Hacker News Reader

Comment by toomuchtodo | Hacker News Reader

It is delightful that OP was able to get Tim’s exec team to fix this for them. Broadly speaking, this indicates that there needs to be a mechanism to bind your IRL identity to your digital identity and your device(s). Instead of showing proof of purchase, you provide a government credential you bound to the account and or the device, and assuming trust in the identity proofing process, you receive access to your device or account because you are known to be who tied the device to your IRL identity.

Emailing Tim doesn’t scale.

(I have filed comments with the FTC on this account recovery matter regulatory gap; identity is a component of my work in infosec, primarily in financial services)

View on HN

Tying your real identity to a machine is a piss poor solution to this problem, and it is as such because you're not understanding the problem itself.

The issue at hand is that devices are being sold where you do not take ownership of the private keys used to configure it. Not your keys, not your device.

Right, this idea that your keys are your ownership interest is not grounded in legal reality and why legal matters end up in court or with regulators: they are the arbiters of the law, not some crypto primitive (which while arguably useful and convenient for security and access control, is not what defines ownership). It’s some tech bro idea of what the law should be, not what it is. The device is yours regardless of the state of private keys on the device, what Apple’s PKI web and FindMy asset status indicates, etc. Observing a judge or regulator issue an order to resolve such an issue, along with penalties for not, makes this clear.

You continue to own what you own as long as you can prove who you are (assuming you haven’t transferred the asset or belonging to someone else legitimately; save your bill of sale!). Tech doesn’t write property law, it is a servant to it and operates within the legal framework (for obvious reasons). Code and keys are not the law; the law is law.

In this case you continue to own what amounts to a paperweight, if your laptop gets activation locked.

If I am not in control of the method to determine ownership and someone else is. its not ownership. At the very least, determining ownership should be in the hands of a system that independent of the product purchased and has a certification that it operates without bias.

* nacho

Being able to "take ownership of the private keys" will benefit us on HN and not many beyond that. Apple sells Macbooks to anyone who can afford one, and I would bet money we'd see 100x the number of complaints of inaccessible laptops (via selling them or otherwise) if you needed to store keys from initial setup until the end of its usage or from people forgetting to transfer the keys to the new owner(s) of said laptop.

sell a better solution and get rich.

btw what we have today is the worse of both worlds. apple et al can tie you to a identity which you cannot use to recover your data but they can sell to advertisers or act on police requests from that profile metadata.

You're assuming such a system would be someone emailing you privatekey.txt

That is, of course, a system that exists, but, be creative, lots of ways to skin that cat. In apple's case, well, they could certainly sell a device to handle that job, basically a key fob like you probably use in your car (sometimes built into the physical key without your knowledge).

You could also use the remarkable amount of compute that most people carry around in their pockets to do this job with no additional device required (use your phone).

Not really a hard nut to crack overall.

Aren't you describing a use case for a yubikey?

I keep thinking that the right solution to this problem is to add an HSM that functions as a bearer title for the device, layered above the existing Apple root of trust, that comes in the box.

It could sign an activation lock removal and give it to the device through the usb port.

If the HSM is lost or fails, revert to the status quo.

That is a cool idea. The machine comes with a horcrux :)

I like the idea of course, but I can see it so easily ending up in some forgotten corner of a stolen laptop bag.

The common theme that keeps coming up with activation lock that Apple's customers do not understand this feature until it bites them in the wallet. Any solution would require education that these same people won't get until they're in an irrevocable situation anyway.

Or they could sell a service to manage the device keys. The could even bundle it for free. They might even give it a terrible, anti-descriptive name like “find my”

Thank you! This comments section is so weird - most of the comments are the exact opposite of my understanding.

Find My Feature from apple.com:

> Activation Lock is designed to prevent anyone else from using or selling your device. When you enable Find My on your device, Activation Lock is turned on automatically.

> Your Apple ID and password will then be required in order to erase or reactivate it. And if someone is able to erase your device, the Hello screen will show that it’s locked, locatable, and still belongs to you.

