Error 53: How Apple Can Make It Right Without Sacrificing Security

Last week, Apple appeared to have a simple message for people who ran into a mysterious iPhone-killing bug known as Error 53: You probably shouldn’t have gone to an unauthorized repair center.

As The Guardian recently documented, Error 53 has rendered thousands of iPhones useless without warning. In many cases, users went to third-party repair shops to fix broken screens or faulty home buttons. Only later did those users discover a hidden security measure that activates when an iPhone’s Touch ID fingerprint sensor has been tampered with, preventing the phone from working after a restore or iOS update.

In Apple’s view, Error 53 isn’t so much a bug as it is a way to protect against malicious fingerprint sensors, which might aid in stealing sensitive information. “When an iPhone is serviced by an unauthorized repair provider, faulty screens or other invalid components that affect the Touch ID sensor could cause the check to fail if the pairing cannot be validated,” an Apple spokeswoman told The Guardian.

It’s hard to blame Apple for erring on the side of caution with fingerprint data. But expecting all iPhone users to avoid third-party repairs is to ignore reality: Not everyone is able to pay what Apple charges for repair or replacement, and those who can may still prefer a local repair shop to sending their phones away if there’s no Apple Store nearby.

Shouldn’t there be a way for Apple to balance the importance of security with the inevitability of third-party repairs? Perhaps, but it won’t necessarily be easy.

The Simpler Way: Let iPhones Work After Touch ID Breaks

Shutting down Touch ID does make sense as a protection against tampering. That kind of response is already standard practice in other industries, such as banking, that rely on special hardware to encrypt data, says Rich Mogull, CEO of security research firm Securosis.

“I am sure if [Apple] didn’t do something like this, at some point we’d be hearing stories of stores adding hardware—unscrupulous iPhone repair shops—and maybe not as much here in the U.S., but most definitely overseas,” Mogull says.]

But just as several other industry observers have wondered, Mogull isn’t sure why an iPhone can’t keep functioning without its fingerprint reader after the Touch ID connection fails. Instead of disabling the phone during a restore or system update, perhaps Apple could explain in an error message that it can’t read the Touch ID sensor, and that users must contact Apple support to bring back any fingerprint-related features.

So far, Apple hasn’t explained why this isn’t possible, and no one’s turned up any evidence for why the phone should refuse to boot after a system restore or iOS update.

One theory is that Apple would have needed to design its hardware to work around a Touch ID failure, otherwise it may be left open to some kind of vulnerability. Mogull speculates that Apple might be concerned about someone being able to break into an iPhone using specialized hardware which bypasses the sensor.

Still, others are skeptical that there’s any risk to leaving the phones alone. Jessa Jones, who runs an iOS repair shop in upstate New York, recently noted in a blog post that today’s aftermarket home buttons don’t come with fingerprint sensors at all, and until Error 53 kicks in, all other phone functions continue to work properly. Even if a malicious sensor existed, Jones wrote, it would need “the magical ability to somehow trick the CPU into thinking it was the original sensor” so that Touch ID functions would work again.

Kyle Wiens, CEO of do-it-yourself repair resource iFixit, says he also hasn’t found any reasons for why the iPhone should stop working without Touch ID. “I’m sure they didn’t think or realize that it was going to be this big of a deal,” Wiens says. “I would put it more in the category of a bug.”

The Complex Way: Build A Better System For Touch ID Repairs

Although Wiens doesn’t ascribe Error 53 to maliciousness on Apple’s part, he’s still frustrated by the situation. In his view, users who want to restore their iPhone’s finger-sensing capabilities should be able to do so on their own terms, whether that means a do-it-yourself repair or a visit to a trustworthy repair center.

When Error 53 occurs, Wiens says, it’s usually because there’s a mismatch between the Secure Enclave (a component that encrypts sensitive data and walls it off from the rest of the system) and each iPhone’s unique electrical pattern formed by Touch ID’s button actuator and flex cable. He speculates that a software tool could reestablish the connection, and figures Apple could make it available to users and trusted repair shops. (Jones, the repair specialist, suggests in her blog post that Apple uses a hardware tool, which would make things vastly more complicated.)

“This is kind of the same thing as re-keying a lock,” Wiens says. “If you lose all your keys, you go to a locksmith, and they say ‘Okay, I’ll make new keys for you.’ You’re not going to throw away your door because you lost your keys.”

Still, it’s easy to speculate why Apple hasn’t gone that route. The company doesn’t sell standalone components such as the Touch ID sensor to users or repair shops. Besides, Apple’s entire justification for Error 53 is to protect against malicious repairs. Determining which repair shops are trustworthy enough to handle Touch ID replacement would be a significant undertaking.

But to Wiens, this just speaks to a larger issue, that the company needs to put more thought into supporting a third-party repair ecosystem: “Apple has pretended as if the repair ecosystem doesn’t exist. They don’t provide parts, they don’t provide information,” Wiens says. “I think they have intentional ignorance of what their customers are doing at mass scale.”

Wiens draws a parallel to the automotive industry, whose vehicles have increasingly become difficult to repair without proprietary diagnostic tools. Thanks a 2012 Massachusetts “right to repair” law, automakers are now hashing out ways to share their tools and information with trusted, independent technicians. Wiens has been advocating similar legislation for electronics, and Error 53 happens to provide the perfect platform for discussion.

“There is an established best industry practice for this in automotive and locksmithing,” Wiens says, “and Apple’s initial reaction to this isn’t going to be in their best interest in selling these devices.”

The History of Apple (in Under 3 Minutes)