Comment by bondarchuk
15 days ago
So you both thought about it for about 10 seconds and came up with some surface-level objections. Doesn't really prove anything when dedicated attackers with 10s of millions in potential profits are in play. Probably you would've written very similar dismissals about the idea of implanting a mini esim modem in a hardware wallet if someone would've brought it up back then.
Would be good if Apple (or anyone) could have some kind of user-verifiable supply chain integrity thing, if they don't already.
planting some very cheap microchips in a hw wallet that is mostly used by those who want to protect their wealth is a whole different thing from what you're suggesting
I would've not dismissed the esim thing
like you do realize the Apple store scenario isn't on the same level, at all? like, you'd have to bascially stalk your target figure out when they're gonna go buy an iphone at some specific store and have all the SKUs ready, all for that one job vs. this where you can buy and resell these things and the cost is materials + labor for implanting the thing and shipping costs, and you don't really have to even identify your victims because your customers are likely wealthy (to a degree at least)
There are ways of approaching this attack you're not currently considering. It simply won't work to go "here's how I would do this, that's impossible though, therefore this whole range of attacks is impossible".