7 ms·

Windows 11: TPMs and Digital Sovereignty

107 points by jasondoty 3y ago

Bran_son 3y ago
> You’ve probably noticed that the marketing for this requirement is vague and confusing, and that’s intentional. It doesn’t do much for you, the consumer. However, it does set the stage for the future where Microsoft begins shipping their TPM on your processor. Enter Microsoft’s Pluton. The same technology is present in the Xbox. It would be an absolute dream come true for companies and vendors with special interests to completely own and control your PC to the same degree as a phone or the Xbox. Explains why official sites don't explain what the TPM is beyond "security" [1], nor that this "security" means "security against the owner" - though the computer is nominally yours, it's built to keep secrets from you. [1] https://support.microsoft.com/en-us/topic/what-is-tpm-705f241d-025d-4470-80c5-4feeb24fa1ee https://support.microsoft.com/en-us/topic/what-is-tpm-705f24...
- fuzzfactor 3y ago
  When Microsoft originally published a short page with their justification of the advantages of UEFI and GPT drive layout, everything touted as an advantage was false. As this was foisted and users became accustomed to the migration away from more well-proven traditional operation, the page was edited into oblivion as it could be seen users would have better recognized the falsehood by then after having some direct experience. So many "influencers" were already carrying the flag on their own that the page was eventually removed. TPM came next.
  - Cyphase 3y ago
    Do you know the URL of that page? Is it available on archive.org?
    - fuzzfactor 3y ago
      This was about 2012 to 2014. The page is long gone now but I definitely saved a copy because it was so blatant. Don't know how easy I can find it. May be on the Wayback Machine. It had recently become possible to bypass Windows 7 activation using "Windows Loader" (by DAZ), a sophisticated hacker tool which loaded the proper BIOS hardware key[0] not from the mainboard, but optionally from a replaced MBR sector 0 on the HDD which then pointed to a file containing a copy of the original sector 0, from which the non-W7 MB then could boot W7 normally without needing activation. GPT as "standard" and UEFI with Microsoft SecureBoot were then rushed out in time for the W8 release. Therefore almost all PC's newer than the ones "designed for W7" would require not only a complete HDD refomatting, but a more extensive complete repartitioning (MBR-style) before anyone could even try to install W7 or anything else other than what the PC originally shipped with. Seemed to me simply to make it more difficult to install W7 on all future PC's, which would turn out to be the main competition for W8 after all. Linux was not as much of a threat, but the collateral damage was not unintentional and set Linux PC and dual-boot approaches back at least two years. Now there is supposedly a hack that allows W7 to be installed on GPT volumes. One of the Microsoft claims was that one of the security "deficiencies" of MBR HDD layout not found with GPT was the unused sectors which padded the area from sector 1 up until the first sector of the first partition which is the partition's boot sector (usually up to sector 63 but at least sector 32 and sometimes 1024 or more). This normally unused area between sector 0 and the first partition's boot sector was a good place for GRUB to routinely use for its bootloader but had also been a location for the occasional "rootkit" that could not be removed by reformatting or often even repartioning (you would have to zero that part of the HDD using ordinary non-Windows tools, like a disk editor or dd in Linux). Also an optional location for Windows Loader. "Benefits" of GPT was that no sectors are unspecified, true but in practice sectors 5 through 31 are still never used unless you have created more than 8 GPT partitions on the HDD. You can also leave as much space in between GPT partitons as you would like (this is not the factory default), and Windows built-in tools can do the job. If you were on top of this and had a plain MBR mainboard with protection from flashing the BIOS, there was no way the mainboard itself could contain any kind of malware. If the HDD was clean, or fully zeroed, you were fine. With UEFI systems, which contain much more extensive and flexible firmware you were actually more subject to nefarious actions if any could be devised, which could then reside in the mainboard along with the UEFI firmware regardless how thoroughly you zero the HDD. This seems to have now become possible, maybe with the recent leak alone. With the slyly undocumented proprietary UEFI firmwares, it is also not too easy to know if "updating the BIOS" actually clears any possible malware that might be still lurking there along with the new factory firmware you put in. As far as I know there is no routine malware scan to check for compromised UEFI firmware like there has been for decades with HDD's. UEFI seemed to be very dependent on highly secret firmware keys never being revealed, otherwise I expected a UEFI MB would then be compromised in a way that BIOS MB's could not, and potentially much more difficult to detect & remove. [0] factory key code for the Windows version that originally shipped within a W7 PC mainboard BIOS so it would not require retail-OS-style activation, could then be used to freely activate W7 on older Vista PC's and expected to function on W8 PC's to come if they had regular traditional BIOS and MBR HDD layout. Almost like they knew in advance that W8 PC buyers would massively prefer to install W7 if they could rather than the original Windows 8.0.
