How important is Apple T2 Security Chip ?

[BigBoy2018]

Nope.

Assuming someone gets past my motion activated cloud security cameras, deadbolt, cloud connected security system with battery and cellular backup, locked studio door, and FileVault encryption—I’m probably dealing with bigger problems like “Why does a state-sponsored actor want to get at my photography and design files so badly?”

Didn’t even factor into my buying decision for a second. As a matter of fact given some of the issues people have had with it, I’m glad I don’t have it in my new iMac.

BEST post of the week. For the love of god, I have no idea why the hell people are so jazzed about getting that stupid T2 chip.
It's another element of complexity that could be yet another 'problem' point, it prevents any upgrading of the hard drive/ssd, and the so-called 'security' it provides is not something most of us need or want.

Bring on the pro-T2 chip junkies, I'm sure they'll chime in with how a state-sponsored agent is out to get us all. My ex-wife who suffered from paranoia schizophrenia would probably LOVE the idea of the T2 chip.

 

[macduke]

BEST post of the week. For the love of god, I have no idea why the hell people are so jazzed about getting that stupid T2 chip.
It's another element of complexity that could be yet another 'problem' point, it prevents any upgrading of the hard drive/ssd, and the so-called 'security' it provides is not something most of us need or want.

Bring on the pro-T2 chip junkies, I'm sure they'll chime in with how a state-sponsored agent is out to get us all. My ex-wife who suffered from paranoia schizophrenia would probably LOVE the idea of the T2 chip.

I mean, additional security is always welcome, but not when it's a glitchy mess. Especially when it's in a desktop that is parked in my house. It's nice to have more security in a device I might lose, but I'm never going to misplace my iMac, lol.

In the next few years Apple is going to ditch Intel anyway and replace it with their own chip, and that will be able to do security on its own, therefore less complexity.

 

[deconstruct60]

https://www.apple.com/newsroom/2018/10/new-mac-mini-packs-huge-punch/

2x , 3x , 4x times improvement would mean results that are 100% , 200%, 300% faster than testing. 10x even higher. 30x even higher still. Apple also doesn't particularly say that 30x is relative too.


I think the Apple hype machine spun a little out of control in the Mini context on the HEVC encoding stuff. In other Macs with a T2, the built in camera is directly hooked to the T2 chips. That specific video stream compressed to HEVC extremely fast... that's probably true. Stuff that is on the disk and needs to be loaded into Memory and then back to the T2 ... I don't buy that. Especially at 30x ( some directed DMA transfer from disk by T2 to encoding by T2 and then back to the disk again perhaps. ).
[doublepost=1553200862][/doublepost]

https://larryjordan.com/articles/video-compression-speed-test-imac-vs-mac-mini/

This testing write up makes not mention of the T2 at all. In fact,

"...
EXECUTIVE SUMMARY

• The 6-core i7 Mac mini is significantly faster (about 40%) for video compression than the test 2017 iMac
• Almost all video compression is CPU-based.

...."

CPU based, not "out of the CPU based".

Other extremely salient point...

"... The i7 is multi-threaded, which yields faster results than an i3 or i5 Mac mini at the same clock speed. This Mac mini is also running the latest version of macOS. ...
... This is the 27″ iMac I used for testing. It is 4-core Intel i5. While it has a faster clock speed, the i5 is not multithreaded. This will prove to be significant in the tests. ..."

The i7 can runs more decode and encode processes concurrently than the specific iMac being tested here can. They are both . The 2017 iMac is running a Gen 9 iGPU with the tech to do HEVC. The 2018 Mac Mini has the same gen 9 baseline tech (CPU labeled "Coffee Lake" but GPU didn't have huge changes). ( perhaps clocked a bit faster but same fixed function logic for HEVC seconding at 8-bits).

If the i5 has to switch back and forth between decoding and encoding then while the i7 ran both at the same time you'd expect to see the i5 to hit around the 50% mark in relative performance.

