Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft proves backdoor keys are a bad idea

theregister.co.uk

Post reply on HN
Print view View original

61–70 of 106 posts

Re: Microsoft proves backdoor keys are a bad idea

#61

Post by theandrewbailey »

RHSeeger wrote: post #33
theandrewbailey wrote: post #9

Earlier quoted context omitted.

From the last section: > To reiterate, these Microsoft-signed resources – the debug-mode policy and the EFI installation tool – are only meant to be used by developers debugging drivers and other low-level operating system code. In the hands of Windows RT slab owners, whose devices are completely locked down, they become surprisingly powerful. > It's akin to giving special secret keys to the police and the Feds that…

Of course, the problem with a digital key is that once it's out in the wild, its out for everyone and forever.

Same issue with a physical one. The solution is the same, too: get a new key (and lock).

Re: Microsoft proves backdoor keys are a bad idea

#62

Post by mulmen »

slg wrote: post #40
daenney wrote: post #2

I genuinely hope this will influence the whole government mandated back door debate for the better but I'm afraid that this will just be forgotten in a matter of minutes. Like Gove said "we've had enough of experts", especially when their educated opinions don't suit us.

If a terrorist attack occurred and it was clear that it could have been prevented if the authorities could have read encrypted information, would that change your opinion of backdoors? If not, why are you criticizing the other side for being just as steadfast in their beliefs as you are in yours? The truth is that no policy is going to be 100% effective so I'm not sure why either side of the debate should overadjust…

I would not criticize the other side of the debate for being steadfast. I will however criticize the belief itself. I will base my criticism on actual events such as this one instead of hypotheticals.

I do not think considering this case in the encryption/backdoor debate is an over-adjustment based on a single failure. I think this a relevant example of the risks of creating and using a golden key. If you discount every individual example what are you left with? As daenney stated, the hope is to influence debate, not base the decision entirely on one event.

Do you believe this situation has no relevance to the encryption and backdoor debate? Are you arguing that because no policy will be 100% effective we just shouldn't bother with a discussion?

Re: Microsoft proves backdoor keys are a bad idea

#63

Post by stable-point »

rocqua wrote: post #54
bradford wrote: post #5

(disclaimer, MS employee, non-security expert here). I've read through the article, here, and in other places, and I'm seeing sentiment that this is a big fuck up on Microsoft's part. I might be completely misunderstanding, but I just don't see it. In order to use the backdoor, you've got to flash firmware, so, you've got to have physical access to the device. If an attacker has physical access to your device, you're…

Secure boot's intentions are to ensure a malicious modified OS cannot run (when taken at face value, there is also the potential for vendor lock-in, but noone will defend it based on that). Remember that I-phone the FBI wanted apple to hack? With this golden key, anyone could've hacked into that I-phone. I am not sure how e.g. bitlocker uses the TPM, but it might be that being able to load a modified OS allows for by…

The TPM controls the rate-limiting. A compromised OS shouldn't affect it. (Otherwise a live CD could compromise your disk encryption, as the encryption is usually done at the OS level, not in the BIOS/EFI).

Re: Microsoft proves backdoor keys are a bad idea

#64

Post by stable-point »

bradford wrote: post #27
sp332 wrote: post #16

Earlier quoted context omitted.

You need admin rights, but not physical access.

requiring admin rights for an exploit is certainly a lower barrier to entry than is requiring physical access, but I think my point still stands: if someone has those rights, you're already screwed.

> if someone has those rights, you're already screwed.

I think that this was once true, but Secure Boot was an attempt to improve the situation. My understanding is that Microsoft's Virtualization Based Security (which Device Guard/Credential Guard are built upon) rely on the assumption that the boot process is secure. If an attacker could have their root kit load before the OS/Hyper-V, then they render those mitigations useless.

Re: Microsoft proves backdoor keys are a bad idea

#65

Post by netsharc »

allendoerfer wrote: post #42

I think people should be able to sue companies that do this. They surely did not advertise it as "secure unless we lose the key". Having a backdoor in the first place could be counted as negligent (should be counted as outright fraud).

Is it really a backdoor? Basically it's a policy with very permissive settings, but even without this policy, the manufacturer still needs to use encryption to sign software, and they'd still need to have a master key which they need to keep very safe.

