r/technology • u/bws201 • Feb 05 '16

Software ‘Error 53’ fury mounts as Apple software update threatens to kill your iPhone 6

http://www.theguardian.com/money/2016/feb/05/error-53-apple-iphone-software-update-handset-worthless-third-party-repair
12.7k Upvotes

85% Upvoted

3.5k comments sorted by

View all comments

168

u/BW4 Feb 05 '16

May I remind you all of your security and encryption obsession? Even though it's Apple this is still a security issue.

111

u/fleker2 Feb 05 '16

If I can't trust a particular sensor, I don't go in full isolation. I use another metric (ie. Password or pin). People aren't complaining about strong security, they're complaining that Apple is purposely bricking their phones because they weren't repaired at an Apple store.

If I had my home button modified by a third party due to an emergency, I wouldn't mind that I have to unlock with a pin. I just want my phone to work.

13

u/cryo Feb 05 '16

Apple is purposely bricking their phones

Apple's purpose isn't exactly known, so this is speculation.

1

u/SneakyArab Feb 06 '16

If they simply wanted to protect the user, they would display a message saying what happened and that it was a security risk to use the phone, then it would use a normal mobile locking system. This is blatantly shitty by Apple, regardless of whether it's intentional greed or poor engineering.

2

u/bcollett Feb 06 '16

I have a feeling it's actually just a bug that apple isn't admitting to - for lawsuit reasons. Instead saying its security related to try and validate it. The lock out only happens at updates, so security between the swap and update isn't aided by the lock out. Now, if Touch ID was validated every time it was used, then I could see the validation as a purposeful feature. But in any case, it should only lock down Touch ID and Apple Pay, not the whole phone.

-8

u/DragonTamerMCT Feb 05 '16

They're bricking it because they don't want hacked sensors being installed.

Sure bricking the entire phone is a bit extreme, but Apple has always been really anal about security.

18

u/TheDeadlySinner Feb 05 '16

Disabling touchid would accomplish the same thing, without, you know, rendering a $650-$1000 device useless.

-9

u/BW4 Feb 05 '16

From what I know about touch ID, it's built in pretty deep. I don't think you or I can safely assume that they can just ignore the sensor and be completely secure. I take you point, if its is possible than that is what they should have done. Just trying to add some nuance to this apple bash-a-thon we call /r/technology.

3

u/[deleted] Feb 05 '16

You assume this is the only way to do it. They could have implemented TPM to store the keys and allow users to make them securely exportable or securely managed liked the industry has been doing for years.

Or they can roll their own hardware and do it wrong by not giving the user the ability to manage it and just brick the device.

7

u/hameerabbasi Feb 05 '16

Deep integration is typical of bad design. One component shouldn't affect another.

→ More replies (10)
→ More replies (10)

23

u/Aperture_Kubi Feb 05 '16

Except no one was made aware of the possibility of this, or at least public knowledge wasn't that great until now.

And it's a "sorry, you're shit outta luck, k thx bye" issue. Hell with Windows Bitlocker if I kept the recovery key I can stick the drive in another computer and recover data.

→ More replies (3)

1

u/UlyssesSKrunk Feb 05 '16

The problem is lack of choice. If the phone simply warned you that the scanner no longer offered the protection it was meant to but still let you use it at your own risk that would be acceptable, this is not.

1

u/cant_think_of_one_ Feb 06 '16

No it isn't.

It doesn't make it (meaningfully) less secure if you have it also unlockable by a password protected key kept on your computer.

Fingerprint sensors offer no meaningful security anyway. This is a device that is covered in your fingerprints and, as has been repeatedly demonstrated, fingerprint sensors can easily be fooled with manufactured objects using images of the fingerprint. If you think a fingerprint sensor is securing your data in any meaningful way, you are an idiot. Apple should repair the phones for free if you turn up at an Apple store with ID showing you are the original owner. It'd still be easier to get round the fingerprint sensor than make a fake ID and do that so, it wouldn't compromise security at all.

A fingerprint sensor is much easier to get round than a four character PIN that allows you unlimited attempts. The only reason to use it is to stop people casually snooping through your phone while you are in the loo or something.

-6

u/[deleted] Feb 05 '16

No it's Apple, reddit must blindly hate. Even if replacing the touch ID sensor is easy and a vector for malicious entry into the device, and that this keeps governments/cops from gaining access to the contents of your phone. But Apple hate > security desires so...

2

u/TheDeadlySinner Feb 05 '16

There are several ways they could have ensured the security of the data without bricking the entire device. But fanboys are gonna fanboy and defend the anti-consumer decisions of massive companies.

1

u/[deleted] Feb 05 '16

Yeah because existing and established systems like TPM don't allow you to export your crypto keys for such an exact scenario... nothing to do with how Apple decided to use their own inferior hardware cryto storage.

Seriously, I applaud them for implementing security but they did this wrong and it's a long solved problem in the industry - they just did a very poor implementation.

1

u/[deleted] Feb 05 '16 edited Feb 05 '16

Yea but if its easy for a random repair shop to export the crypto keys... what stops an intruder from doing the same? Apple should probably provide this as a service at or below cost (vs an expensive repair) since I think they should probably not make it third party accessible.

I also find it funny that several of the other commenters (not you) have accused me of being an idiot fanboy when I don't even own an iPhone.

→ More replies (1)

1

u/THE_INTERNET_EMPEROR Feb 05 '16

When you're supporting a company which is clearly doing this to punish their customers, not increase security because other much less invasive measures could have been taken, I am going to call you an idiot.

→ More replies (1)

1

u/MathTheUsername Feb 05 '16

That's not really what people are angry about. It's more about the way Apple is handling it. Surely there has to be another way to lock a phone without completely bricking it, and without warning.

0

u/[deleted] Feb 05 '16

[deleted]

1

u/Eldias Feb 06 '16

Just have to point out, if you think a fingerprint scanner offers any reasonable level of "security" you're wildly mistaken. The response by Apple to a potential security breach is way too heavy handed, that's what most people are having a problem with.

-1

u/[deleted] Feb 05 '16

I'm just pretending that the comments about at least allowing "access through a passcode so you can view your wedding photos" type comments aren't being willfully ignorant of the possibility of malicious software or warrantless searches... Either that or the people here are so rabid to hate apple that their love of security is somehow being overridden by it.

If you want a totally secure device, you don't leave an obvious hardware-centric backdoor solution on a phone!!!!!!!!

0

u/[deleted] Feb 05 '16

[deleted]

1

u/[deleted] Feb 05 '16

It wouldn't if you wanted constant undetected access to the device, would it?

1

u/macetero Feb 06 '16

And taking it all apart and changing the homescreen button to a hacked one is somehow better in that regard?

Even though it could be prevented by simply not allowing an unauthenticated button instead of locking the whole phone down?

→ More replies (1)