And what was the general results of this testing????? Go back and look at the first quote. About 40% faster. The Symmetric Multi Threading (SMT) [ or as Intel marketing term goes Hyperthreading] isn't performance. There is some overhead when the latency reads don't open up a big enough window for the "other thread" to get work done while the its partner gets work done.

Just like the testing commentary says.... the SMT makes a difference here. If the T2 was 300-600% faster then you'd see at least one of these multitude of decode/encode tasks top the 100% mark. None of them do. zero , zip, nada.

There is no evidence here for the T2 making a big impact here at all.

 

[SecuritySteve]

The prime purpose of the T2 chip on the Mac Mini is security - Secure Boot makes sure that only a legitimate, trusted operating system loads at startup. It also serves as a mass storage controller that includes a dedicated AES engine that encrypts your drive regardless of whether you have FileVault on or not. And if you do use FileVault, it makes the initial encryption process significantly faster. And it has been reported that SSD performance is superior on T2-equipped machines.

The T2 also does HEVC video transcoding (h.265) significantly quicker so if you plan to Handbrake a lot of Blu-ray rips...

This should be all the explanation anyone needs for why Apple is using a T2 chip. It can accomplish some security tasks where no other hardware / software will, and it will speed certain tasks up that a good chunk of Mac users (video transcoding) use Macs for in the first place.

Is it a point of failure? Absolutely. Especially since it is (relatively) new. But having this kind of SSD controller on a logic board is probably a good feature to add, if only for speeding up AES encryption process offloading. I wonder if perhaps Safari WebKit TLS could be optimized to use the T2 chip for AES certificate validation and message encryption ... That would be kinda neat.

 

[priitv8]

...and it will speed certain tasks up that a good chunk of Mac users (video transcoding) use Macs for in the first place.

This is exactly the place, where I am accounting Coffe Lake's built-in 10-bit HEVC encoder to be a much better performer than the one in T2. Which, apparently, only supports 8-bit encoding in hardware.

 

[nutmac]

BEST post of the week. For the love of god, I have no idea why the hell people are so jazzed about getting that stupid T2 chip.
It's another element of complexity that could be yet another 'problem' point, it prevents any upgrading of the hard drive/ssd, and the so-called 'security' it provides is not something most of us need or want.

Bring on the pro-T2 chip junkies, I'm sure they'll chime in with how a state-sponsored agent is out to get us all. My ex-wife who suffered from paranoia schizophrenia would probably LOVE the idea of the T2 chip.

I guess I am what you might call a "pro T2 junky".

My biggest criticism is the reason for omitting T2 -- HDD and Fusion drive. This is 2019 and iMac is a desktop computer. A T2-equipped iMac would've doubled the performance of SDD (using a trick similar to RAID 0 striping).

If Apple needs to offer iMac with HDD or Fusion drive for certain segment of customers, fine, continue selling older iMacs to satisfy their needs. But iMacs launched in 2019 should go all-in on SSD, and use T2 to maximize performance and security.

If you need larger storage, just get an external or network attached storage. This is a desktop computer.

 

[dimme]

The T2 issues are way overblown, as are most issues with Macs. I think it is very possible that the lack of T2 will shorten this iMac's supported life. Mojave in particular wants to be on an SSD and as more macOS releases come, I suspect more features will come to rely on the presence of a T2. At this point I would personally probably not purchase a new Mac without a T2.

I think having an intel chip is what will shorted a Mac life if the ARM rumors are true. Hopefully that a few years out.

 

[Cashmonee]

You may be right, although considering the number of non-T2 Macs out there, that shorter life may amount to a year, perhaps.

There's the question of what's meant by "supported life." The Vintage/Obsolete clock isn't modified by hardware considerations - 5 years Vintage, 7 years Obsolete, regardless. It comes down to macOS upgrades. Yeah, the lack of a T2 may be a dividing line at some point, if they decide that a particular T2-exclusive capability is essential to the functioning of the OS. Something security-based, I'd presume. I don't think transcoding or SSD handling would be sufficiently fundamental, but what do I know? Should that happen, it'll be a question of whether someone can upgrade from macOS 10.20 to macOS 10.21. As long as 10.20 works well and 10.21 doesn't contain a ground-breaking new capability, not a big deal.

