[salamandersauce]

Give me a break. A screen swap in a modern smartphone is not something you can do in a bar in the time it takes somebody to go the bathroom. You need tools like a heat gun to even get the things open which greatly greatly limits the scenarios where and when something like this could occur.

[dpkonofa]

Or, you know, you could just get access to the repair facility and compromise the phone that way...

[zepto]

Or just introduce compromised components into the supply chain to repair facilities…

[m45t3r]

Yeah, sure. Let me put millions to compromise a supply chain and get access to what thousands of people are sending on their WhatsApp accounts /s.

There is a reason why any type of security analysis needs to depend on your treat model. Unless the target is worth it, it doesn't make sense to do what you described.

Instead, millions of people lose a option of doing their screen repairs for cheap. And of course, Apple will have access to more money as always. But sure, security...

[dpkonofa]

What are you on about? All you'd need to do is find the place where your target is going and either bribe the teenager behind the counter or, depending on the value of the target, compromise the distributor from wherever the parts are coming. This is neither expensive nor difficult to do.

[m45t3r]

> All you'd need to do is find the place where your target is going and either bribe the teenager behind the counter or, depending on the value of the target, compromise the distributor from wherever the parts are coming. This is neither expensive nor difficult to do.

Sure you won't find strange that your smartphone disappear and appear later on, probably turned off (or at least asking for password) because I can't imagine someone doing this procedure with it powered on.

BTW, if you're really a so important target that your life depends on your phone not being tapped, you probably at this point would just throw away your phone and buying another, even if it is completely secure (that I am sure it iPhones isn't). I can imagine many other ways of compromising your privacy just by adding a small GPS tracker or something similar, and this way I don't even need to have access to the original hardware.

Now, of course only a small handful of people needs that amount of security. For most people, having hardware-level encryption of the data contents is fine, of course with trusted path with the bio-metric sensors so a just swap of parts doesn't give access to all its data. This level of security is available in any Android/iPhone. Anything else is just justification to allow Apples to earn even more money.

[zepto]

> only a small handful of people needs that amount of security

Everyone is vulnerable to fraud, identity theft, blackmail etc. Everyone needs a secure device.

If your argument is that insecure devices are ok for most people, you’ve already lost.

[zepto]

Who leaves their phone behind at a bar when going to the bathroom?