fingerprint scanner's trustworthiness can not be verified, no ability to just use the phone with the fingerprint scanner disabled. Just straight to a permanent bricking.

IMO it wasn’t nearly as egregious as the other examples. I only defend them because they didn’t do this when you replaced the screen etc.

You don’t want phones to work if someone swaps out that specific piece of hardware without your knowledge. Bricking the phone forever makes it harder for people to find back doors around that security feature as they would risk large numbers of expensive phones. Presumably people developing replacement fingerprint readers would notice the issue before most customers where harmed. Further, anyone actually harmed would have gotten hardware from an very untrustworthy source.

They reversed course after a backlash, but I can see an argument for them standing their ground on this one.

As a user, that’s what I’d want it to do. If someone is trying to bypass the fingerprint sensor by replacing it because they know that’s where the authorization is stored, that’s exactly what I’d want the phone to do.

You want your whole phone bricked by an update when it worked before, even though they can just disable the fingerprint scanner instead?

Not just bricked but permanently and securely wiped, would be my preference.

You want your own phone that you paid money for wiped and bricked remotely at random without your permission while you’re using it for no security advantage whatsoever (since it can just fall back to PIN authentication which is actually more secure than a fingerprint) until you give Apple money to “repair” it?

You are assuming it is fine to swap authentification hardware for incompatible parts? I guess this is from the spirit of "right t repair". While I get the idea in princple, I still think going dark is the best option you have if essential hardware was apparently tampered with. Find a back-alley smartphone shop which at least swaps your FP reader with compatible hardware. But if someone gained access to my phone, and put a piece of hardware in which is not recognized by the OS, I want it to stop right there. That doesn't feel like bricking, more like a security feature.

This attack scenario doesn't make any sense. If your phone is out of your sight and unsecured for long enough to take it apart and replace the fingerprint sensor, it's unsecured and out of sight long enough to be entirely replaced by a clone that will steal all your credentials and send everything to whatever bad guy you are imagining

And it won’t work anyway because the phone will detect and reject the sensor and just fall back to PIN authentication which is how it worked before the update

Ah, I see the use case now-where you get it replaced by a 3rd party or buy a stolen phone, do you want it bricked by a software update? I don't know. I don't know that I care much about that use case TBH.

What I don't want is this: someone steals my phone and then replaces the fingerprint sensor and has access to everything, including the ability to reset and resell the phone.

That’s not possible anyway because the phone can detect and reject the replacement sensor. If it couldn’t then how would it know to brick itself? Instead it should just fall back to PIN authentication, which is actually more secure and how it worked before the update

Nice how some people try to justify Apple here.

I think the problem lies in this point:

>No warning is given ... Just straight to a permanent bricking.

There should have been a warning, at least, but there was none.

The fingerprint scanner is just a scanner, it doesn't handle authorization, that's what the security chip does. The scanner has two ways of communicating with the security chip. It can authenticate itself with the chip, and it can send the chip images of fingerprints.

If a compromised scanner fails to authenticate, then the security chip can just ignore the scanner. Not much it can do if its only avenue of communication is cut off. A warning message telling users to not touch their compromised fingerprint scanner would have been sufficient.

The the home button scandal I'm talking about is older than that.

Circa 2010-15, the iphone home button was having more and more problem: https://osxdaily.com/2011/12/22/iphone-home-button-not-worki...

For a while, half the users were just using a software button as a workaround: https://osxdaily.com/2012/07/02/broken-iphone-home-button-as...

It was funny to see everyone with a very expensive phone just moving around this fake button everywhere on their screen because their physical button was not working.

But then people stopped finding it funny.

Because Apple said it was a hardware problem, and said the fix was to buy the next iphone generation.

However, a few weeks later, jailbreak iphone received a patch from the community fixing the home button problem, showing not only that it was a software issue that was easy to fix, but Apple just conned their entire customer base.

I guess part of the problem with boycotts is that it's very hard to know who will not buy your product because of e.g DRM, and who won't buy it because they're not interested in it.

I haven't bought a single Sony product since the rootkit fiasco, but I've never been able to tell them this directly. I don't buy products with DRM in them. I just don't. I'm not going to be appearing in the balance sheet, however, and won't appear in the calculus of lost growth for an MBA.

The only time I think boycotts do work is when they cause a direct negative action to a company's bottom line that is sufficiently obvious that an accountant can see it. Long, slow protests -- such as exist against Nestlé for example -- are worthy but likely for the birds.

Oh they have an entire department dedicated to understand what people think about each product, so they would know.

Market research departments notwithstanding, companies can be quite oblivious about why their products are bought and, especially, not bought.

Well said, I couldn't agree more, unfortunately... I also noticed the "MS is cool now"-cult, felt surreal and almost like deliberate misinformation. Classic counterpart to FUD, Honeypotting. However, more people seem to fall for that because it is less known, and games the "assume good intentions"-virus.

ony infecting its users with a rootkit didn't make it sell less playstations

They sold atleast one less PS3. I caved and let my kid get a 4 and 5 when they came out. But he's gotta keep them at his mother's house.

Reply on news.ycombinator.com