Hacker News Reader

Comment by toxik | Hacker News Reader

While anti-consumerist practices such as this authentication mechanism sometimes accidentally protect the consumer, it is not the reason why companies do it. If it were, they would also allow you to say “yes this replacement is desired.” Similarly, if it was about security and preventing backdoored parts, they could allow you to authorize the replacement.

But no, it is of course about money grabbing, and then the consumer is the opponent.

View on HN

Such an ignore button would allow theft to continue and would allow users to make poor security decisions. I agree that something needs to happen to enable easier or maybe more privacy focused 3rd party repairs but I also appreciate my device being less of a target.

What? How is someone who snatched your phone out of your hand and ran away going to know your password and authentication information needed to authorize a parts replacement?

They're going to snatch your phone, break it up into parts, and install those into other people's phones, and those people will happily approve the new part.

approve them on your behalf? theyd still be paired to your device

My comment is in response to your “yes this replacement is desired.” button in a world where parts can be harvested from a phone and used in a different one. My understanding of what you mean is if phone A were stolen and parts removed from it and installed in phone B then phone B would get the “yes this replacement is desired.” button instead of whatever is in place now. My feeling is this button would be no different from just not having a button at all. The user of phone B will almost never care what that prompt says and will just click through, they're certainly not going to consider the parts were stolen from phone A.

Change "replacement" to "removal" and it should work as intended. I haven't authorized my stolen phone's parts to be removed so they can't be installed in any other phone.

But if the phone doesn't turn on you can't authorize the removal. And if it turns on but a factory reset is enough to let you authorize the removal, you're back to square 1. Either way it's not feasible.

It's a better solution than always rejecting it, at least

the phone is likely linked to an apple account. seems reasonable that if the components are approved for a specific phone and that phone is linked to an icloud account, that account could permit a swap?

That assumes that you managed to ask the previous owner to log into iCloud on another phone and "free" the previous one for repairs. I guess you could do that if he's buying a new iPhone from you, but still... it is similar to the Macs that are stuck on the previous owner's enterprise account.

I thought person A/ex-phone A would get the "someone is using your old battery, allow?" via iCloud account

I think the point is that an unsuspecting buyer of, e.g. a screen replacement, could end up going to a shady repair shop that uses stolen parts, sees the message once, clicks "OK", and moves on. The reasoning being that this scenario would cause some demand for black market parts.

The suggestion from OP whereby the seller of a used phone logs in and "unpairs" the parts could avoid this, unless a robber forces you to do it under duress.

> unless a robber forces you to do it under duress.

Isn't that possible with the full iPhone atm?

Yes, it's actually made phone theft even worse as a victim. instead of running with the device muggers are demanding pin's and passcodes at gun/knife point

it's resulted in a few deaths in chicago at least

Got a source on this? Quick google search for "Chicago death iPhone mugging" did not turn up anything about robbers specifically asking for PIN codes, or killing someone for not providing it.

> killing someone for not providing it

They wouldn’t live to tell the tale

but a ring camera can. see video of Dakota earley. shot 3 times. for initially refusing to give up his passcode. he survived after 3 surgeries. https://www.cbsnews.com/chicago/news/family-of-dakotah-earle...

Dakota Earley age 23 was viciously attacked and shot 3 times and barely survived. all caught on video and you can hear the thieves demanding the passcode.

https://www.cbsnews.com/chicago/news/family-of-dakotah-earle...

and before you dismiss it given the time of day or one off, armed robberies for cell phones are way up in chicago and they are occurring in broad daylight . the crime that keeps getting covered and that I know someone who this happened to is, 1 -2 people walking on the street, a car pulls up with 4 people . they all get out and have guns and force you to give up your phone and passcode. Armed Robberies are way up 44% 7978 cases and they are all for iPhones and passcodes . people are getting pistol whipped when they don't cooperate and increasingly even when they do.

https://cwbchicago.com/2023/09/chicago-at-least-14-robbed-vi...

https://cwbchicago.com/2023/09/north-side-chicago-robbery-sp...

https://cwbchicago.com/2023/09/4-more-depaul-students-were-m...

See this story: https://www.nbcnews.com/nbc-out/out-news/patrons-nyc-gay-bar...

Hence why you should not use bank/brokerage websites or apps on phone other than maybe a checking account with a small amount of money in it.

Yes! On my travel checklist I have "REMOVE BROKERAGE APPS FROM PHONE"

Unless you are a day trader, I do not see a reason to ever have them on your phone.

You're probably right. I rebalance my account 4 times/year. I'm thinking it may be best to have one "secure PC" that I do my balancing on, and even remove the passwords from my password manager.

for paypal, i only ever use a login through the website on the rare occasions i have to use it. for other apps like cashapp/venmo, do they even have a non-app method of using them?

