undefined | Better HN

0 pointsthrowaway2902y ago0 comments

> They already have cryptographic authentication for parts

What if a genuine part is modified. I am not sure it is a solvable problem?

> First they are indeed not exclusive options, locking parts when the phone is locked is a possible option.

If that is technically possible I am all for it (but if I had to choose between no integrity protection and integrity protection that makes it harder to repair, I don't know what I would choose). However if you are a phone, how would you distinguish between a legitimate repair and malicious swapping out of parts? Sounds like incompleteness theorem would say you can't

0 comments

realusername2y ago

> What if a genuine part is modified. I am not sure it is a solvable problem?

Same problem as it is now, nothing changes.

> However if you are a phone, how would you distinguish between a legitimate repair and malicious swapping out of parts? Sounds like incompleteness theorem would say you can't

If your threat model is malicious swapping parts, an iPhone isn't for you anyway, you need a device more secure than that.

And I doubt that applies to more than an handful of individuals, even targeted attacks themselves usually don't go this far and prefer to just exfiltrate the data by software.

throwaway290OP2y ago

> Same problem as it is now, nothing changes.

Now the phone warns you about a replaced part. Even if it is a genuine one.

> If your threat model is malicious swapping parts, an iPhone isn't for you anyway, you need a device more secure than that.

This is a thread model of many people in many countries today. Sorry for stupid question but is there a usable phone that is more secure, seriously?

realusername2y ago

> Now the phone warns you about a replaced part. Even if it is a genuine one.

Yes, and that's a broken behavior.

> This is a thread model of many people in many countries today. Sorry for stupid question but is there a usable phone that is more secure, seriously?

No it's not a threat model of many people. I'm not even aware of such an attack existing publicly, please link relevant media articles of past attempts, including on Android. Targeted attacks go for the software because it's easier and doesn't leave a trace.

> Sorry for stupid question but is there a usable phone that is more secure, seriously?

Publicly you have GrapheneOS, privately you have security firms providing secure systems for high profiles which are targets.

1 more reply

j / k navigate · click thread line to collapse

0 pointsthrowaway2902y ago0 comments

> They already have cryptographic authentication for parts

What if a genuine part is modified. I am not sure it is a solvable problem?

> First they are indeed not exclusive options, locking parts when the phone is locked is a possible option.

0 comments

realusername2y ago

> What if a genuine part is modified. I am not sure it is a solvable problem?

Same problem as it is now, nothing changes.

> However if you are a phone, how would you distinguish between a legitimate repair and malicious swapping out of parts? Sounds like incompleteness theorem would say you can't

If your threat model is malicious swapping parts, an iPhone isn't for you anyway, you need a device more secure than that.

And I doubt that applies to more than an handful of individuals, even targeted attacks themselves usually don't go this far and prefer to just exfiltrate the data by software.

throwaway290OP2y ago

> Same problem as it is now, nothing changes.

Now the phone warns you about a replaced part. Even if it is a genuine one.

> If your threat model is malicious swapping parts, an iPhone isn't for you anyway, you need a device more secure than that.

This is a thread model of many people in many countries today. Sorry for stupid question but is there a usable phone that is more secure, seriously?

realusername2y ago

> Now the phone warns you about a replaced part. Even if it is a genuine one.

Yes, and that's a broken behavior.

> This is a thread model of many people in many countries today. Sorry for stupid question but is there a usable phone that is more secure, seriously?

> Sorry for stupid question but is there a usable phone that is more secure, seriously?

Publicly you have GrapheneOS, privately you have security firms providing secure systems for high profiles which are targets.

1 more reply

j / k navigate · click thread line to collapse