Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Apple has touted Touch ID as a secure hardware path from the beginning. Here's the explanation straight from Apple:

Touch ID does not store any images of your fingerprint. It stores only a mathematical representation of your fingerprint. It isn't possible for your actual fingerprint image to be reverse-engineered from this mathematical representation. iPhone 5s also includes a new advanced security architecture called the Secure Enclave within the A7 chip, which was developed to protect passcode and fingerprint data. Fingerprint data is encrypted and protected with a key available only to the Secure Enclave. Fingerprint data is used only by the Secure Enclave to verify that your fingerprint matches the enrolled fingerprint data. The Secure Enclave is walled off from the rest of A7 and as well as the rest of iOS. Therefore, your fingerprint data is never accessed by iOS or other apps, never stored on Apple servers, and never backed up to iCloud or anywhere else. Only Touch ID uses it and it can't be used to match against other fingerprint databases.

This was my point too. If Apple is now changing their conversation - then it stands to reason that TouchID wasn't as secure as they stated, right? Now they believe it's hackable? What does that say for Apple Pay then?
 
This issue is no different the the original Xbox... The motherboard and hard drive had to have matching ID's or it would fail to boot and not work. (Not using mod chips)

The morons should have purchased Apple care.

A persons stupid Mistake always ends up being blamed on somebody else....

Next some moron will sue because the Apple phone won't install android software.

Companies have a right to protect their product and end user. If that 3rd party Touch ID did keep working after the update how does that person know their finger print data and information wasn't being sent out to a botnet or host collecting data... With the way stuff has been nowadays... Maybe the 3rd party Touch ID has a new encrypting malware with would lock the phone down on its own...

Everybody whines about closed systems and proprietary equipment but there is a reason for it in today's world of data breaches and security issues.
 
This issue is no different the the original Xbox... The motherboard and hard drive had to have matching ID's or it would fail to boot and not work. (Not using mod chips)

The morons should have purchased Apple care.

A persons stupid Mistake always ends up being blamed on somebody else....

Next some moron will sue because the Apple phone won't install android software.

Companies have a right to protect their product and end user. If that 3rd party Touch ID did keep working after the update how does that person know their finger print data and information wasn't being sent out to a botnet or host collecting data... With the way stuff has been nowadays... Maybe the 3rd party Touch ID has a new encrypting malware with would lock the phone down on its own...

Everybody whines about closed systems and proprietary equipment but there is a reason for it in today's world of data breaches and security issues.

Considering some of the users complainingg went to authorized repair locations and/or didn't even perform a repair, your rant is pretty much invalidated.
 
I can't believe all these stupid comments here. What if someone could access all your private data including Apple Pay by just stealing your device and replacing the finger print sensor? What's the point with a finger print sensor if it's not keeping your stuff secure? Please think people!

the repair causes the device to reboot so u have to put in the owners passcode anyway so whats the big deal?

i mean the TouchID and AppStore require your passcode / AppleID password after a reboot before you can use your TouchID so Apple clearly thinks a Passcode is more secure. In that case they could simply disable TouchID and still give access if you know the passcode. no need to brick the whole device
 
This times a million. Regular pin was not compromised and I'm betting that the software wizards can just make the phone behave like any other iPhone without TouchID. I smell nothing but a money grab here.

Yes, because this is such a widespread occurrence. And, for the few that have rolled the dice going to Fast Freddies Fone Fix, those walking away with disabled phones will be extremely pleased and motivated to go out and purchase another iPhone.

Indeed, a huge money grab for Apple. Such a huge money grab that Apple put this system in place solely to encourage unhappy phone owners to continue to be loyal Apple customers for decades into the future. I sense several billion dollars worth of new revenue from happy customers due to this custom-designed money grab alone due to the extraordinary goodwill it will engender!

I smell some lacking the ability to think things through.
 
My take on this is rather simple. Apple does have the right to protect the integrity of their own devices. This goes without saying. That said, if Apple chooses to completely disable a device due to non-OEM parts the following must be in effect…

1) Authorised Apple Service Centres for iOS devices must meet a certain saturation in all regions your devices are sold. If I can't get a repair effected in a timely fashion because I have to send it away this type of response to a 3rd party part is unacceptable as a return time can result in weeks. I for one have nowhere I can take my iOS device… I must send it away. With a 3rd party repairer I can typically arrange a time for my repair (when I get to the front of the queue so to speak) and I can have a coffee while wait for them to do it.