For example, in the FBI vs. Apple case, the FBI wanted Apple to write a custom version of iOS and sign it so that the phone would verify that it's legitimately from Apple, and install it. Obviously it's different than the FBI also having keys, but only because of protections of the law. I guess in Russia or China the 3 letter agencies can be a lot more persuasive about asking the manufacturers for their master keys, although the USA also has NSL's...

Re: Microsoft proves backdoor keys are a bad idea

#66

Post by babesh »

bradford wrote: post #5

(disclaimer, MS employee, non-security expert here). I've read through the article, here, and in other places, and I'm seeing sentiment that this is a big fuck up on Microsoft's part. I might be completely misunderstanding, but I just don't see it. In order to use the backdoor, you've got to flash firmware, so, you've got to have physical access to the device. If an attacker has physical access to your device, you're…

Like when the government intercepted routers in transit to install their own snooping devices. Now they can do that to all computers and it would be very hard to tell. And now it can be anyone not just the government.

Re: Microsoft proves backdoor keys are a bad idea

#67

Post by rocqua »

stable-point wrote: post #63
rocqua wrote: post #54

Earlier quoted context omitted.

Secure boot's intentions are to ensure a malicious modified OS cannot run (when taken at face value, there is also the potential for vendor lock-in, but noone will defend it based on that). Remember that I-phone the FBI wanted apple to hack? With this golden key, anyone could've hacked into that I-phone. I am not sure how e.g. bitlocker uses the TPM, but it might be that being able to load a modified OS allows for by…

The TPM controls the rate-limiting. A compromised OS shouldn't affect it. (Otherwise a live CD could compromise your disk encryption, as the encryption is usually done at the OS level, not in the BIOS/EFI).

Perhaps not rate-limiting, but on the i-phone, it was about circumventing the limit of 10 tries.

Besides, doesn't secureboot block an unsigned live-CD? Otherwise, I don't see the point of secure boot past vendor lock-in.

Re: Microsoft proves backdoor keys are a bad idea

#68

Post by scythe »

bradford wrote: post #5

(disclaimer, MS employee, non-security expert here). I've read through the article, here, and in other places, and I'm seeing sentiment that this is a big fuck up on Microsoft's part. I might be completely misunderstanding, but I just don't see it. In order to use the backdoor, you've got to flash firmware, so, you've got to have physical access to the device. If an attacker has physical access to your device, you're…

>Isn't a secure boot policy that can be bypassed with physical access more secure than none?

Not if the bypass is a zero-day.

Re: Microsoft proves backdoor keys are a bad idea

#69

Post by MichaelGG »

rocqua wrote: post #67
stable-point wrote: post #63

Earlier quoted context omitted.

The TPM controls the rate-limiting. A compromised OS shouldn't affect it. (Otherwise a live CD could compromise your disk encryption, as the encryption is usually done at the OS level, not in the BIOS/EFI).

Perhaps not rate-limiting, but on the i-phone, it was about circumventing the limit of 10 tries. Besides, doesn't secureboot block an unsigned live-CD? Otherwise, I don't see the point of secure boot past vendor lock-in.

It is supposed to prevent boot level malware or people otherwise compromising the device. Implemented correctly, it can be beneficial to security. As an end user, I like having a TPM, and I like having boot level protection measures. I wouldn't trust my life to them, but after seeing indictments/FBI testimony, they seem like they are enough to deter many attackers.

The whole "only applies to RT devices" was a bit shifty looking from MS, though. Fortunately the broken Windows on ARM model died.

Edit: I'd also note that, e.g. console gamers love this stuff. It allows them to pretty much rely on others not being able to cheat very well.

Re: Microsoft proves backdoor keys are a bad idea

#70

Post by MichaelGG »

beagle3 wrote: post #56
boznz wrote: post #52

Earlier quoted context omitted.

I'm speculating here, but surely by this argument Apple has a backdoor to unlock the phone if it physically has it.

Of sorts. Apple (and unless they have been compromised, only Apple) could replace the firmware of a locked phone with a new firmware that will accept millions of unlock attempts without erasing the phone, at which point the password could be found by brute force. The FBI asked Apple to create this firmware, and Apple refused.

And presumably Apple could have designed it to not allow firmware updates without being unlocked. Or require overwriting of "secured" secrets if an update is applied anyways. It probably wasn't worth the potential user hassles?
Post reply on HN