Auto Erase for OS-X /?

Discussion in 'OS X El Capitan (10.11)' started by rdav, Feb 17, 2016.

?

Option to turn-on Auto-Erase, for OS-X devices?

  1. Yes, this would be fantastic, let's do it. Apple, anyone - Please.

    2 vote(s)
    25.0%
  2. No, my kids might erase all my stuff by accident, and backups are boring.

    1 vote(s)
    12.5%
  3. Dude, it's not necessary - other worthy options are already available.

    5 vote(s)
    62.5%
  1. rdav macrumors 6502

    rdav

    Joined:
    Mar 16, 2007
    Location:
    So/California.
    #1
    As has been all over the news recently, current versions of iOS have an optional feature to auto-erase the device after ten failed password attempts. Which is a great iPhone security feature IMHO.

    http://www.macrumors.com/2016/02/17/cook-open-letter-backdoor-fbi-san-bernardino/
    Thanks Apple.

    But is there anything like this for OS-X? A Mac laptop has the potential to hold far more data than an iPhone, which may be just as sensitive. And of course there are countless scenarios wherein the Mac device could be lost, stollen or seized... (And where remote-wipe is not viable).

    I know there are some more complicated solutions out there, such hidden partitions etc. But it seems like a big problem in need of a simple solution, just like auto-erase for iOS. Even better, if deliberately entering a pre-set wrong password were to auto-erase all (or selected parts) of the Mac HD.

    Cummon internet, help us out!
     
  2. ABC5S macrumors 68040

    Joined:
    Sep 10, 2013
    Location:
    Florida
  3. rdav thread starter macrumors 6502

    rdav

    Joined:
    Mar 16, 2007
    Location:
    So/California.
    #3
  4. leman macrumors 604

    Joined:
    Oct 14, 2008
    #4
    There is already a much better solution for the which is called filesystem encryption. A password-based auto-erase accomplishes nothing because its trivial to bypass. To access your data, one would simply remove the disk and use it with an external reader. Or even boot your machine from an external drive.
     
  5. rdav thread starter macrumors 6502

    rdav

    Joined:
    Mar 16, 2007
    Location:
    So/California.
    #5
    Is there some reason why they could not be combined? That is, filesystem encryption & auto-erase /both. With the password errors being just one trigger. (And with FileVault enabled).
     
  6. leman macrumors 604

    Joined:
    Oct 14, 2008
    #6
    Well, sure, one could do this (technically), if you are attempting to boot from the very disk. If you use the disk as an external drive and try to crack it, not su much. Unless you want to build the encryption into the disk itself and let the drive firmware handle the auto-delete. This would require proprietary storage interfaces and people are already upset that Apple is using non-standard connector.
     
  7. NoBoMac, Feb 17, 2016
    Last edited: Feb 17, 2016

    NoBoMac macrumors 6502a

    Joined:
    Jul 1, 2014
    #7
    Or: can build future Macs more like iOS devices in that there is a Secure Enclave-like chip in it that holds the disk encryption key. But, we are back to add more proprietary stuff.

    Then again, Android phones use TrustZone built into ARM chips for their Secure Enclave-ish function, and Intel implements something similar (TEE) in their processors, so, MAYBE can pull off a Secure Enclave without too much proprietary stuff. Then again, the "logistics" might be a bit tricky between OS, separate processor from Secure Enclave, and, how to implement re: boot vs up-and-running lock screen.

    ADD: voted "no", because accidental or intentional erase is a good possibilty since the device might be a shared machine vs phone being usually tied to a single person. Full disk encryption with a strong, difficult for dictionary cracks password should be suffcient.
     
  8. rdav, Feb 19, 2016
    Last edited: Feb 19, 2016

    rdav thread starter macrumors 6502

    rdav

    Joined:
    Mar 16, 2007
    Location:
    So/California.
    #8
    There are some great, technical responses here. But please consider another scenario.

    You arrive at a dodgy foreign airport on business, perhaps wearing a fedora, when a Uniform demands that you hand over your Mac laptop & the access password. You reluctantly comply.

    But the (alternate) p/w you give them quickly & automatically wipes all pre-specified (classified) areas from your HD. OS-X still appears to work normally, but the device no longer holds any private data - Just enough content, & embarrassing images, to make it all seem legit.

    Of course there are many complex ways to circumvent this, but sometimes the world is not that sophisticated. Just as a criminal can break into any car, given time - but most will target the unlocked ones first.
     
  9. KALLT macrumors 601

    Joined:
    Sep 23, 2008
    #9
    You mean, like the US Border Patrol?

    Even if it were implemented, a reasonably up-to-date customs agent will know that and make sure that such measures cannot be used. Remember: all it takes is a remote mounting of the (encrypted) drive to circumvent any runtime protections, like passwords and auto-erase functions.

    I think it is even commonly advised nowadays to be careful when you take your electronic devices with you on a journey to the United States. It is better to rely on the Internet and a virtual private network to get your sensitive data across.

    I am on the fence. I would not mind something like a Secure Element on a MacBook. Apple is on the path of glueing everything together already; it gas become really difficult to swap the hardware yourself. Why not go all the way then? As long as it remains optional to turn it on.
     
  10. leman macrumors 604

    Joined:
    Oct 14, 2008
    #10
    I am quite sure that they would be aware of that functionality if it gets backed into OS X. So if a Uniform has interest in your data, they will simply confiscate your laptop, extract the disk and attempt to hack your encryption. In fact, it might make things even more difficult for normal people: right now, if you cooperate and give them the password, they might just be satisfied with it. With an auto-erase, they probably won't even ask a password but will confiscate the hardware right away (btw, its not even funny, our colleagues machine was confiscated in China because its drive was encrypted, and my other colleague was detained and questioned in an airport by the USA secret service because her linguistics conference talk was titled "Radical elements of aspect grammar in Chechen" or something like that).
     
  11. rdav thread starter macrumors 6502

    rdav

    Joined:
    Mar 16, 2007
    Location:
    So/California.
    #11
    The same principle could also apply to security-critical OS-X user Apps such as DevonThink or 1Password etc. That is, that multiple false attempts, or one deliberate one, would deliberatley erase all - As pre-set by the User. Perhaps requiring extra delays or authentication to restore from the Cloud (or not). And, of course, this security layer would apply even if the Mac HD were extracted.
     
  12. IowaLynn macrumors 6502a

    IowaLynn

    Joined:
    Feb 22, 2015
    #12
    From the weird whacky: your device does what some law enforcement (odd, as I think breaking and bending the law fits better?) - installs malware to their system - I'm sure govt has gotten good installing their own backdoors - along the lines of Stuxnet
     

Share This Page