2) Apple must guarantee a decent minimum time for them to be able to make an iOS device classed as "vintage". The moment a product goes into "vintage" status Apple will not fix it. Apple are doing this to products sooner and sooner it seems.

3) Something that people seem to have forgotten… Apple, you sold me this product. You didn't borrow it, rent it or otherwise. SOLD! It's no long yours to have your say over.

4) If security is in fact an issue, with Touch ID for instance, it's not like it's difficult to just disable Touch ID at which point it'll work like a standard home button. Why brick the whole device?!

5) Allow the restoring of a device to the same, non-current, OS that is currently on it. This is the step that's seemingly causing "Error 53". Why I should be forced into any iOS version beats me. This is a whole other angst I have with Apple.

While I get both sides of the argument, bricking devices is not the answer. Disabling functionality, simply being reasonable, is better route for all.


I think there is a general misunderstanding because the previous article was so poorly worded. The error is occurring when either A) the phone is repaired with a 3rd party part that is not OEM and, thus, does not meet Apple's security standards, or B) The phone was not properly calibrated by the repair facility (Apple or AASP), and the sensor was not paired with the MLB of the phone. The fact that it can hit many months later is certainly frustrating, especially considering there is no warning for this new behavior in the update logs, but, from Apple's standpoint, I can see why they do it. If this can become a threat to the security enclave, they want to nip it in the bud before the snakes realize it and come up with ways to expose the loophole. It's more than "Oh Apple just wants you to pay for their service."
 
  • Like
Reactions: Agilis
Okay, perhaps English is your second language?

You constantly seem to confuse terms like "MAY cause damage" or "MAY void" to mean "WILL" do so. You also confuse "SHOULD use authorized" with MUST. The first forms are allowable by law. The second demand forms are normally not.



Backwards. The phone was not damaged until it was bricked. But I can see Apple's lawyers arguing your way.



Just to be clear: the sensor doesn't access anything. It's an input device, like a mouse. Your mouse does not access your hard drive. Nor does the sensor access the secure enclave.

The sensor simply sends print images to the CPU, which then copies them to the secure enclave to look at and possibly authenticate.

Sensor data -> CPU -> secure enclave -> authentication Y/N flag back to -> CPU

That's all. So no, the sensor cannot attack the rest of the phone directly. The security hole being presented is that if a evil sensor knows your real fingerprint, it can duplicate it at some other time for someone else. Of course, a much cheaper (and easier to do without being detected) fake finger also works, especially if you can follow and target someone.

I wonder if next Apple will brick laptops if you change the mouse or keyboard. After all, a malicious third party mouse or keyboard could remember your movements / keystrokes, and thus are security risks.



One of the possible arguments that Apple lawyers will use. But you know what? Sometimes that which is legal is still the wrong thing to do, both from moral and PR standpoints.
Thanks for adding some clarity and logic to the thread!
 
Man, what a lot of dumb fanboys in this thread. These are Apple users being screwed over here, you know, people like you. The fact remains that Apple are such liars with this error 53 bricking. If my passcode supersedes my finger print in all cases (which it does) then why brick a phone when the fingerprint sensor is compromised? My fingerprint is not required after a reboot and not required after 48 hours.
 
I like the security but it´s not too much to ask that they inform about it..

My old Nintendo Wii had a warning about mod chips and soft mods before you could accept the software update.

Apple could insert a line of text in the iOS update info.
"Non original parts might cause the phone to become unusable"
Do you accept? Y/N
 
Except the iphones fixed by unauthorized repairmen do work.

Let me type that again in all caps. THE FIXED IPHONES WORK.

The iphones brick when doing an iOS update or iOS restore. It isn't because of a new security feature in the new iOS update, it is because the additional security check (assuming it is a security check and is bricked on purpose and not some bug) is done during the OS install/restore process. This error 53 is not new.

If this security check was done on bootup instead and the iphone bricked right away, people would be blaming the unauthorized repairman.

That is not factually correct. Look at my post above. Errors occurred three years ago if the tech didn't pair up the new sensor with the A7 chip. Only an Apple tech could do that.
 
  • Like
Reactions: LV426
That's semi-true however there is no fix in case. In the case of the car you can get a proper key from the dealership. Plus you don't need TouchID for a functional phone as it's an extra feature and the phone works properly without it.