The bigger potential hardware change in the next few years could turn out to be Intel vs. ARM. While there's no point delaying a Mac purchase until/if that happens, I'd expect it'll be the issue that'll be of the most concern to the owners of Intel Macs in 6-8 years.

I think having an intel chip is what will shorted a Mac life if the ARM rumors are true. Hopefully that a few years out.

You guys may be right, ARM Macs may be the bigger threat. Having said that we have no idea what the switch to ARM will look like if it even ever happens. Will it be all Macs or just the non-Pro line? Will they still be using macOS or will it be iOS? Is it possible that some of the higher end Macs stay Intel and a few of the lower end go ARM and iOS? No one knows.

What I do know is that the 2019 iMac is the only Mac other than the MacBook and nTB MacBook Pro (released in 2017) without a T2, and I suspect it will be the only one without a T2 once those machines are updated. That does not seem like something I would want to buy into.

 

[Anarchy99]

to me as a IT professional T2 is a annoying hurdle and thus a disincentive rather than a incentive.

for the average user filevault is sufficient encryption, secure boot is not really a issue and frankly its annoying just as it is on PCs, while i don't doubt there will be needs for the average person in some dystopian future its not now and as of now its only extra hurdles your IT person needs to jump over (or walk you through if they are talking you through a problem)

back to T2 specifically now that its the storage controller T2 just feels like the camels nose in the tent to further block user desires.
it will eventually lead to no more hackintoshing which is a problem as many pro users rely on those because of the years of inconsistent neglect we have had to endure at the hands of Apple.


i know this may seem to be over exagerated but this is how it starts

don't believe me just look at how apple is fighting right to repair:
not allowing people to buy parts or schematics as well as misrepresenting the issue and having customs seize parts from 3rd parties at the border.
making storage inaccessible to 3rd party IT (funny the only people who have access to the adapter for the lifeboat connector are Apple and there partners, all of which DONT DO DATA recovery, but even if we could use the connector its useless if something else on the logic board also needs to be replaced)
they block jailbreaking and sideloading on iOS
they make you jump through hoops like disabling SIP for low level OS access like installing drivers for nvidia cards and certain apps. etc.

theres more i can list but i don't feel llike continuing the rant, and yes im sure someone will point out the average user doesn't care about these things and thats where your wrong, they care because when something goes wrong they take it to someone who would care about these things to fix it

TLDR: T2 is theoretically fine, practically bad and is just one more sign Apple doesn't care about the Mac as we know and love it.

 

[EugW]

T2 is a great thing NOT to have.

I am very pleased Apple has released the 2019 6-core and 8-core consumer iMacs without T2. I had guessed that the last T2-less iMacs would be my 2017 4-core line, but Apple has given the 2019 6-core line a reprieve too.

It also suggests to me the possibility that the 2020 iMacs will come with T2 with a new form factor.

 

[BigBoy2018]

T2 is a great thing NOT to have.

I am very pleased Apple has released the 2019 6-core and 8-core consumer iMacs without T2. I had guessed that the last T2-less iMacs would be my 2017 4-core line, but Apple has given the 2019 6-core line a reprieve too.

It also suggests to me the possibility that the 2020 iMacs will come with T2 with a new form factor.

Couldnt agree more!

Once I have another year with my 2017 iMac I will almost certainly pick up a 6-core i5 3.7ghz 2019 iMac.

‘reprieve’ is the perfect word. I have one more Mac purchase to look forward to that’s not enchained by a T2 chip.

 

[partsofspeech]

This should be all the explanation anyone needs for why Apple is using a T2 chip. It can accomplish some security tasks where no other hardware / software will, and it will speed certain tasks up that a good chunk of Mac users (video transcoding) use Macs for in the first place.

