One question: can I finish the setup of an M1 Mac without giving it an internet connection? As in, could I get it from unboxing to desktop without it sending a single network packet to Apple?
>According to the small print in Apple’s Platform Security Guide, when you set up a new M1 Mac, or set one up after restoring it in DFU mode, the primary admin account created is special: it’s the Owner account of that Mac. During that inital setup, the Mac sends a request to Apple for that Mac’s signed Owner Identity Certificate (OIC). This is based on a private key generated in the Secure Enclave known as the Owner Identity Key (OIK).
I'm not trying to imply that you're wrong at all, but I'm curious how the Mac goes about obtaining the OIC without a network connection.
The OIC, if I understand correctly, is an Apple vetted OIK which is created on-device.
This mainly would come into play, as the article says, if you install another operating system. By default, the OS is in Full Security mode, so it would contact Apple when installing the other OS and the OIC may come into play.
But if you aren’t installing another OS, or you set your Mac to permissive security which needs no internet, perhaps the OIC is not required because you’ve downgraded the security?
Im just speculating.
Still, somehow, the fact remains you can fully set up an M1 Mac without internet. The technicals of how it does this while reconciling that with the security guide is unknown.
There are three levels of M1 security, Full, Reduced, and Permissive. You can downgrade at any time without internet, but you cannot re-enter Full without contacting Apple over the internet.
You need to log into 1TR with a local admin account, which is used to prevent thieves from wiping the drive and reselling. This process apparently works even if macOS is damaged, meaning your account credentials are likely stored in the enclave which is persistent and has storage inside the chip.
"One True Recovery". It's a special recovery environment that the user enters when they hold down the power button on an M1 Mac. It looks identical to a standard recovery environment, but it allows you to do things turn off secure boot.
Yes, it's after reading this that I'm asking. I really don't like my own hardware phoning home without my explicit consent. Ideally I'd install a firewall before I first connect it to the internet, and I'd block *.apple.com by default.
To clarify, Home will not. But home is targeted to the non techy layman. pro / Enterprise will allow this. comparing window home to oax is like complaining that my Honda civic doesn't have the towing capacity that my f150 has. different class and purpose.
apple doesn't even have a comparable os to be compared to home, as it's a market they don't even target or develop for.
Yet it will be sold on laptops to anyone that buys them, even if the customer is a 'pro'. It's their prerogative, but I would rather see 'Want to set up with an offline account? Upgrade to pro now for $80'.
No, because of activation lock. Setup doesn’t differentiate whether it’s been wiped or not, and activation lock would be weak if a simple wipe could defeat it.