But you would pay the dealership for the proper key that must be used. Same with those named in the Lawsuit... they should pay Apple to fix the error because the phone should not have been opened in the first place.
[doublepost=1455288928][/doublepost]
Considering some of the users complainingg went to authorized repair locations and/or didn't even perform a repair, your rant is pretty much invalidated.

So then those people, would go to Apple and have the phone fixed free of charge. This suit is fighting for those who went to a third party repair location, that are not authorized to work on Apple devices, and trying to get their phone fixed.
 
I'm 50/50 on this, maybe its a bug I dont know. I will say this though, Apple is so big that they will be wrong no matter what they do. It comes with the territory. Look what happened because Tim Cook took a blurry picture.
 
After the lawyers take 80% of the cut, Apple will send out $25 vouchers toward the purchase of a new iPhone to those affected.

The only people who win in a class action are the lawyers.

No, you are wildly misinformed. Lawyers take is about 15%. The $ seems high because it's going to one source whereas the remaining 85% is being divided up by thousands, even hundreds of thousands, of class members. Keep in mind they lawyers filing the suit are paying 100% of costs and fees out of their own pocket. If they lose it's on them. They, not the class members are taking the risk. Also, any class member can opt-out from the suit and file their own suit, and also bear the costs involved.
 
  • Like
Reactions: Demo Kit
No, you are wildly misinformed. Lawyers take is about 15%. The $ seems high because it's going to one source whereas the remaining 85% is being divided up by thousands, even hundreds of thousands, of class members. Keep in mind they lawyers filing the suit are paying 100% of costs and fees out of their own pocket. If they lose it's on them. They, not the class members are taking the risk. Also, any class member can opt-out from the suit and file their own suit, and also bear the costs involved.

Also - and correct me if I am wrong - the settlement may or may not cover the devices. Apple may be forced to replace phone and pay for damages. I'm not saying it's likely - but the outcome may not just be cash.
 
  • Like
Reactions: Demo Kit
This lawsuit is a complete joke. Apple will just do whatever it takes to make the lawsuit go away because of the bad publicity. But look, it's simple folks...

Say Apple had a condition where if (X == Y), the result of that is true. This means the validity of the pairing between the Touch ID sensor and the CPU is okay. And in a later update, increases the strength of that condition by changing it to:
if (X == Y) && (A == B) && (C == D), which makes the result that used to be true, now false.

Then there is no case. That is how security is improved. And if the updates Apple releases are that strict to reject third-party Touch ID sensors to prevent "fake" parts, then I'm all for it.

I've witnesses first hand "Error 53." My cousin replaced his screen using a third party service. His home button worked but the Touch ID did not. When he updated his iPhone to iOS 9, he was displayed a "Connect to iTunes" screen which resulted in iTunes displaying "Error 53."

We took it to Apple and they said they would not be able to repair it, and instead they would need to replace the phone paying the replacement fee. They said the Warranty on the phone has been voided and repairs could not be made because the iPhone was opened by a third party. I ended up paying for a replacement phone for him.
 
Last edited:
  • Like
Reactions: LV426
I was watching Apples Super Bowl commercial "1984" yesterday, and was shocked when I realized that the text was all about Apples wision of the future (say now): Apple has become what it (told us) it was fighting against in 1984!
“Today, we celebrate the first glorious anniversary of the Information Purification Directives.
We have created, for the first time in all history, a garden of pure ideology.
Where each worker may bloom, secure from the pests purveying contradictory thoughts.
Our Unification of Thought is more powerful a weapon than any fleet or army on earth.
We are one people, with one will, one resolve, one cause.
Our enemies shall talk themselves to death and we will bury them with their own confusion.
We shall prevail!”

Oh the irony
 
Not every country has apple store or authorized repair centre. One of the first victims repaired his phone while he was on vacation.

Not to mention that 'authorized parts' aren't available for a very long time, and could be unavailable very soon after the item goes off the market. These people are literally arguing for hardware rentals.
 
  • Like
Reactions: Demo Kit
iPhone 6/6+ are out of warranty unless you purchased Apple Care.
Warranty has little to do with this for the 6/6+
Not everywhere. http://www.apple.com/uk/legal/statutory-warranty/
Under consumer laws in the UK, consumers are entitled to a free of charge repair or replacement, discount or refund by the seller, of defective goods or goods which do not conform with the contract of sale. For goods purchased in England or Wales, these rights expire six years from delivery of the goods and for goods purchased in Scotland, these rights expire five years from delivery of the goods.
 