For those, I would only connect them to a bank account with a relatively small amount of money in it.

you just described every single account i have =(

This thread transformed from "multiple dead people in Chicago" to "5 people in NYC's banks are out $5000".

Overall I think it's pretty safe to pull out your smartphone in public these days, which was not the case years ago.

Apple could just unpair parts when the phone itself is reset/deactivated. And new genuine Apple parts could at least have a one-time automatic pairing when signing in with your Apple ID.

Stolen phone? The phone is still activated, part can't pair with new phone. Not perfect, but at least somewhat less anti-consumer.

But if that were the case, there would be plenty of people willing to sell you a refurbished screen for your 2 year old iphone for $100.

By restricting the reuse of parts, when you crack the screen of your old phone, you are faced with a $500 repair bill, and decide to just pay your phone company $50/month for a new contract that comes with a new phone.

I think you’re misunderstanding. The user who previously owned the part would need to unpair it.

New owners wouldn't OK a stolen part, the part would have to unpaired from the Apple account (on device or online) from the previous owner first.

You should search what happens when these phones are stolen with Apple's lock on them.

It's almost always the same play book:

- moves to some US address nearby

- turns off for days

- shows up in Shenzhen or Guangzhou

Usually from there are a few attempts to phish the owner with fake iCloud alerts (and sometimes outright threats) before they strip it for parts.

To be clear it's not like the phone theft itself is part of some concerted effort by Chinese actors: there are only so many places where the tools and skills to strip down, repackage, and resell something as specific as an iPhone speaker unit are so common

When my phone was taken in an armed robbery, it ended up in Ho Chi Minh City.

No threats though... I assume they just parted it out.

What is your stance on government backdoors in encryption?

Thieves who really want your iPhone will make you unlock it (or just point it to your face) and remove it from your iCloud account. Much better than using it for parts.

Does that happen? I've not heard of that. Regardless, that does iPhones are still immune to everything short of armed robbery. That your front door lock doesn't stop thieves from smashing the window to get in doesn't mean it doesn't serve a purpose.

It happens if they can get away with it, a working used iPhone is more valuable than its parts short-term.

> If it were, they would also allow you to say “yes this replacement is desired.”

How does that not completely bypass any of the reasons for wanting to do this?

And it is “anti-consumerist” to make my property a less desirable target for theft?

> How does that not completely bypass any of the reasons for wanting to do this?

Do it from your iCloud account. Presumably thieves will not hold you at gun point to log in to iCloud and allow pairing of your phone's components to a ready recipient iPhone

This. If Apple was honest, they'd have an 'unlock from account' security, not an 'accept new to account' pairing.

but you'd have to make it to not be something to be done from an iDevice. it would have to be through the website. otherwise, how do you know it's not a still a malicious approval?

Yep, a web portal similar to what apple does with Find My would cover it nicely I think.

Truly, they could put up any roadblock---a time delay, requiring a phone call, MFA up one side and down the other---and it would be a much better look for them.

I don't buy the anti-theft angle that can only be solved by buying a brand-new genuine part direct from Apple.

I dont buy the anti theft angle either. People's phones still end up stolen, and they are still contacted by the thieves to remove the icloud account. ICloud is a good enough feature to prevent theft, and having authorized repair options in it is great. So, that notion is already pretty bad. If someone replaces the motherboard with a blank iPhone(no iCloud attached), then a check of parts that are serialized to an iCloud account should be implemented to prevent harvesting parts from a locked iPhone. There are better consumer friendly methods that Apple simply ignores.

> And it is “anti-consumerist” to make my property a less desirable target for theft?

That's not the main purpose, it's an excuse. You can tell because they don't take relatively simple steps to make things easier for non-stolen parts replacement like the one being suggested

This. The proof is in the actions.

No need to try to defend them based on unsupportable benefit of the doubt possibilities. If their motivations were actually for the users benefit, then the user would have these options and be benefitting.

Yes. I could see a better system being made. Perhaps alerting you that the screen was marked as stolen and refusing to have it operate. Hell, for screens in particular you could display a “please return to <original owner>” message and nothing else.

I think this is being downvoted as it initially reads as a snarky way to say "the way it works now is fine", but reading closer I think they are saying it should only happen when the screen is marked as stolen which seems reasonable

The solution for a phone is put a vin on the display and other valuable parts and upload those to the carrier/manufacturer.

Imagine how happy someone would be if they had their display replaced with a stolen one and next thing they know their phone is both bricked and of no value even for parts.

Can’t Apple grab money by raising prices? Why do they need to do this?

Reply on news.ycombinator.com