Auto Erase for OS-X /?

[rdav]

As has been all over the news recently, current versions of iOS have an optional feature to auto-erase the device after ten failed password attempts. Which is a great iPhone security feature IMHO.

https://www.macrumors.com/2016/02/17/cook-open-letter-backdoor-fbi-san-bernardino/
Thanks Apple.

But is there anything like this for OS-X? A Mac laptop has the potential to hold far more data than an iPhone, which may be just as sensitive. And of course there are countless scenarios wherein the Mac device could be lost, stollen or seized... (And where remote-wipe is not viable).

I know there are some more complicated solutions out there, such hidden partitions etc. But it seems like a big problem in need of a simple solution, just like auto-erase for iOS. Even better, if deliberately entering a pre-set wrong password were to auto-erase all (or selected parts) of the Mac HD.

Cummon internet, help us out!

 

[ABC5S]

FingerPrint reading instead

 

[rdav]

FingerPrint reading instead

Not really -
http://www.zdnet.com/article/virgin...nlock-your-smartphone-with-your-fingerprint/#!

Oct 2014: "A Virginia circuit court judge ruled this week that smartphone users can be compelled to give up their fingerprint, but not their passcodes, allowing police to search their devices."

 

[leman]

There is already a much better solution for the which is called filesystem encryption. A password-based auto-erase accomplishes nothing because its trivial to bypass. To access your data, one would simply remove the disk and use it with an external reader. Or even boot your machine from an external drive.

 

[rdav]

There is already a much better solution for the which is called filesystem encryption.

Is there some reason why they could not be combined? That is, filesystem encryption & auto-erase /both. With the password errors being just one trigger. (And with FileVault enabled).

 

[leman]

Is there some reason why they could not be combined? That is, filesystem encryption & auto-erase /both. With the password errors being just one trigger. (And with FileVault enabled).

Well, sure, one could do this (technically), if you are attempting to boot from the very disk. If you use the disk as an external drive and try to crack it, not su much. Unless you want to build the encryption into the disk itself and let the drive firmware handle the auto-delete. This would require proprietary storage interfaces and people are already upset that Apple is using non-standard connector.

 

[NoBoMac]

Unless you want to build the encryption into the disk itself and let the drive firmware handle the auto-delete. This would require proprietary storage interfaces and people are already upset that Apple is using non-standard connector.

Or: can build future Macs more like iOS devices in that there is a Secure Enclave-like chip in it that holds the disk encryption key. But, we are back to add more proprietary stuff.

Then again, Android phones use TrustZone built into ARM chips for their Secure Enclave-ish function, and Intel implements something similar (TEE) in their processors, so, MAYBE can pull off a Secure Enclave without too much proprietary stuff. Then again, the "logistics" might be a bit tricky between OS, separate processor from Secure Enclave, and, how to implement re: boot vs up-and-running lock screen.

ADD: voted "no", because accidental or intentional erase is a good possibilty since the device might be a shared machine vs phone being usually tied to a single person. Full disk encryption with a strong, difficult for dictionary cracks password should be suffcient.

 

[rdav]

There are some great, technical responses here. But please consider another scenario.

You arrive at a dodgy foreign airport on business, perhaps wearing a fedora, when a Uniform demands that you hand over your Mac laptop & the access password. You reluctantly comply.

But the (alternate) p/w you give them quickly & automatically wipes all pre-specified (classified) areas from your HD. OS-X still appears to work normally, but the device no longer holds any private data - Just enough content, & embarrassing images, to make it all seem legit.

Of course there are many complex ways to circumvent this, but sometimes the world is not that sophisticated. Just as a criminal can break into any car, given time - but most will target the unlocked ones first.

 

[KALLT]

You arrive at a dodgy foreign airport on business, perhaps waring a fedora, when a Uniform demands that you hand over your Mac laptop & the access password.

You mean, like the US Border Patrol?

Even if it were implemented, a reasonably up-to-date customs agent will know that and make sure that such measures cannot be used. Remember: all it takes is a remote mounting of the (encrypted) drive to circumvent any runtime protections, like passwords and auto-erase functions.

I think it is even commonly advised nowadays to be careful when you take your electronic devices with you on a journey to the United States. It is better to rely on the Internet and a virtual private network to get your sensitive data across.

I am on the fence. I would not mind something like a Secure Element on a MacBook. Apple is on the path of glueing everything together already; it gas become really difficult to swap the hardware yourself. Why not go all the way then? As long as it remains optional to turn it on.

 

[leman]

You arrive at a dodgy foreign airport on business, perhaps waring a fedora, when a Uniform demands that you hand over your Mac laptop & the access password. You reluctantly comply.

I am quite sure that they would be aware of that functionality if it gets backed into OS X. So if a Uniform has interest in your data, they will simply confiscate your laptop, extract the disk and attempt to hack your encryption. In fact, it might make things even more difficult for normal people: right now, if you cooperate and give them the password, they might just be satisfied with it. With an auto-erase, they probably won't even ask a password but will confiscate the hardware right away (btw, its not even funny, our colleagues machine was confiscated in China because its drive was encrypted, and my other colleague was detained and questioned in an airport by the USA secret service because her linguistics conference talk was titled "Radical elements of aspect grammar in Chechen" or something like that).

 

[rdav]

The same principle could also apply to security-critical OS-X user Apps such as DevonThink or 1Password etc. That is, that multiple false attempts, or one deliberate one, would deliberatley erase all - As pre-set by the User. Perhaps requiring extra delays or authentication to restore from the Cloud (or not). And, of course, this security layer would apply even if the Mac HD were extracted.

 

[IowaLynn]

From the weird whacky: your device does what some law enforcement (odd, as I think breaking and bending the law fits better?) - installs malware to their system - I'm sure govt has gotten good installing their own backdoors - along the lines of Stuxnet