- trympet 3y ago
  This is false. Here are technical docs on how the TPM is used: https://learn.microsoft.com/en-us/windows/security/information-protection/tpm/how-windows-uses-the-tpm https://learn.microsoft.com/en-us/windows/security/informati...
jimbob45 3y ago
I have to believe most of us here on HN are in the boat of keeping a W11 partition for work and a Linux partition for everything else at this point.
- Rimintil 3y ago
  > I have to believe most of us here on HN are in the boat of keeping a W11 partition for work and a Linux partition for everything else at this point. If statistics bear out, you'd be incorrect (at least with regards to a non-Windows OS being run by 'most').
  - saghm 3y ago
    I also imagine I'm not the only one who doesn't use their work laptop for personal stuff (even on a separate partition). At my previous job, I never even took my work laptop home, and in my current remote job, my work laptop gets booted up at the start of each work day and shut down at the end; I have my own devices for non-work use.
- hammyhavoc 3y ago
  I would like to think so too, but the reality seems to be a lot of Windows-only or macOS-only folks.
- navjack27 3y ago
  Nope. Least, not me. Windows 11 pro for workstations on my personal desktop. Linux in WSL2. Linux in docker.
- ldarby 3y ago
  If Windows is required for work then you've already lost. Seriously I'm unable to be productive in Windows (or Mac, I tried). I don't know what the stats are on employers requiring Windows but my current one doesn't (mainly because of a sizable chunk of Mac users, not that there's any support for Linux).
  - bmurray7jhu 3y ago
LocalH 3y ago
(2021)
emily-c 3y ago
>Did we mention that a TPM isn’t going to protect you from UEFI malware that was planted on the device by a rogue agent at manufacture time? DRTM, a technology supported by Windows 11 that is layered on top of the TPM, aims to solve this very problem.
- hlandau 3y ago
  Except that it can't actually do that, because x86 DRTM doesn't remove SMM handlers installed by the system firmware, ACPI tables also remain resident and could be changed to contain malicious code, etc.
  - emily-c 3y ago
    DRTM does not remove any malicious firmware provided code or data. Traditionally it is merely a measurement mechanism that happens after ExitBootServices which measures platform state in an unforgable manner. Practically the DRTM event can also cause certain chipset registers to get locked or SMM supervisors to get launched depending on the platform. SMM and ACPI tables (on some x86 platforms certain tables are rebuilt) are measured into a PCR by the secure loader or security processor during the DRTM event. The idea is that if malicious code or data was present then the PCR values wouldn't match the previous boot session and TPM secrets wouldn't unseal. While what you said is technically correct, it is by design and any compromised firmware can do as it pleases before the DRTM event at the cost of getting caught and having the device fail attestation or not be able to access encrypted data (depending on what policy is layered on top of DRTM itself as it is just a security primitive). By having PCRs get reset during the DRTM event secrets are much more reliably able to be sealed to specific PCR values.
    - hlandau 3y ago
      The claim that SMM is measured by (Intel) DRTM is interesting. Do you have any details on that? To my knowledge Intel was trying to solve this issue using the concept of an 'SMM Transfer Monitor (STM)' not simply by measuring the SMM environment [1]. But it's been 8 years since [1] was written so if you have links to more current information, it'd be welcome. [1] https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf#page=16 https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf...
tashian 3y ago
I agree with the sentiment of the piece, but I disagree with the idea that TPMs don't add much value for end users. TPMs were originally designed in the early days of ecommerce, when it became clear that home computers would need better security if they were going to be used for financial transactions. Today's TPMs don't have a lot of compute power, but they have a lot of features. It's just that we don't have that much software taking the best advantage of those features yet, probably because they have only just become ubiquitous in the last couple years. TPMs lay the groundwork for unphishable credentials, using hardware-bound asymmetric keys. TPMs add a user-friendly option for full-disk encryption, in a way that's resistant to physical attacks. TPMs can be used to protect symmetric credentials too, instead of storing them on disk (see systemd-creds TPM2 support). And, TPMs do have actual privacy mechanisms. End-user TPMs do not offer up their endorsement key to any third party. Attestation workflows shield third parties from the endorsement key. I'm excited for more widespread use of TPMs in Linux especially. Lately systemd has been making some good progress here.