Yeah, the issue is the author didn’t avail himself of Apple’s device key feature, then had his laptop stolen. In the interim, whomever had the machine enabled the device key feature, so the author couldn’t use the machine when it was eventually recovered.

Normal people are not going to do any of those things. If you force them to, they’ll lose the phone or wipe it or sell it. They will lose the physical key immediately, or break it somehow, or sell it.

This is not a technical problem, and you cannot solve it with a technical solution.

> if you needed to store keys

Is that a plan anyone is suggesting?

First time I've heard "Not your keys, not your device." I love it. Thanks.

I think it comes from the world of cryptocurrency: "Not your keys, not your coins". Really, it can be extended to a lot of troublesome issues in computing. Like cloud computing: "Not your metal, not your machine" and storage: "Not your drive, not your data". Or E-mail hosting: "Not your domain, not your... well I can't figure out a clever phrase there but you get the point." We delegate so much important stuff to faceless, opaque corporations, and then act all "Shocked Pikachu" when we realize our stuff really isn't ours.

>here needs to be a mechanism to bind your IRL identity to your digital identity and your device(s)

No, this creates more problems than it solves.

Estonia has a system a little like that: https://e-estonia.com/solutions/e-identity/id-card/

I absolutely don't want my identity tied to my hardware. Because once it's there the industry will start campaigning to link it to online accounts as well.

I definitely don't trust the government and industry that much.

> Broadly speaking, this indicates that there needs to be a mechanism to bind your IRL identity to your digital identity and your device(s)

The link between digital identity and device ownership would have been sufficient to prevent this situation without involving IRL identity. The author had a chance to establish that link, but chose not to.

I enjoy Apple's services, but I can understand why someone wouldn't want their computer phoning home to a big tech company all the time. It's pretty difficult to understand why someone who doesn't want their device phoning home to Apple, would be OK with their device phoning home to the government?

I've long wanted something like this for addresses or contact details.

You register your address somewhere, and give access to it to companies by signing their certificate. When you update your contact details, you do so in one place and it sends a notification to each organisation to update their details.

It'd be better as well if you could revoke your permission with that company so they can't contact you.

What about those of us who are unable to obtain government ID?

You’re default fucked anyway current state based on this anecdote. Broadly speaking, government should make it as straightforward as possible to obtain a legitimate government credential from an equity perspective for a variety of lifetime identity needs (and about 1% of the US population has no government ID). Out of 200 countries, 170 have a national ID system.

https://www.theatlantic.com/politics/archive/2021/08/voting-...

I'm the 1% in the USA, due to immigration issues.

No gov creds from home country on hand from across the pond? Should be able to walk into an embassy or consulate and have them provided if you haven’t yet. Purposely being vague to attempt to answer your inquiry without divulging your personal info.

Yes, it's a process, but I can get my UK passport back from the embassy. My USA green card got burned up in a building fire last year, and my passport is just missing, which presents a problem.

Not being able to get USA ID makes it very hard to get registered on many web sites though :(

This sounds so annoying, why does it have to be gov-issued?

Because those are credentials of last resort trusted at scale. Losing who you are is much more challenging than a secure hardware token or a soft crypto primitive. If you lose a gov credential, the government itself does the hard part of identity proofing to reissue a credential for consumption by those who require identity assurance to complete a transaction or action. A business or other party can then trust that credential, reducing the risk of loss through identity fraud.

Optional of course. For those who want to ride the lightning, they should be able to opt out and eat the loss if they so choose (assuming loss of authentication mechanisms, whether that be passwords, passkeys, private key(s), hardware tokens, totp seeds, etc). For the rest of us, “here is my driver’s license, state ID, or passport, please unlock my property or I’m engaging state and federal regulators and the legal system.” To do otherwise is in violation of consumer and citizen property rights.

Sort of, in some places. In the USA identity theft, including getting gov documents is pretty common.

Reply on news.ycombinator.com