I'm trying to figure out how you want this to work.

If your own laptop is stolen, you're no longer in physical possession of it.

So from the perspective of the laptop, some sort of interaction should brick it. What should that interaction be? It needs to happen early, before thieves have a chance to disable it. So it needs to happen before login, say. Really it needs to happen at either bootup or as soon as the laptop establishes a connection to the internet.

At which point it should... reach out to you? How? Must you own a second Apple device for that to work? Okay, let's go with that. You have an iPhone, and you use Find My to brick the laptop. So now someone can steal your phone and use it to brick your laptop? Your laptop needs to talk to your phone every time it boots up or connects to the internet?

I'm not sure you've thought this through.

It seems reasonable to me that the only entity that makes sense here is Apple. Even a savvy thief, who might block packets to anywhere unexpected--and "person's iPhone somewhere" is definitely unexpected--is going to need to let packets go to Apple, making them the only party with the means and opportunity to do this.

> So from the perspective of the laptop, some sort of interaction should brick it. It needs to happen early, before thieves have a chance to disable it.

Not really. Encrypted data on the drive, password protection to get in should be enough. If the password implementation is top notch it essentially is a brick to anyone not in the know — time will be of no use to them.

The idea here is to prevent theft for resale - nobody needs your vacation photos. you'll erase it and sell it for $$$$$

And how do you think Apple implements their anti-theft functionality?

It's really not that hard to design a system that will become essentially a brick when the password is lost. E.g. just put some flash memory on the main processor chip that partakes in the encryption of the harddrive.

Which sounds like the Secure Enclave.

Obviously, the laptop contains some bytes somewhere which refer to Apple.

Just make those bytes point somewhere else (assuming Apple allows you to), and run a server at that location and you're done.

What is the problem?

Off the top of my head: if you can change those bytes, sophisticated thieves can change those bytes, and eventually anybody buying a kit on the open market can change those bytes.

Also, as I previously mentioned, sophisticated thieves can block traffic anywhere other than Apple by default.

> from the perspective of the laptop, some sort of interaction should brick it

Yes, that is the sales scenario for remote lockout. Its kind of lame, like "if I can't have my thing then nobody else can either and it becomes e-waste," and also depends on a crook being smart enough to realize this valuable looking thing has no resale value.

Now run out the scenario where you are the Canadian truck driver or in some other politically unpopular position and getting progressively locked out of stuff. Maybe the feds start leaning on Apple like they do to debank state-level authorized herbal commerce. Maybe some other entity gets into Apple's system and holds your computer hostage. It seems like the wrong direction for computing devices.

You are in control. You attaching your account to it is what is bricking it for anyone else. You can always remove your account from it and hand it to another entity. The only thing Apple is doing in these cases is saying no to letting someone else remove your account/mdm association.

No, Apple is clearly in control by being the only possible provider of accounts.

For example I could run my own account/password system, and lock my own phone if it is stolen. Or transfer that right to another organization.

Saying that "vendor can remotely brick the phone" is the only way to have this functionality is not true.

Good thing I didn't say anything about the vendor locking the phone is the only way. Apple designed their system and yes, they do have control. It's also a good thing that Apple has delegated the ability for you to lock/unlock your own phone when you want.