- Gigachad 3y ago
  Seems like a lot of banking and other secure business is moving to mobile first or mobile only, presumably as it's likely the only secure device the user has.
  - DaiPlusPlus 3y ago
    I agree with your assessment: desktop-browser online banking (with US banks in particular) is a depressing experience given how they’re full of ads for credit-card offers and manual (if not broken) OFX/QFX downloads that only contain a fraction of the actual backend txn data that the banks won’t ever share with their (retail-banking) customers… And yet, while lots of banks now use SMS 2FA, none of the banks I use (Chase, BoA, Citi, and a couple of credit-unions) offer the far more secure TOTP scheme, let alone any way for headless clients to download txn data except via the literally-25+-years-old Quicken/Intuit OFX endpoints - presumably without 2FA, but with zero documentation in their online help and their retail banking customer support people have no idea what I’m talking about when I say OFX - it’s maddening, lots of banks’ legacy OFX endpoints are listed here: https://www.ofxhome.com/index.php/home/directory https://www.ofxhome.com/index.php/home/directory
EMM_386 3y ago
Wow ... I am getting old and jaded. I was so into locking down systems, making sure I knew where every packet was going, not trusting anything. Meanwhile I'm also "wardriving", phreaking with a red box, running an underground BBS ... all sorts of stuff. I had one of those fancy t-shirts with the export-restricted RSA encryption source code printed it. Because, why not? Now I just quickly skim a 2 year old article about Windows 11 and TPM again, on a Windows 11 device, and have just enough left in me to post a comment. > You see, the PC (emphasis on personal here) is in a way the last bastion of digital freedom you have. The TPM requirement of Windows 11 furthers the agenda to protect the PC against you, its owner. These keys are then cryptographically tied to the vendor who issued them, and as such, not only does a TPM uniquely identify your machine anywhere in the world, but content distributors can pick and choose what TPM vendors they want to trust. Every time these technologies come out, there are similar "it's all over" scenarios. But so far it hasn't been all over, and I've been around a while. I recall Intel Management Engine (ME) really piquing my interest for a bit. So my computer now has a computer running on it, that still runs when I turn it off, has access to the system hardware, including memory, the contents of the display, keyboard input, and the network? And the keys to the kingdom are secure ... they haven't been shared with anyone else who may be highly interested in having those ... ? Hello, anyone ... I'm still secure, right? ... right!? Forget it, I'll just disable it. Oh. Nevermind. Wait ... what? Intel ME has a ring −3 rootkit??! Just ... ah, forget it ... what's on TV? And then AMD shows up with their own. At least that one can be disabled by BIOS. I think? Hope? > Did we mention that a TPM isn’t going to protect you from UEFI malware that was planted on the device by a rogue agent at manufacture time? If you are the target of a rogue agent at manufacturing time, that is way past "game over". If they want it they're going to get it and you're not going to stop it by having, or not having, things like TPM on a Windows machine. I can't tell if this is more about losing the ability to watch HD video and DRM, or if nation states are coming after you. Those are slightly different. I'd personally prefer neither but I'd settle for the former. If it's security then it's more Tor/Tails and a USB key than Windows. Certain groups can even shut down highly specialized air-gapped equipment that is deeply underground. It's like "if there's a will, there's a way".
- frankzander 3y ago
  > It's like "if there's a will, there's a way". and that's one of the reasons I see no use in TPM. This is also a layer of complexity which usually is the opposite of more security. TBH I don't get it why people cheer this TPM and Secure Boot stuff as much.
judge2020 3y ago
The underlying point you should be calling out if you want to present this argument is that "User freedom should prevail over companies' freedom". The only thing attestation enables is companies enacting their own policies along the lines of "I only want users who are willing to let their device attest x level of security". The user is not required to use that service, they're not required to run W11 or to enable the fTPM in their BIOS. Asking for widespread change and the death of TPM attestation is like saying that companies should be forced to serve all customers even if it degrades the services they provide, if it requires x orders of magnitude more personnel for fraud/risk/etc management, or if it degrades the experience of other users on the service willing to perform attestation. Maybe this is the right approach, maybe we just need some good regulation that won't deepen the moat of existing players, but this is the crux of the argument being made. > We are here to remind you that the TPM requirement of Windows 11 furthers the agenda to protect the PC against you, its owner. No. It's to protect third party services that your PC makes network requests to. Your PC in itself doesn't need any protection from you.
