As long as the people using fake serials are a small group of hackers, developers, etc. who are hardcore Apple fans in the first place and merely building things for personal use, I can see Apple intentionally turning a blind eye.
But once that starts getting abused to build a consumer product at scale, it becomes a whole different story.
And I have to imagine it becomes difficult when dealing with old devices, 99% of which have long since been thrown out or recycled, and those serial numbers are ripe for re-use, but there are still people using 10-year-old iPads.
> If it isn't, why doesn't Apple do this
You piqued my curiosity with your example, though.
10-100s of people logging into the same Mac with their Apple ID?
Is that possible?
I thought there was a 1:1 mapping of, say, Apple ID signed into ID : *NIX account.
Does OS X have something more ephemeral these days? That would be fantastic for shared computing.
I was able to log in to any of the Macs in the computer rooms on campus at my university using my regular Unix username and password.
UIDs go as high as 2 billion on macOS as well (they're signed 32 bit integers), which should fit even the largest institutions even without aliasing of local UIDs to directory server names.
A database isn't enough. They'd also need a way for that device to attest its identity to Apple, and serial numbers can be relatively easily copied (or sometimes even brute-forced).
This should be possible for newer devices using Apple's own chips, but I believe that at least non-T1/T2 Intel Macs lack any such capability.
> Why don't they check "is this device sitting on a shelf un-sold or does it belong to this account, activated"?
How would they know this? I highly doubt that every retailer in the world reports sold devices' serial numbers to Apple.
You are correct about pre-T1 Intel Macs though. Apple will have a blind spot by design, until support is dropped for old machines.
I’m confused by the pathway where paying apple can be skipped.
You do not pay for this. You would like to, I’m sure.
edit: I mean hell, i certainly don't pay Apple for hardware. You might argue i do, but i don't actually have access to the hardware - right? It's not like a PC where each component has value to me, that it's documented and hackable, etc. Nono, you buy the suite - everything, when you buy an iPhone. If not for iOS, iPhone is a nearly useless undocumented brick.
And it's still nowhere near what you are asking for. What exactly is "validating" a serial number? Are you saying users need to present receipt of purchase? Does the store need to provide proof? Maybe Apple validates by getting access to you bank statements? How are these proof of sales tied to individual specific devices?
This feels like clutching for certainty. Maybe Apple can have such a tight & narrow sales model, can get every cell phone company managing their inventory with vastly tighter inventory control (tracking which specific devices are ss) than anyone has ever done before. Maybe Apple can pull it off.
Should they? Do they want to be subject to various governments asking who bought which device? Do they want to spend the time updating & maintaining these listings? Are they ok pissing off devs hackers & other enthusiasts who get steamrolled by these changes? Apple can form & deploy the Imperial Royal Guard over their products if they really wanted to, I have scant doubts, but the costs of forming that chain of control, cost of maintaining that database, and the liability of owning such rich data about their users in the current legal climate all seem like colossal prices to pay.
https://learn.jamf.com/bundle/jamf-now-documentation/page/Us...
So Apple can maintain this database but they still have the problem of proving that a serial number attestation, sending all the right information, is from that actual hardware and not a spoof of the hardware.
Without intensely protected cryptography like the T1/T2 enclaves, there is nothing legitimate hardware can send that can't be mimicked once the protocol is reversed. Maintaining a stricter database of unsold and destroyed products can only slow down activation, not stop it.
That means Apple would have to use other means to determine whether an attestation is valid like number of sign-ins, locations, the user trying to sign in, etc. If it enforces any of these, it will lock out and anger more legitimate users than it will block Hackintoshes and Android iMessage clients.
Hopefully that makes sense. Apologies if this is a repeat of previous answers.
Most Hackintosh users use a plausible, but non-legitimate serial number. The community has found it immoral to potentially cause issues to random people by using their device’s serial number and that is why they stay away from it and tutorials typically instruct against it.
Doesn’t mean it doesn’t actually happen, but I’ve seen only a handful of people who openly admit to it.
> So Apple can maintain this database but they still have the problem of proving that a serial number attestation, sending all the right information, is from that actual hardware and not a spoof of the hardware.
It’s actually quite easy for them to infer due to the simple premise that a physical device can’t be in two places at once, coupled with other behaviors and it’s pretty easy to nail down which device attributes are being exploited for this purpose.
The only hard part would be to determine which is the actual device and which is the fake one, if there’s no activity that predates the spoofing.
All in all it’s a safe assumption that a very low number of devices have their attributes abused for spoofing (easily single digit percentage) and at a certain point Apple might find it more desirable to inconvenience the owners of these “donor devices” by locking things down and having them contact support, than to let the spoofing go on.
I think that point might be nearer than we think. Already Apple seems to have no qualms to ban Apple IDs of legitimate customers who entirely legitimately have bought gift cards and loaded them up on their account, on the simple premise that their algorithm flags accounts that top up more than $1k as suspicious.
Both Apple Store geniuses and Apple Care support personnel can easily establish in a minute or so if you have possession of the actual physical device and take actions accordingly.
> Without intensely protected cryptography like the T1/T2 enclaves, there is nothing legitimate hardware can send that can't be mimicked once the protocol is reversed.
True, without a Secure Enclave, device attestation will never be airtight. But it might be that Apple might drop iMessage support for older devices, or more likely, between older and newer devices, in due time like they did with FaceTime.
iPhone 5s and newer had them so there aren’t many iPhone left behind if they upgrade the protocol. Same for iPad Air and Apple Watch Series 1.
2016 was the first time MacBooks were introduced with T1, in a few years that’ll be a decade ago. I could see them upgrade the protocol by then and leave older devices behind.
I wonder if that’s an AML thing? Buying apps from a small (15%) developer account using gift cards (paid with cash) could be an efficient way to clean money. I would guess that the number of legitimate customers inconvenienced by a $1k heuristic is fairly small.
In almost all described cases they claim that they used legitimate gift cards bought or gifted to them in an effort to purchase an Apple device.
I have my doubts about the veracity of some of those stories, but assuming everything is aboveboard and truthfully conveyed, I think $1k might be a bit too sensitive for a company that sells a lot of hardware that’s priced above that.
It might also be more prevalent nowadays because App Store funds and Apple Store funds used to be separate, they merged the balances not too long ago.
Apple essentially uses a scoring model. The legitimacy of your device is only one part of the score; your Apple ID and its history and standing is another. Those and other factors are calculated into a score, and if you meet the threshold, you can use iMessage. Think of it as a credit score.
Before the Beeper saga, I haven’t looked into it since Hackintosh users have found that Apple will allow you to use iMessage with clearly spoofed device attributes as long as your Apple ID is in good standing and not brand new.
Why they did is anyone’s guess.
The leading theory has always been that, based on your Apple ID activity, they considered you a valuable customer. They didn’t think it was worth the hassle and potential backlash to block you despite using spoofed device attributes.
But it’s just that, a theory. And nothing is stopping Apple from tweaking its score threshold.
You don’t want malicious actors that are poking and prodding to take notes.
But CS tends to be pretty friendly about it, even when you clearly tried to pass off a BS serial as real, so there’s that.
When you log in to iMessage and the various underlying protocols/services, you do it with an Apple ID. Is that Apple ID tied in a one-to-many (but you need at least one) fashion of registered, active, non-flaged-stolen, checked-for-legitimacy hardware IDs/serial #s?
If it isn't, why doesn't Apple do this? Don't they have a database of every device they've sold?
Why would their APIs that handle auth accept something that looks a real serial # instead of an actually real validated serial #? Why don't they check "is this device sitting on a shelf un-sold or does it belong to this account, activated"?