Is it a point of failure? Absolutely. Especially since it is (relatively) new. But having this kind of SSD controller on a logic board is probably a good feature to add, if only for speeding up AES encryption process offloading. I wonder if perhaps Safari WebKit TLS could be optimized to use the T2 chip for AES certificate validation and message encryption ... That would be kinda neat.

As King’s Guard may think the King is unworthy, T2 may think it should be the better CPU.

 

[nutmac]

T2 is a great thing NOT to have.

I am very pleased Apple has released the 2019 6-core and 8-core consumer iMacs without T2. I had guessed that the last T2-less iMacs would be my 2017 4-core line, but Apple has given the 2019 6-core line a reprieve too.

It also suggests to me the possibility that the 2020 iMacs will come with T2 with a new form factor.

While I understand why the proprietary nature of T2 would make T2-less iMac more attractive for some customersI think doubling the performance of SSD storage as well as freeing up iMac's CPU from doing some of the chores, is a big enough win for majority of the customers.

 

[BigBoy2018]

While I understand why the proprietary nature of T2 would make T2-less iMac more attractive for some customersI think doubling the performance of SSD storage as well as freeing up iMac's CPU from doing some of the chores, is a big enough win for majority of the customers.

@EugW can chime in here, but we cant stress enough that all this talk about ‘better ssd performance’ fails to realize that there’s a law of diminishing returns when it comes to ssd speeds on benchmarks vs real world experience when it comes to everyday use.

Its our feeling that for the very small perceptable gain these super fast ssds actually give you, the downsides of the T2 chip is too much.

 

[nutmac]

@EugW can chime in here, but we cant stress enough that all this talk about ‘better ssd performance’ fails to realize that there’s a law of diminishing returns when it comes to ssd speeds on benchmarks vs real world experience when it comes to everyday use.

Its our feeling that for the very small perceptable gain these super fast ssds actually give you, the downsides of the T2 chip is too much.

Comparing iMac Pro vs. last generation iMac hints what you may gain if the latest iMacs were equipped with T2 (I am looking at HPFS iMac Pro vs. HPFS iMac). The differences are not always super dramatic, but they are far cry from negligible.

Forgot the link: https://macperformanceguide.com/iMacPro_2017-flashDriveSSD.html

 

[BigBoy2018]

Comparing iMac Pro vs. last generation iMac hints what you may gain if the latest iMacs were equipped with T2 (I am looking at HPFS iMac Pro vs. HPFS iMac). The differences are not always super dramatic, but they are far cry from negligible.

Forgot the link: https://macperformanceguide.com/iMacPro_2017-flashDriveSSD.html

Again, missing the point. The differences you see in bechmarks like that arent what you see in real world use. Things like launching apps, boot times, small file transfers (which is what you do most of the time) does not see a huge leap in PERCEPTABLE differnence.
Every time I try to explain that, someone like you comes back and shows me the benchmarks again.

Heres what I mean by ‘real world’: When I launch premiere pro off my apple blade ssd on my 2017 iMac, it takes 16 seconds to get to the project screen.
That same iMac also has a sata ssd installed (samsung 860 evo). When I launch the same version of premiere pro thats also installed on the sata ssd the time to the project screen is about 16.5 seconds.
Do you think that .5 seconds makes a big docference? I certainly dont.

Theres so many things that go into how fast a computer boots or apps launch, and the drive speed, once its even an average ssd, is fast enough that the computer is rarely ‘waiting’ on the drive ... its waiting on some other process that has nothing to do with drive soeed.

 

[nutmac]

Again, missing the point. The differences you see in bechmarks like that arent what you see in real world use. Things like launching apps, boot times, small file transfers (which is what you do most of the time) does not see a huge leap in PERCEPTABLE differnence.
Every time I try to explain that, someone like you comes back and shows me the benchmarks again.

