Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Intel Security True Key

intel.com

Post reply on HN
Print view View original

41–50 of 113 posts

Re: Intel Security True Key

#41

Post by wolfgke »

wyager wrote: post #27
seanp2k2 wrote: post #20

Earlier quoted context omitted.

Interesting that Apple is doing similar things with the embedded ARM stuff in the new touchbar MBPs.

The thing is that Apple actually has a pretty good track record for security and not violating the privacy or integrity of customers' products. I have a lot more trust in Apple doing this correctly. I'd be fine with Intel taking on secure computing, but there's been some pretty bad stuff with the IME (like sending data to the internet outside of user control when using intel NICs), so I'm skeptical of this approach (…

> but there's been some pretty bad stuff with the IME (like sending data to the internet outside of user control when using intel NICs)

That's also a typical concern about baseband processors - and Apple has a baseband processor integrated into their iPhones and iPads. OK, there is a difference: While for ethernet ports (and with a little bit more effor WiFi connections) you can at least theoretically analyze whether there is dubious traffic, this is nearly impossible for connections over mobile networks.

Re: Intel Security True Key

#42

Post by moppl »

wyager wrote: post #27
seanp2k2 wrote: post #20

Earlier quoted context omitted.

Interesting that Apple is doing similar things with the embedded ARM stuff in the new touchbar MBPs.

The thing is that Apple actually has a pretty good track record for security and not violating the privacy or integrity of customers' products. I have a lot more trust in Apple doing this correctly. I'd be fine with Intel taking on secure computing, but there's been some pretty bad stuff with the IME (like sending data to the internet outside of user control when using intel NICs), so I'm skeptical of this approach (…

Just to give an idea of how bad the stuff is with the IME, I recommend reading up Chapter 4 here:

Intel x86 considered harmful by Joanna Rutkowska

https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf

The IME is basically a second computer inside your computer, running as the most privileged component on the platform. It has privileged access to all components of the system, and runs as long as the computer is plugged in or has battery (even if it the computer is switched off). It is under the control of Intel, they decide what the IME does, and it can use the NIC as it pleases, unnoticeable for the host system. It can not be disabled, switched off or removed. The rootkit researcher Rutkowska described it as "an ideal rootkiting infrastructure".

Re: Intel Security True Key

#43

Post by temptel »

akerl_ wrote: post #38
HashThis wrote: post #32

The truth is that we can't trust INTEL. Their CPU micro-code or ME (Management engine) can and does "phone home" to the internet, grab updates and update the CPU. They don't allow the customer to turn this OFF, which betray's the customer who purchased the CPU. Anyone who can sign the update and intercept the download channel can update your CPU with you having no ability to protect yourself. We can't trust intel. In…

What are some good resources to learn more about the phone-home functionality in their microcode? I've been trying to find more details and have been unable to do so.

You've been unable to find that information because no such "functionality" exists. Microcode just patches bugs or configuration details of the CPU; it doesn't "phone home".

Re: Intel Security True Key

#44

Post by akerl_ »

temptel wrote: post #43
akerl_ wrote: post #38

Earlier quoted context omitted.

What are some good resources to learn more about the phone-home functionality in their microcode? I've been trying to find more details and have been unable to do so.

You've been unable to find that information because no such "functionality" exists. Microcode just patches bugs or configuration details of the CPU; it doesn't "phone home".

That was my initial understanding, but I figured I'd give the parent commenter the benefit of the doubt in case my understanding was flawed.

Some more searching seems to lead back to where I started: the microcode itself isn't phoning home, the only phoning "home" that occurs is the normal process of "when you pull down an update for something, it requires phoning to the repository holding the updates".

Re: Intel Security True Key

#45

Post by micheljones »

temptel wrote: post #43
akerl_ wrote: post #38

Earlier quoted context omitted.

What are some good resources to learn more about the phone-home functionality in their microcode? I've been trying to find more details and have been unable to do so.

You've been unable to find that information because no such "functionality" exists. Microcode just patches bugs or configuration details of the CPU; it doesn't "phone home".

ME does have ability to do that, tho.

Re: Intel Security True Key

#46

Post by arjie »

junto wrote: post #22
IshKebab wrote: post #17

Earlier quoted context omitted.

You can use fingerprints as a password. They aren't perfect but in many situations they are fine. Security isn't black and white.

Providing you have them, I can chop then off and use them. Seriously, use your eye or fingerprint as a password and there is someone ruthless enough to remove them from your body.

Who is this mythical fellow who's not going to give up his password in such a situation anyway? No one's going to protect their accounts at the cost of their finger. Certainly not me.

I mean, I agree with not using fingerprints as passwords but not because I want to protect myself from the fingermen.

Re: Intel Security True Key

#47

Post by akerl_ »

micheljones wrote: post #45
temptel wrote: post #43

Earlier quoted context omitted.

You've been unable to find that information because no such "functionality" exists. Microcode just patches bugs or configuration details of the CPU; it doesn't "phone home".

ME does have ability to do that, tho.

Just like IPMI, or any other standard for allowing hardware-level admin of a system.

Re: Intel Security True Key

#48

Post by comboy »

micheljones wrote: post #45
temptel wrote: post #43

Earlier quoted context omitted.

You've been unable to find that information because no such "functionality" exists. Microcode just patches bugs or configuration details of the CPU; it doesn't "phone home".

ME does have ability to do that, tho.

Do you think you could fit drivers for all common ethernet/wifi cards in there and proper TCP/IP implementation? It's below assembly abstraction level.

Re: Intel Security True Key

#49

Post by moppl »

comboy wrote: post #48
micheljones wrote: post #45

Earlier quoted context omitted.

ME does have ability to do that, tho.

Do you think you could fit drivers for all common ethernet/wifi cards in there and proper TCP/IP implementation? It's below assembly abstraction level.

The ME is basically an independent universal computer in its own right, it comes with its own clock, RAM, CPU etc...

It is like a Matryoshka doll sitting inside the Intel CPU of your computer. Therefore, yes, it can contain all of that. For further details see my other two posts.

Re: Intel Security True Key

#50

Post by Someone »

tw04 wrote: post #39
BinaryIdiot wrote: post #34

Earlier quoted context omitted.

Genuinely surprised to not see this happen yet. I guess it's a good thing Apple and Google are the ones who typically store Fingerprints and not third party apps.

Who exactly has been storing fingerprints centrally? I know plenty of devices that store them locally, but have not seen one phoning it home.

The EU is planning to. http://europa.eu/rapid/press-release_IP-16-1247_en.htm:

"The proposed system stores alphanumeric and biometric data (a combination of four fingerprints and the facial image). [...] The System is composed of a central database connected to national entry points."

If/when this comes to be, that database will probably be both well-protected and an incredibly tempting attack target.

Post reply on HN