TL;DR: a repair shop owner from Germany managed to create a tool to calibrate the display angle sensor (used to trigger sleeping on Macs when the lid is closed)
TL;DR: a repair shop owner from Germany managed to create a tool to calibrate the display angle sensor (used to trigger sleeping on Macs when the lid is closed)
So, I do agree on anti repair vs not-pro-repair, and assuming you’re right about the calibration stuff (which seems possibly true by my understanding)…
Why do they serialize the biometric scanners? The only way that’d make sense was if the bio scanner was scanning, comparing to a registered scan, and then just giving the rest of the phone a thumbs up to unlock.
But as I understand, the biometrics are stored on the Secure Enclave within the cpu and the scanner is just a sensing device.
For your device to be compromised would require an attacker to reverse engineer the sensors output, have a model of your face to spoof, and for the device to be accepting biometric unlocking, which iPhones only do after having been unlocked via passcode.
There are a couple of concerns with biometrics.
The big one is, as you already mentioned, spoofing biometrics.
The FaceID or TouchID sensor essentially saying “I got that face/fingerprint that you have in your Secure Enclave”. Granted it is a sophisticated attack, but nevertheless one you’d want to prevent if only because it’s good practice to maintain a secure chain in which the individual links can trust each other.
For similar reasons the lockdown mode exists, which is mainly useful in limited scenarios (e.g. journalists, dissidents, etc).
On the other hand, if ever there was a potential attacker, it would be a government because they unlimited funds in theory and it isn’t hard to imagine the FBI trying to utilize this in the San Bernardino case if it was available.
A different risk, which would make the above quite a bit easier to accomplish, would be an altered biometrics scanner that, in addition to working the way it’s supposed to work, stores and sends off your biometrics or simply facilitates a replay attack.