- kmeisthax 3y ago
  Ok, so instead of Microsoft turning my PC into an Xbox, it's banks asking Microsoft to turn my PC into a credit card reader. This is not materially different. We already know how this works on Android. Attestation requirements and DRM tend to creep beyond their initial scope if implementing them is easy. And those requirements will include not having owner-level control over your machine[0]. If you root Android, you basically forefeit access to all banking apps, most gaming apps, and a whole bunch of things that you wouldn't even think should require secure attestation. On the web, we all thought that EME DRM was going to lock down web video and cascade into audio and text. This didn't come to pass primarily because DRM vendors charge money that free web video platforms don't have. If EME had made DRM ubiquitous, the best case would have been one distro vendor offering "blessed" kernel builds that can still "go online", and anyone wanting to be online with their own Linux kernel potentially violating DMCA 1201 or being limited to an increasingly shrinking "clearweb". There's three types of companies here: - People that absolutely need user-hostile attestation: banks, competitive multiplayer games, and streaming services - People that would never demand attestation on principle: normal websites, blogs, web forums, the Fediverse, and YouTube[1] - People who would implement attestation if it were available regardless of the impact on their user base: Facebook/Meta, Twitter, basically any social media network. That third group is arguably the largest. They will tolerate unattested users, but they wish they didn't have to. Making attestation easier makes it way more likely for them to demand it. [0] This could be made less onerous with per-partition boot policies, but only Apple Macs do this AFAIK. [1] YouTube's stance on DRM is very very weird. Google has the capability to DRM all their content, but they don't. And they've used YouTube as a trojan horse to push open standards like VP8/9 and AV1. On the other hand, they do try to obfuscate video download in ways that the RIAA thinks is DRM.
AraceliHarker 3y ago
One of the reasons why Microsoft and OEMs are promoting TPM is to encourage planned obsolescence, so that users will replace their PCs as often as they replace their smartphones, right? "(Lenovo) said people buy new smartphones every other year but became accustomed used to buying new PCs every six or seven years. The industry needs to do better at motivating people to buy new devices" https://www.cnbc.com/2021/10/05/microsofts-panos-panay-explains-balancing-surface-keeping-oems-happy.html https://www.cnbc.com/2021/10/05/microsofts-panos-panay-expla...
- api 3y ago
  Push local LLMs and generative AI then. That’ll require people to upgrade old machines.
- Gigachad 3y ago
  Tbh I'd expect the trend of upgrading phones to start to slow down as well as they become "good enough" but there are still pretty big gains being made in cameras. Laptops are just good enough now. If you took the 3 year old M1 internals, and stuck them in the new case and told me it was the 2024 model, I'd not notice anything was off.
  - barbariangrunge 3y ago
    Phones are locked down. All you need is a vendor to refuse further software updates after 5 years, after releasing a more resource-draining updates prior to this, and it doesn’t matter how good the old hardware is. People won’t be able to use it
- toastal 3y ago
  A capitalist economy predicated on infinite growth necessarily needs planned obsolescence to artificially churn consumption to increase growth (with new devices costing more). With public-traded companies bound to make profits for shareholders, this is no surprise.
G3rn0ti 3y ago
Regarding TPM’s security see also: https://gbatemp.net/threads/nintendo-reportedly-issues-dmca-takedown-for-switch-homebrew-projects-skyline-switch-emulator-development-ceased.632406/ https://gbatemp.net/threads/nintendo-reportedly-issues-dmca-... „ specifically, Lockpick bypasses the Console TPMs to permit unauthorized access to, extraction of, and decryption of all the cryptographic keys, including product keys, contained in the Nintendo Switch“
floatboth 3y ago
> Did you know that technologies such as Intel Boot Guard that have existed for the better part of a decade defend well against such attacks that might seek to overwrite flash memory? It's rather funny to see Boot Guard as a "good" example here. Boot Guard is what's actually taking freedom away. With a vendor-locked Boot Guard configuration, you cannot replace the firmware with anything not signed by the vendor. Bye bye dreams of coreboot (until a private key leaks like it just did ha ha). Netflix & co denying service to machines that don't pass Microsoft attestation? Literally who cares, just go to The Pirate Bay instead.
deleted 3y ago
[deleted]

