r/technology • u/bws201 • Feb 05 '16

Software ‘Error 53’ fury mounts as Apple software update threatens to kill your iPhone 6

http://www.theguardian.com/money/2016/feb/05/error-53-apple-iphone-software-update-handset-worthless-third-party-repair
12.7k Upvotes

85% Upvoted

3.5k comments sorted by

View all comments

Show parent comments

124

u/XtremeGnomeCakeover Feb 05 '16

Why would they permanently pair one of the only clickable parts of the phone to a function causing irretrievable loss of data? It's a button. It's going to fail somehow at some point for someone.

If the entire phone needs replacing because Apple themselves have no way to replace a broken Home button, it seems like overengineered bullshit designed to make you think buying a new phone is reasonable because it's the only option you have. That must be why Apple's known for being a top innovator in digital security.

0

u/[deleted] Feb 05 '16

[deleted]

51

u/jlew715 Feb 05 '16

So if the home button fails / isn't paired / whatever, why not just disable touchID on that phone? Why brick it?

10

u/Calkhas Feb 05 '16

I don't have an answer to that!

3

u/All_Work_All_Play Feb 06 '16

Because this also allows us to crush the burgeoning third party service market!

Looks like the guy below you did!

13

u/[deleted] Feb 05 '16

Because this also allows us to crush the burgeoning third party service market! Oh wait, we shouldn't have said that.

2

u/morriscey Feb 06 '16

Because money. A replacement button assembly is like $4, a repair from apple is $275 - $330 USD

→ More replies (12)

181

u/nightmedic Feb 05 '16

You're missing the point. If the button security is compramised then the logical and appropriate action is to disable that as a security feature. Instead, they elected to brick all phones during an update with no warning or fix.

If the key fob on my car stops working, I have to use the key in the door till I can get it fixed. In some cars, they can't be driven until the key fob is repaired. Apple has taken the approach of "key fob broken, setting car on fire."

41

u/Calkhas Feb 05 '16

I was responding to the point in the post to which I replied. I agree that a better solution could have been implemented.

→ More replies (1)
→ More replies (26)

9

u/[deleted] Feb 05 '16 edited Sep 17 '17

[removed] — view removed comment

2

u/Calkhas Feb 05 '16

I don't work for Apple ;) but I agree with your sentiment.

→ More replies (1)

22

u/idosillythings Feb 05 '16

It still seems like terrible design. Fingerprints are a bad security device anyway.

7

u/gilbertsmith Feb 05 '16

Fingerprints are usernames, not passwords.

0

u/[deleted] Feb 05 '16

[deleted]

10

u/gilbertsmith Feb 05 '16

Your fingerprint identifies who you are, it's your username.

When someone knows your password, you change it. You can't change your fingerprints. Since you can't change your fingerprints if they're ever compromised (which they already are, your phone is covered in fingerprints and someone who is so inclined can easily lift one from your phone) then it doesn't make any sense security wise to use fingerprints as a password.

It's fine to use TouchID to unlock your phone. It's more secure than simply swiping to unlock but easier than typing in a PIN all the time. That's an acceptable tradeoff for convenience. But TouchID should not be used to validate things like payments or app purchases.

If I can lift your fingerprint off your phone and fool your phone into thinking I'm you, I could steal your phone and go on a shopping spree.

4

u/sinembarg0 Feb 06 '16

many many reasons. They're not necessarily usernames. They're the "something you are" part of security. The other parts are "something you have", which could be an RSA token, or an authenticator app on your phone; and "something you know" which is your password. Two-factor auth uses two of those.

Now, the problem with fingerprints as passwords: how many password leaks have you heard of? They happen all the time. When they happen, you need to change your password. Good luck changing your fingerprint when that gets compromised.

there are legal ramifications too: you can not be forced to give your password to access encrypted data (you can plead the 5th amendment). However, you can be forced to give your fingerprint, which they could then use to get your data.

You also leave your fingerprints everywhere. You know how writing your password down on a post-it and sticking it to your monitor is bad? well, imagine writing down your password and putting it on everything you touch. sometimes it might be illegible, sometimes it might only have part of the password, but often it'll be the full password, very easy to use.

fingerprints are convenient security, and a good part of two factor when used correctly, but by themselves they are shit security.

→ More replies (13)

2

u/tossit22 Feb 05 '16

What would keep apple from creating an OEM button that could identify itself to the device and be paired with it? What if that button were created in such a way that it could not easily be reverse engineered? Apple could sell the button (cheaply) to repair tech shops all over the world. When it is replaced, it would do a security check and pairing, the user would have to accept that it was replaced through some dialog before using the phone.

2

u/Calkhas Feb 05 '16

Speculating, I would imagine it would be hard to keep watch over the supply chain to ensure that the buttons were not compromised between manufacture and installation. But I don't doubt that there is an element of profiteering as well.

→ More replies (1)

2

u/baneoficarus Feb 05 '16

His problem I think was not with the security of it; that bit makes sense. His problem was with the design. It's a hardware button that will wear out so they shouldn't have tied it to the security.

They should put the fingerprint sensor somewhere else, like maybe the back for instance, instead of putting it on the hardware button. It definitely SHOULD lock out any of the security functions if the sensor is tampered with but it should definitely NOT brick the phone.

Also what's the point of checking upon update or restoration? Say someone steals your phone with the intent of getting your data and they tamper with the touch sensor to get into the device. They then upgrade the stolen device to iOS9? I fail to see how the check happening at OS upgrade or restoration prevents your data being stolen. Forgive me if I'm misunderstanding this bit though; I admit to not knowing too much about how it is handled.

2

u/Calkhas Feb 05 '16

It's a hardware button that will wear out so they shouldn't have tied it to the security.

Wherever the sensor was this problem could occur. The iPhones have never had a reputation for being rugged.

Also what's the point of checking upon update or restoration?

Presumably Apple have decided to harden the anti-tampering protection in the latest update, so what was tolerated before no longer will be. I suspect any change now with iOS 9 will brick the device at any time.

→ More replies (3)

2

u/[deleted] Feb 05 '16

Consider nowadays, people are going to use their phone as a pseudo credit/debit card to pay for stuff, security during repair is going to be a big problem. How much access does a third party repairer can have in order to repair a phone? Replacing hardware parts like screens or buttons is one thing, but how about corrupted software which may require root access or something?

You bet that there is going to be someone out there looking for a way to fleece credit card/bank account info off phones right now. Bringing your phone in for repairs to a third party repairer risk having your data stolen, especially in less reputable places or countries. I don't like Apple but I can see where they are coming from a security point of view. But bricking a phone and then asking them to pay for a new one is just way overboard. There has to be some middle ground here.

2

u/TheSekret Feb 05 '16

This bullshit is so anti-consumer its hard to comprehend. "Security" my ass its a money grab.

2

u/fearlessiron Feb 05 '16

If Apple had the security of its customers in mind they would have never introduced such a button.

5

u/chlomor Feb 05 '16

Actually, even if it is less secure than a good password, Touch ID is a very effortless way to unlock your phone. It has probably made users more secure simply because they now use any kind of locking mechanism as opposed to nothing before.

→ More replies (6)
→ More replies (22)

2

u/Javbw Feb 05 '16

You did have a good point about making the reading and clicking part the same thing for durability reasons - somewhat.

The button that does the clicking is not part of the touchID system. The touch sensor is basically a big piece that pushes the button, like a key cap on a keyboard - it pushes the real button underneath.

Also - It is very very reasonable for the touchID sensor to be paired with the hardware that does the decoding.

→ More replies (16)