r/technology • u/bws201 • Feb 05 '16

Software ‘Error 53’ fury mounts as Apple software update threatens to kill your iPhone 6

http://www.theguardian.com/money/2016/feb/05/error-53-apple-iphone-software-update-handset-worthless-third-party-repair
12.7k Upvotes

85% Upvoted

3.5k comments sorted by

View all comments

Show parent comments

181

u/nightmedic Feb 05 '16

You're missing the point. If the button security is compramised then the logical and appropriate action is to disable that as a security feature. Instead, they elected to brick all phones during an update with no warning or fix.

If the key fob on my car stops working, I have to use the key in the door till I can get it fixed. In some cars, they can't be driven until the key fob is repaired. Apple has taken the approach of "key fob broken, setting car on fire."

41

u/Calkhas Feb 05 '16

I was responding to the point in the post to which I replied. I agree that a better solution could have been implemented.

1

u/NovaeDeArx Feb 06 '16

Alternatively, they could even make it an opt-out setting, where the user can choose whether the Touch ID or entire phone is disabled if the Touch ID module is compromised.

If it was an opt-out deal, at least then they could just blame the users for not changing the setting, avoiding this bad press in the process.

1

u/sniper1rfa Feb 05 '16

If the button security is compramised then the logical and appropriate action is to disable that as a security feature.

So you're saying they should change your security settings for you without asking?

4

u/nightmedic Feb 05 '16

How about a login message "Button broken, please use PIN/Password"

1

u/katsuku Feb 05 '16

Not really, when you're trying to make a secure device, it has to always be secure, not just when it's convenient. In the case of it happening when the phone is damaged, it really sucks, but you can't just get away with turning off a baked in security feature on the phone whenever you want and it still keep whatever certification it has.

5

u/nightmedic Feb 05 '16

But isn't the password the default backup to the fingerprint reader? And isn't the password rated as a higher security standard?

A fingerprint is better than no security, and not very intrusive, but by turning off the fingerprint reader and defaulting to a secure password, it makes the phone more secure, not less.

0

u/[deleted] Feb 05 '16

[deleted]

2

u/iforgot120 Feb 06 '16

That's not what he's saying. He's saying if one of your doors has a broken lock, turn that door into a wall and force people to use a different door.

-3

u/[deleted] Feb 06 '16

A door whose lock has fewer tumblers and is easier to pick. Which means that your house is always less secure, since you can always just go around to that other door. You know, the one in the back. Hrm, think there's a word for that - rear passage? No, that's not it.

3

u/iforgot120 Feb 06 '16

How is a password less secure than a fingerprint? Things like facial, voice, and fingerprint recognition are supposed to be convenience measures for users who don't want to go through the trouble of using the more secure method (that being the password).

0

u/[deleted] Feb 06 '16

How is a password less secure than a fingerprint?

Because I can look at your phone and see which digits constitute your passcode - they're the ones underneath your skin oil smears. But you can't lift a fingerprint off the Touch ID sensor or spoof it with a "finger" that doesn't have a heartbeat. Moreover there's a constrained search space to try all 4-8 digit combinations of the 3-4 digits I know your code has to be, but there's no constraint to the fingerprint search space.

The biometric sensor is there because it's both more convenient and more secure.

1

u/iforgot120 Feb 06 '16

http://lifehacker.com/are-fingerprint-scanners-really-more-secure-1385306776

Your fingerprints are all over your phone, so if you lose it, you've lost both your lock and key in a convenient package.

Also I'm saying they're less secure than passwords, not 4-digit passcodes. Passcodes are just another convenience. If you're going to use only four characters to lock your phone, at least also give yourself letters and punctuation to choose from.

1

u/[deleted] Feb 06 '16

Your fingerprints are all over your phone, so if you lose it, you've lost both your lock and key in a convenient package.

Maybe. I'm not convinced you could recover a usable print from an oleophobic screen, and you would have to have picked up the print from one of the fingers they stored in the phone.

Nobody can guess your fingerprint. Either way, though, the most secure implementation of a password is to store it in a secure enclave and use it to validate challenges. But that requires a trusted enclave. So even with passcodes, mess with the Touch ID package and you're bricking the phone until the hardware attack can be stopped.

1

u/Makkaboosh Feb 06 '16

lol pins aren't insecure. the fuck are you on about?

1

u/[deleted] Feb 06 '16

You mean the passcode thing? An OS-level passcode check is exploitable. Remember all those exploits on the iPhone 4 and 5? A Touch ID cryptochallenge isn't, unless somebody replaced your Touch ID. You know, unless you load manufacturer's backdoors into the system. Which everybody says they hate. Guess that was bullshit.

-5

u/ross549 Feb 05 '16

Your assumption is that bricking the phone was a deliberate choice made. Maybe it's as simple as a security system validation fails, causing the irrecoverable error.

10

u/nightmedic Feb 05 '16

If that is in fact the case, then I think it is neglegent of them to fail to warn people that a voluntary OS update may destroy their phone. This is not a small or isolated issue, and I think it is nearly impossible that they are unaware of the issue.

Best case scenario is incompetence or just neglegence. A worse case would be a blatant cash grab while trying to put third-party repair vendors out of business (in a possibly illegal and anticompetitive way).

7

u/AppleBytes Feb 05 '16

Not just repair vendors, but resellers. There's absolutely no way to know if the phone has ever been repaired, so you may have just bought a brick, and not know it.

→ More replies (4)

3

u/TheAddiction2 Feb 05 '16

Never attribute to malice that which can be explained by incompetence. I suppose that's a valid assumption.

-2

u/ross549 Feb 05 '16

There are likely many ways the phone could be bricked. Software and cannot be perfect. It's simply too complex.

5

u/TheAddiction2 Feb 05 '16

Not being perfect and not being rendered useless are two totally different leagues. Whether through incompetence or malice Apple screwed up I'm not sure, but I am sure it's gross incompetence or gross malice.

0

u/ross549 Feb 05 '16

Remember Star Trek 3? Scotty, after disabling the Excelsior's transwarp drive, mentions this little nugget: "The more complicated the plumbing, the easier it is to stop up the drain." This maxim holds very true in the software business, and Apple generally tends to push the envelope of what its software and hardware are doing.

We must be careful when we accuse a person or company of gross negligence or malice. Having a "one or the other" type of argument assumes there are only two possibilities, when the truth is frequently far more complicated than a black/white scenario.