107 points by jasondoty 3y ago

> You’ve probably noticed that the marketing for this requirement is vague and confusing, and that’s intentional. It doesn’t do much for you, the consumer. However, it does set the stage for the future where Microsoft begins shipping their TPM on your processor. Enter Microsoft’s Pluton. The same technology is present in the Xbox. It would be an absolute dream come true for companies and vendors with special interests to completely own and control your PC to the same degree as a phone or the Xbox. Explains why official sites don't explain what the TPM is beyond "security" [1], nor that this "security" means "security against the owner" - though the computer is nominally yours, it's built to keep secrets from you. [1] https://support.microsoft.com/en-us/topic/what-is-tpm-705f241d-025d-4470-80c5-4feeb24fa1ee https://support.microsoft.com/en-us/topic/what-is-tpm-705f24...

fuzzfactor 3y ago
When Microsoft originally published a short page with their justification of the advantages of UEFI and GPT drive layout, everything touted as an advantage was false. As this was foisted and users became accustomed to the migration away from more well-proven traditional operation, the page was edited into oblivion as it could be seen users would have better recognized the falsehood by then after having some direct experience. So many "influencers" were already carrying the flag on their own that the page was eventually removed. TPM came next.
- Cyphase 3y ago
  Do you know the URL of that page? Is it available on archive.org?
  - fuzzfactor 3y ago
    This was about 2012 to 2014. The page is long gone now but I definitely saved a copy because it was so blatant. Don't know how easy I can find it. May be on the Wayback Machine. It had recently become possible to bypass Windows 7 activation using "Windows Loader" (by DAZ), a sophisticated hacker tool which loaded the proper BIOS hardware key[0] not from the mainboard, but optionally from a replaced MBR sector 0 on the HDD which then pointed to a file containing a copy of the original sector 0, from which the non-W7 MB then could boot W7 normally without needing activation. GPT as "standard" and UEFI with Microsoft SecureBoot were then rushed out in time for the W8 release. Therefore almost all PC's newer than the ones "designed for W7" would require not only a complete HDD refomatting, but a more extensive complete repartitioning (MBR-style) before anyone could even try to install W7 or anything else other than what the PC originally shipped with. Seemed to me simply to make it more difficult to install W7 on all future PC's, which would turn out to be the main competition for W8 after all. Linux was not as much of a threat, but the collateral damage was not unintentional and set Linux PC and dual-boot approaches back at least two years. Now there is supposedly a hack that allows W7 to be installed on GPT volumes. One of the Microsoft claims was that one of the security "deficiencies" of MBR HDD layout not found with GPT was the unused sectors which padded the area from sector 1 up until the first sector of the first partition which is the partition's boot sector (usually up to sector 63 but at least sector 32 and sometimes 1024 or more). This normally unused area between sector 0 and the first partition's boot sector was a good place for GRUB to routinely use for its bootloader but had also been a location for the occasional "rootkit" that could not be removed by reformatting or often even repartioning (you would have to zero that part of the HDD using ordinary non-Windows tools, like a disk editor or dd in Linux). Also an optional location for Windows Loader. "Benefits" of GPT was that no sectors are unspecified, true but in practice sectors 5 through 31 are still never used unless you have created more than 8 GPT partitions on the HDD. You can also leave as much space in between GPT partitons as you would like (this is not the factory default), and Windows built-in tools can do the job. If you were on top of this and had a plain MBR mainboard with protection from flashing the BIOS, there was no way the mainboard itself could contain any kind of malware. If the HDD was clean, or fully zeroed, you were fine. With UEFI systems, which contain much more extensive and flexible firmware you were actually more subject to nefarious actions if any could be devised, which could then reside in the mainboard along with the UEFI firmware regardless how thoroughly you zero the HDD. This seems to have now become possible, maybe with the recent leak alone. With the slyly undocumented proprietary UEFI firmwares, it is also not too easy to know if "updating the BIOS" actually clears any possible malware that might be still lurking there along with the new factory firmware you put in. As far as I know there is no routine malware scan to check for compromised UEFI firmware like there has been for decades with HDD's. UEFI seemed to be very dependent on highly secret firmware keys never being revealed, otherwise I expected a UEFI MB would then be compromised in a way that BIOS MB's could not, and potentially much more difficult to detect & remove. [0] factory key code for the Windows version that originally shipped within a W7 PC mainboard BIOS so it would not require retail-OS-style activation, could then be used to freely activate W7 on older Vista PC's and expected to function on W8 PC's to come if they had regular traditional BIOS and MBR HDD layout. Almost like they knew in advance that W8 PC buyers would massively prefer to install W7 if they could rather than the original Windows 8.0.
trympet 3y ago
This is false. Here are technical docs on how the TPM is used: https://learn.microsoft.com/en-us/windows/security/information-protection/tpm/how-windows-uses-the-tpm https://learn.microsoft.com/en-us/windows/security/informati...