Heres what I mean by ‘real world’: When I launch premiere pro off my apple blade ssd on my 2017 iMac, it takes 16 seconds to get to the project screen.
That same iMac also has a sata ssd installed (samsung 860 evo). When I launch the same version of premiere pro thats also installed on the sata ssd the time to the project screen is about 16.5 seconds.
Do you think that .5 seconds makes a big docference? I certainly dont.

Theres so many things that go into how fast a computer boots or apps launch, and the drive speed, once its even an average ssd, is fast enough that the computer is rarely ‘waiting’ on the drive ... its waiting on some other process that has nothing to do with drive soeed.

Your Premiere example is cherry picked because the task is not heavily I/O bound.

I mean, if I pick an example of copying a large file, which would show much dramatic difference, you would accuse me of doing the same.

I just don’t get why people are so happy with the omission when the only reason why Apple did was to keep HDD and Fusion in the line up. The use of T2 certainly has downsides some isolated segment of customers would be affected by. But the inclusion means most people would enjoy at least incremental performance increase (and for some operations, very meaningful one).

 

[BigBoy2018]

Again, missing the point. The differences you see in bechmarks like that arent what you see in real world use. Things like launching apps, boot times, small file transfers (which is what you do most of the time) does not see a huge leap in PERCEPTABLE differnence.
Every time I try to explain that, someone like you comes back and shows me the benchmarks again.

Heres what I mean by ‘real world’: When I launch premiere pro off my apple blade ssd on my 2017 iMac, it takes 16 seconds to get to the project screen.
That same iMac also has a sata ssd installed (samsung 860 evo). When I launch the same version of premiere pro thats also installed on the sata ssd the time to the project screen is about 16.5 seconds.
Do you think that .5 seconds makes a big docference? I certainly dont.

Your Premiere example is cherry picked because the task is not heavily I/O bound.

I mean, if I pick an example of copying a large file, which would show much dramatic difference, you would accuse me of doing the same.

I just don’t get why people are so happy with the omission when the only reason why Apple did was to keep HDD and Fusion in the line up. The use of T2 certainly has downsides some isolated segment of customers would be affected by. But the inclusion means most people would enjoy at least incremental performance increase (and for some operations, very meaningful one).

Ok. give me an example of an every day, common task where your super fastt ssd gives you a big benefit. I’ve given you a few where it doesnt (boot times, launch times, average size copy times. Are you transferring 100gb files all day long to equally fast drives? Thats the only time you’ll benefit from your super fast drive, unless I’m mistaken. So please give me a good example.

 

[xgman]

o please give me a good example.

It makes me feel better! I'm the buyer.

 

[mikehalloran]

The T2 chip provides a level of security not available in FileVault. Whether or not you need it is up to you.
[doublepost=1553617230][/doublepost]

For the love of god, I have no idea why the hell people are so jazzed about getting that stupid T2 chip.

Because you don't understand its benefits.

Among its many features, it allows you to link other T2 equipped Macs over 10G Ethernet to render huge AV files.

It is incompatible with some AV hardware that connects via USB 2—many audio and video/film pros still have to work with these tools. All kernel panic threads I've seen involve this. True, I have not read all the threads.

The 2019 iMac is a minor refresh of the 2017 when the 2015 acquired TB3. The 2015 updated the 2013 from PCIe 2 to 3 x4 (but Apple used the slower PCIe 2 blade). The 2013 replaced one of 2012 SATA III busses with PCIe 2 and so on... The 2019 is nice refresh, certainly but the architecture is unchanged from 2017 and little changed from 2012.

I'm still deciding among a souped up 2018 Mini, 2019 i9 iMac and iMac Pro. If my budget allows, it will likely be an iMac Pro.
[doublepost=1553617155][/doublepost]

Ok. give me an example of an every day, common task where your super fastt ssd gives you a big benefit.

If you did what I do for a living, you'd know. And no, I don't discuss that in public.