Okay, perhaps English is your second language?

You constantly seem to confuse terms like "MAY cause damage" or "MAY void" to mean "WILL" do so. You also confuse "SHOULD use authorized" with MUST. The first forms are allowable by law. The second demand forms are normally not.



Backwards. The phone was not damaged until it was bricked. But I can see Apple's lawyers arguing your way.



Just to be clear: the sensor doesn't access anything. It's an input device, like a mouse. Your mouse does not access your hard drive. Nor does the sensor access the secure enclave.

The sensor simply sends print images to the CPU, which then copies them to the secure enclave to look at and possibly authenticate.

Sensor data -> CPU -> secure enclave -> authentication Y/N flag back to -> CPU

That's all. So no, the sensor cannot attack the rest of the phone directly. The security hole being presented is that if a evil sensor knows your real fingerprint, it can duplicate it at some other time for someone else. Of course, a much cheaper (and easier to do without being detected) fake finger also works, especially if you can follow and target someone.

I wonder if next Apple will brick laptops if you change the mouse or keyboard. After all, a malicious third party mouse or keyboard could remember your movements / keystrokes, and thus are security risks.



One of the possible arguments that Apple lawyers will use. But you know what? Sometimes that which is legal is still the wrong thing to do, both from moral and PR standpoints.
I have already corrected you in a different thread, so I'm really surprised you haven't taken in that information, as it comes directly from Apple.

For the love of God, read https://www.apple.com/business/docs/iOS_Security_Guide.pdf

You are spreading misinformation.

The secure enclave does FAR MORE than authenticate fingerprints.

Some quotes:

"ACLs are evaluated inside the Secure Enclave and are
released to the kernel only if their specified constraints are met."


"When a file is opened, its metadata is decrypted with the file system key, revealing
the wrapped per-file key and a notation on which class protects it. The per-file key
is unwrapped with the class key, then supplied to the hardware AES engine, which
decrypts the file as it is read from flash memory. All wrapped file key handling occurs
in the Secure Enclave; the file key is never directly exposed to the application processor.
At boot, the Secure Enclave negotiates an ephemeral key with the AES engine. When
the Secure Enclave unwraps a file’s keys, they are rewrapped with the ephemeral key
and sent back to the application processor."


"To further discourage brute-force passcode attacks, there are escalating time delays after
the entry of an invalid passcode at the Lock screen. If Settings > Touch ID & Passcode >
Erase Data is turned on, the device will automatically wipe after 10 consecutive incorrect
attempts to enter the passcode. This setting is also available as an administrative policy
through mobile device management (MDM) and Exchange ActiveSync, and can be set
to a lower threshold. On devices with an A7 or later A-series processor, the delays are enforced by the
Secure Enclave. If the device is restarted during a timed delay, the delay is still
enforced, with the timer starting over for the current period."

"The One-time Unlock Token for attended software updates expires after 20 minutes.
This token is exported from the Secure Enclave and is written to effaceable storage. A
policy timer increments the counter if the device has not rebooted within 20 minutes."


So, from these examples, the secure enclave handles ACL enforcement, disk encryption, password enforcement, even with TouchID disabled, and software updates.

A compromised Secure Enclave compromises the entire phone.

Please inform yourself.
 
Last edited:
This issue is no different the the original Xbox... The motherboard and hard drive had to have matching ID's or it would fail to boot and not work. (Not using mod chips)

The morons should have purchased Apple care.

A persons stupid Mistake always ends up being blamed on somebody else....

Next some moron will sue because the Apple phone won't install android software.

Companies have a right to protect their product and end user. If that 3rd party Touch ID did keep working after the update how does that person know their finger print data and information wasn't being sent out to a botnet or host collecting data... With the way stuff has been nowadays... Maybe the 3rd party Touch ID has a new encrypting malware with would lock the phone down on its own...

Everybody whines about closed systems and proprietary equipment but there is a reason for it in today's world of data breaches and security issues.


A perfect example for epidemic Stockholm syndrome of "extreme Brand Loyalists"…

have a look:

https://en.wikipedia.org/wiki/Stockholm_syndrome



...
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.