jimbob45 3y ago

I have to believe most of us here on HN are in the boat of keeping a W11 partition for work and a Linux partition for everything else at this point.

Rimintil 3y ago
> I have to believe most of us here on HN are in the boat of keeping a W11 partition for work and a Linux partition for everything else at this point. If statistics bear out, you'd be incorrect (at least with regards to a non-Windows OS being run by 'most').
- saghm 3y ago
  I also imagine I'm not the only one who doesn't use their work laptop for personal stuff (even on a separate partition). At my previous job, I never even took my work laptop home, and in my current remote job, my work laptop gets booted up at the start of each work day and shut down at the end; I have my own devices for non-work use.
hammyhavoc 3y ago
I would like to think so too, but the reality seems to be a lot of Windows-only or macOS-only folks.
navjack27 3y ago
Nope. Least, not me. Windows 11 pro for workstations on my personal desktop. Linux in WSL2. Linux in docker.
ldarby 3y ago
If Windows is required for work then you've already lost. Seriously I'm unable to be productive in Windows (or Mac, I tried). I don't know what the stats are on employers requiring Windows but my current one doesn't (mainly because of a sizable chunk of Mac users, not that there's any support for Linux).
- bmurray7jhu 3y ago

LocalH 3y ago

(2021)

emily-c 3y ago

>Did we mention that a TPM isn’t going to protect you from UEFI malware that was planted on the device by a rogue agent at manufacture time? DRTM, a technology supported by Windows 11 that is layered on top of the TPM, aims to solve this very problem.

hlandau 3y ago
Except that it can't actually do that, because x86 DRTM doesn't remove SMM handlers installed by the system firmware, ACPI tables also remain resident and could be changed to contain malicious code, etc.
- emily-c 3y ago
  DRTM does not remove any malicious firmware provided code or data. Traditionally it is merely a measurement mechanism that happens after ExitBootServices which measures platform state in an unforgable manner. Practically the DRTM event can also cause certain chipset registers to get locked or SMM supervisors to get launched depending on the platform. SMM and ACPI tables (on some x86 platforms certain tables are rebuilt) are measured into a PCR by the secure loader or security processor during the DRTM event. The idea is that if malicious code or data was present then the PCR values wouldn't match the previous boot session and TPM secrets wouldn't unseal. While what you said is technically correct, it is by design and any compromised firmware can do as it pleases before the DRTM event at the cost of getting caught and having the device fail attestation or not be able to access encrypted data (depending on what policy is layered on top of DRTM itself as it is just a security primitive). By having PCRs get reset during the DRTM event secrets are much more reliably able to be sealed to specific PCR values.
  - hlandau 3y ago
    The claim that SMM is measured by (Intel) DRTM is interesting. Do you have any details on that? To my knowledge Intel was trying to solve this issue using the concept of an 'SMM Transfer Monitor (STM)' not simply by measuring the SMM environment [1]. But it's been 8 years since [1] was written so if you have links to more current information, it'd be welcome. [1] https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf#page=16 https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf...

tashian 3y ago

I agree with the sentiment of the piece, but I disagree with the idea that TPMs don't add much value for end users. TPMs were originally designed in the early days of ecommerce, when it became clear that home computers would need better security if they were going to be used for financial transactions. Today's TPMs don't have a lot of compute power, but they have a lot of features. It's just that we don't have that much software taking the best advantage of those features yet, probably because they have only just become ubiquitous in the last couple years. TPMs lay the groundwork for unphishable credentials, using hardware-bound asymmetric keys. TPMs add a user-friendly option for full-disk encryption, in a way that's resistant to physical attacks. TPMs can be used to protect symmetric credentials too, instead of storing them on disk (see systemd-creds TPM2 support). And, TPMs do have actual privacy mechanisms. End-user TPMs do not offer up their endorsement key to any third party. Attestation workflows shield third parties from the endorsement key. I'm excited for more widespread use of TPMs in Linux especially. Lately systemd has been making some good progress here.