 

[priitv8]

I'm still deciding among a souped up 2018 Mini, 2019 i9 iMac and iMac Pro. If my budget allows, it will likely be an iMac Pro.

Mini is not in my shortlist, but as it seems, lack of HEVC 10-bit hardware encoder makes i9 iMac an obvious choice for my usecase.

 

[deconstruct60]

The T2 chip provides a level of security not available in FileVault. Whether or not you need it is up to you.
[doublepost=1553617230][/doublepost]Because you don't understand its benefits.

Among its many features, it allows you to link other T2 equipped Macs over 10G Ethernet to render huge AV files.

Thunderbolt v3 (TB) has some point to point networking capabilities. The T2 has no inherent networking capabilities. T2 happens to have shipped after Apple started shipping new Macs with TBv3 sockets, but they are coupled at a low level together. (e.g, if Apple dropped a T2 in the next MacBook and didn't change the case/body in any way then it probably still would not have TBv3 (and hence no n10Gb networking. )

It is incompatible with some AV hardware that connects via USB 2—many audio and video/film pros still have to work with these tools. All kernel panic threads I've seen involve this. True, I have not read all the threads.

It isn't via USB 2. It is specifically USB 2 provisioned directly by the Intel PCH chipset. The T2 is not directly connected to the USB 2 ports of the PCH on any block diagram I've seen, so it is somewhat of a mystery why folks keep blaming it as being the primary root cause. The driver sitting on top of PCH is more likely candidate. T2 may not be entirely uncoupled ( as it has some audio function that the PCH driver could get entangled with).

 

[Loops]

Until it is proven that it overrides the insecurity of Intel CPUs and any other components in the machine, it's not much of a security guarantee.

However, security for the "user" of the computer isn't the entirety of security. The Apple Lisa, for example, provided extra security for certain folks with its automatic serialization of floppy disks (which locked installation disks to a specific machine). This security could be seen as more insecurity for the "user" of the machine (in quotes because who is using what/who is becoming increasingly unclear these days), from a productivity point of view.

DRM is a philosophical quagmire.

 

[SecuritySteve]

Until it is proven that it overrides the insecurity of Intel CPUs and any other components in the machine, it's not much of a security guarantee.

However, security for the "user" of the computer isn't the entirety of security. The Apple Lisa, for example, provided extra security for certain folks with its automatic serialization of floppy disks (which locked installation disks to a specific machine). This security could be seen as more insecurity for the "user" of the machine (in quotes because who is using what/who is becoming increasingly unclear these days), from a productivity point of view.

DRM is a philosophical quagmire.

The ARM T2 chip cannot interface with the x86 chip's cache or RAM, and thus cannot prevent speculative execution or row hammer attacks. The security that the T2 chip provides is onboard SSD controller encryption (similar to your floppy disk Apple Lisa analogy) and boot volume security, if enabled. Otherwise the T2 chip serves as an SSD controller speed boost, and a process offloader.

 

[deconstruct60]

The ARM T2 chip cannot interface with the x86 chip's cache or RAM, and thus cannot prevent speculative execution or row hammer attacks.

Directly undoing defects in someone else's hardware is a litmus test for "good security device". It is more the case that whole scoping of the problem is way. off.

The security that the T2 chip provides is onboard SSD controller encryption (similar to your floppy disk Apple Lisa analogy) and boot volume security,

If also offers secure key and credential storage. Often that was the problem with the MDS/attacks is they are chasing sensitive information. One way of securing it is to not storage the master keys in RAM at all.

Even free of CPU defects, any code in the kernel and with root privs can see pragmatically everything anyway.

Implementing very good security consists of multiple layers. The T2 doesn't have to solve every security problem. The evaluation should be more so on does it add yet another secure layer to the system's defenses.

T2 does a bit more than Boot volume security. One of its primary purposes is to protects the boot firmware itself. That is data independent of the end user "storage disk" capacity it serves up. if the firmware isn't secure ( similar to trust corrupted kernel/root level) the whole system has security vulnerabilities.