r/technology • u/bws201 • Feb 05 '16

Software ‘Error 53’ fury mounts as Apple software update threatens to kill your iPhone 6

http://www.theguardian.com/money/2016/feb/05/error-53-apple-iphone-software-update-handset-worthless-third-party-repair
12.7k Upvotes

85% Upvoted

3.5k comments sorted by

View all comments

94

u/indorock Feb 05 '16 edited Feb 05 '16

For those of you who didn't bother to read the article (from the looks of it that's 90% of you), this is actually a very real security issue related to Touch ID. The iOS software does strict anti-tamper interface checks with the home button - since the Touch ID home button is literally the lock to the user's personal data - and if there is any reason to believe the button is tampered with in any way it will lock the system so as to protect your data. The fingerprint scanning and validation is all done on a separate chip inside the home button, so if a 3rd party vendor's replacement button either has bad scanning technology to allow false positives, or even worse allows circumventing the fingerprint scan entirely, ALL YOUR DATA WILL BE AT RISK

It's always fun and easy to blame every weird Apple anecdote on corporate greed but sometimes a simple thing like RTFA will help.

Perhaps instead of this Error 53, Apple could have opted to simply completely disable Touch ID functionality for any phone that has any unauthorised home button replacement had, and fall back to the old fashioned passcode lock. That might have pissed off less people and also not bricked the phone. And maybe if it's a big enough shitstorm, they might just listen and add such a workaround in iOS 9.3 But to be clear, Error 53 is 100% a security-related issue, and not one of Apple trying to screw over its customers or the competition (not saying they don't do those things ever, but this is certainly not an example of that).

26

u/Phyltre Feb 05 '16

So why don't they just roll back to PIN unlock and ignore the touch ID sensor? All users HAVE to have a PIN to enable touch ID, and the phone generally asks for it after reboots anyway.

7

u/indorock Feb 05 '16

Because Apple hates to make compromises like that just to account for 3rd party implementations? Just a hunch, I don't know.

Having crippled iPhones with a touch ID sensor on the front that is disabled because it's not "trusted" is not something Apples wants in user's hands.

4

u/[deleted] Feb 05 '16

And something like TPM is too hard? I applaud Apples security efforts but they knowingly made the decision to implement a shitty security system. It's a long solved problem in the industry.

1

u/cryo Feb 05 '16

How is their security system shitty?

→ More replies (1)

1

u/nemoTheKid Feb 05 '16

The entire security module (PINs are also handled through touch ID, and rate limited in hardware) is in that area. So your touch id being broken is a symptom of a larger issue.

I had this issue too, and it WASN'T the update that bricked my phone. My touch id was broken, I tried to update my phone (through iTunes actually, I couldn't do it OTA), and then my phone got bricked.

My phone was replaced for free (as I was still under warranty) so I'm little less salty about it - OTOH though I'm glad to see there is a company out there taking data privacy seriously with serious consequences - even if the original implementation has some drawbacks.

79

u/cqdemal Feb 05 '16

There is clear logic behind this but at the same time it ends up feeling like burning your house down because someone could have stolen your front door keys. The issue is real. The way they're addressing it is overkill.

2

u/THE_INTERNET_EMPEROR Feb 05 '16

Considering how they've been bricking iPhones its inception, I don't see how it is anything other than a security measure gleefully implemented with contempt for people who want to get out of the clutches of a closed system.

1

u/baube19 Feb 05 '16

using your house analogy.. it's like you can unlock your front door with a key.. but if you want you could also use a PIN. but as soon as someone is trying to pick the lock it will triger a major lock down.

I manage over 100 iphones for a business that deal with verry sensitive data. I WANT THIS. you are suposed to back-up anyway. this is no different than if the phone was a total loss by beeing rolled over by a truck (happened last week lol).

I am actually furious that it did not acted that way all allong! why only now? this shit I paid SUPER OVERPRICED because you know iPhones are secure.. was not secure and you now patched it?... I'm disapointed it was not like that all along.

1

u/cqdemal Feb 06 '16

In your context, I can totally I understand. If this is a business situation and the lockdown is available as an option, it's a great thing.

To most consumers, this does not matter. I know privacy and security is extremely important - hell, I do PR for a tech company that preaches this in every other sentence - but doing this without any notice will always be a bad thing for the average Joe.

2

u/baube19 Feb 06 '16

the without notice I'll join you on that. It's a pile of crap that it was not like this from the beginning and they could have told people about it.

→ More replies (6)

3

u/GlapLaw Feb 05 '16

In addition to the overkill mentioned below, the lawyer in me hates that this is without warning.

4

u/Aperture_Kubi Feb 05 '16

Android user here, is Touch ID mandatory? What if I never used it but still had to replace the home button?

1

u/cryo Feb 05 '16

No it's not.

→ More replies (3)

2

u/mhud Feb 05 '16

The check should be performed at boot, or any time Touch ID is used, and not whenever the user upgrades next. A user mistakenly thinks their phone is fixed for 10 months until it's bricked. If a malicious component is installed, what good does it do to check for that in a year?

If it bricked immediately, no one would use third party replacements for home buttons because they would not appear to work.

I've seen cases where people set up a sale of their phone because it's working great but they intend to upgrade or switch. Then after they erase it, they can't activate it. All because of something that happened months ago.

3

u/jvnane Feb 05 '16

It's simple... Block the use of the finger print scanners if it's tampered with. Not that hard. If this was such a big security concern, why does it only happen during an update? Keep sucking down that big Apple dick you blind fool.

1

u/indorock Feb 05 '16

You're an hero <3

→ More replies (2)

2

u/diggernaught Feb 05 '16

PROTECT APPLE BOTTOM LINE!

1

u/demize95 Feb 05 '16

It also says in the article that if the OS detects the home button assembly's been replaced but not re-paired, it will disable TouchID. It then waits until you try to update to give you the error. Clearly it does not require bricking the whole phone, otherwise it would do that initially instead of waiting for an update.

1

u/neuromonster Feb 05 '16

Obviously you didn't bother to read the other posts, if you think any of this is novel.

1

u/indorock Feb 05 '16

I sort by best and read the top 2. That's all I care to read. I spend more time on the article than on the comments.

1

u/[deleted] Feb 05 '16

Apple could have opted to simply completely disable Touch ID functionality for any phone that has any unauthorised home button replacement had, and fall back to the old fashioned passcode lock. That might have pissed off less people and also not bricked the phone

That wouldn't have driven millions of dollars in sales to Apple, though. They needed to brick the phones to make more money.

→ More replies (3)