Gigachad 3y ago
Seems like a lot of banking and other secure business is moving to mobile first or mobile only, presumably as it's likely the only secure device the user has.
- DaiPlusPlus 3y ago
  I agree with your assessment: desktop-browser online banking (with US banks in particular) is a depressing experience given how they’re full of ads for credit-card offers and manual (if not broken) OFX/QFX downloads that only contain a fraction of the actual backend txn data that the banks won’t ever share with their (retail-banking) customers… And yet, while lots of banks now use SMS 2FA, none of the banks I use (Chase, BoA, Citi, and a couple of credit-unions) offer the far more secure TOTP scheme, let alone any way for headless clients to download txn data except via the literally-25+-years-old Quicken/Intuit OFX endpoints - presumably without 2FA, but with zero documentation in their online help and their retail banking customer support people have no idea what I’m talking about when I say OFX - it’s maddening, lots of banks’ legacy OFX endpoints are listed here: https://www.ofxhome.com/index.php/home/directory https://www.ofxhome.com/index.php/home/directory

EMM_386 3y ago

Wow ... I am getting old and jaded. I was so into locking down systems, making sure I knew where every packet was going, not trusting anything. Meanwhile I'm also "wardriving", phreaking with a red box, running an underground BBS ... all sorts of stuff. I had one of those fancy t-shirts with the export-restricted RSA encryption source code printed it. Because, why not? Now I just quickly skim a 2 year old article about Windows 11 and TPM again, on a Windows 11 device, and have just enough left in me to post a comment. > You see, the PC (emphasis on personal here) is in a way the last bastion of digital freedom you have. The TPM requirement of Windows 11 furthers the agenda to protect the PC against you, its owner. These keys are then cryptographically tied to the vendor who issued them, and as such, not only does a TPM uniquely identify your machine anywhere in the world, but content distributors can pick and choose what TPM vendors they want to trust. Every time these technologies come out, there are similar "it's all over" scenarios. But so far it hasn't been all over, and I've been around a while. I recall Intel Management Engine (ME) really piquing my interest for a bit. So my computer now has a computer running on it, that still runs when I turn it off, has access to the system hardware, including memory, the contents of the display, keyboard input, and the network? And the keys to the kingdom are secure ... they haven't been shared with anyone else who may be highly interested in having those ... ? Hello, anyone ... I'm still secure, right? ... right!? Forget it, I'll just disable it. Oh. Nevermind. Wait ... what? Intel ME has a ring −3 rootkit??! Just ... ah, forget it ... what's on TV? And then AMD shows up with their own. At least that one can be disabled by BIOS. I think? Hope? > Did we mention that a TPM isn’t going to protect you from UEFI malware that was planted on the device by a rogue agent at manufacture time? If you are the target of a rogue agent at manufacturing time, that is way past "game over". If they want it they're going to get it and you're not going to stop it by having, or not having, things like TPM on a Windows machine. I can't tell if this is more about losing the ability to watch HD video and DRM, or if nation states are coming after you. Those are slightly different. I'd personally prefer neither but I'd settle for the former. If it's security then it's more Tor/Tails and a USB key than Windows. Certain groups can even shut down highly specialized air-gapped equipment that is deeply underground. It's like "if there's a will, there's a way".

frankzander 3y ago
> It's like "if there's a will, there's a way". and that's one of the reasons I see no use in TPM. This is also a layer of complexity which usually is the opposite of more security. TBH I don't get it why people cheer this TPM and Secure Boot stuff as much.

judge2020 3y ago

The underlying point you should be calling out if you want to present this argument is that "User freedom should prevail over companies' freedom". The only thing attestation enables is companies enacting their own policies along the lines of "I only want users who are willing to let their device attest x level of security". The user is not required to use that service, they're not required to run W11 or to enable the fTPM in their BIOS. Asking for widespread change and the death of TPM attestation is like saying that companies should be forced to serve all customers even if it degrades the services they provide, if it requires x orders of magnitude more personnel for fraud/risk/etc management, or if it degrades the experience of other users on the service willing to perform attestation. Maybe this is the right approach, maybe we just need some good regulation that won't deepen the moat of existing players, but this is the crux of the argument being made. > We are here to remind you that the TPM requirement of Windows 11 furthers the agenda to protect the PC against you, its owner. No. It's to protect third party services that your PC makes network requests to. Your PC in itself doesn't need any protection from you.

