2 HN users recommended this talk2 months2019–2022score 2
Years with an HN recommendation, 2007–2026
Recommended as a rare insider look at Apple's security architecture and the reasoning behind its hardware choices.
Ivan Krstic's Black Hat talk on Apple platform security, including the Find My design that uses elliptic curve key diversification to locate offline devices privately. It also covers hardware features such as the T2 chip and secure boot hardening.
“Good talk behind the reason for the T2 chip and some other Apple security stuff” (HN, 2019)
I'm curious if Apple's work on hardening their secure boot process on x86 affects this at all? For this unaware, this [0] video covers it over about seven minutes. Basically they claim to be enabling the IOMMU with a basic deny everything policy so that when the changeover to executing from RAM occurs and PCIe devices are brought up the IOMMU is able to deny possible malicious access to the firmware image. It sounds from the end of the article that there are separate DMA/IOMMU processes for the CSME, but I'm not familiar enough with stuff this far down to know for certain. [this video]
Seven-minute explanation of Apple's IOMMU-based x86 secure boot hardening.
Apple has been moving their defenses earlier and earlier in the boot process. According to this talk[0] they are even able to foil malicious option ROM[1] and other early boot attacks. I don’t recall if they mention boot passwords specifically, but they claim to lead the industry in this regard. [0] [this video] [1] [link]
Apple hardening early boot against option ROM attacks.
Apple (at least their security org) has done this before with their talks at Blackhat [1] where they've detailed pieces of their boot chain and interesting challenges they solved while building Find My's offline location feature [1]: [this video]
Apple security team details boot chain and Find My challenges.
Video list and Hacker News comment labels from HackerTube (prompted by @karpathy), released under ODC-By 1.0, built on the open-index/hacker-news archive. Hacker News data is provided by Y Combinator; comments remain the work of their authors. Video titles, channel names and thumbnails belong to their creators and are shown via YouTube. HackerTube Watch is an unofficial edition. Data export of 2026-10-31.
Plays via YouTube's privacy-enhanced embed
4 Hacker News comments
From the HN archive; up to 20 kept per video, favoring different commenters. Recommendations first.
Citations, criticism and jokes