kmeisthax 3y ago
Ok, so instead of Microsoft turning my PC into an Xbox, it's banks asking Microsoft to turn my PC into a credit card reader. This is not materially different. We already know how this works on Android. Attestation requirements and DRM tend to creep beyond their initial scope if implementing them is easy. And those requirements will include not having owner-level control over your machine[0]. If you root Android, you basically forefeit access to all banking apps, most gaming apps, and a whole bunch of things that you wouldn't even think should require secure attestation. On the web, we all thought that EME DRM was going to lock down web video and cascade into audio and text. This didn't come to pass primarily because DRM vendors charge money that free web video platforms don't have. If EME had made DRM ubiquitous, the best case would have been one distro vendor offering "blessed" kernel builds that can still "go online", and anyone wanting to be online with their own Linux kernel potentially violating DMCA 1201 or being limited to an increasingly shrinking "clearweb". There's three types of companies here: - People that absolutely need user-hostile attestation: banks, competitive multiplayer games, and streaming services - People that would never demand attestation on principle: normal websites, blogs, web forums, the Fediverse, and YouTube[1] - People who would implement attestation if it were available regardless of the impact on their user base: Facebook/Meta, Twitter, basically any social media network. That third group is arguably the largest. They will tolerate unattested users, but they wish they didn't have to. Making attestation easier makes it way more likely for them to demand it. [0] This could be made less onerous with per-partition boot policies, but only Apple Macs do this AFAIK. [1] YouTube's stance on DRM is very very weird. Google has the capability to DRM all their content, but they don't. And they've used YouTube as a trojan horse to push open standards like VP8/9 and AV1. On the other hand, they do try to obfuscate video download in ways that the RIAA thinks is DRM.

AraceliHarker 3y ago

One of the reasons why Microsoft and OEMs are promoting TPM is to encourage planned obsolescence, so that users will replace their PCs as often as they replace their smartphones, right? "(Lenovo) said people buy new smartphones every other year but became accustomed used to buying new PCs every six or seven years. The industry needs to do better at motivating people to buy new devices" https://www.cnbc.com/2021/10/05/microsofts-panos-panay-explains-balancing-surface-keeping-oems-happy.html https://www.cnbc.com/2021/10/05/microsofts-panos-panay-expla...

api 3y ago
Push local LLMs and generative AI then. That’ll require people to upgrade old machines.
Gigachad 3y ago
Tbh I'd expect the trend of upgrading phones to start to slow down as well as they become "good enough" but there are still pretty big gains being made in cameras. Laptops are just good enough now. If you took the 3 year old M1 internals, and stuck them in the new case and told me it was the 2024 model, I'd not notice anything was off.
- barbariangrunge 3y ago
  Phones are locked down. All you need is a vendor to refuse further software updates after 5 years, after releasing a more resource-draining updates prior to this, and it doesn’t matter how good the old hardware is. People won’t be able to use it
toastal 3y ago
A capitalist economy predicated on infinite growth necessarily needs planned obsolescence to artificially churn consumption to increase growth (with new devices costing more). With public-traded companies bound to make profits for shareholders, this is no surprise.

G3rn0ti 3y ago

Regarding TPM’s security see also: https://gbatemp.net/threads/nintendo-reportedly-issues-dmca-takedown-for-switch-homebrew-projects-skyline-switch-emulator-development-ceased.632406/ https://gbatemp.net/threads/nintendo-reportedly-issues-dmca-... „ specifically, Lockpick bypasses the Console TPMs to permit unauthorized access to, extraction of, and decryption of all the cryptographic keys, including product keys, contained in the Nintendo Switch“

floatboth 3y ago

> Did you know that technologies such as Intel Boot Guard that have existed for the better part of a decade defend well against such attacks that might seek to overwrite flash memory? It's rather funny to see Boot Guard as a "good" example here. Boot Guard is what's actually taking freedom away. With a vendor-locked Boot Guard configuration, you cannot replace the firmware with anything not signed by the vendor. Bye bye dreams of coreboot (until a private key leaks like it just did ha ha). Netflix & co denying service to machines that don't pass Microsoft attestation? Literally who cares, just go to The Pirate Bay instead.

deleted 3y ago

[deleted]