Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

anandtech.com

Post reply on HN
Print view View original

71–80 of 172 posts

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#71

Post by lrae »

dpoochieni wrote: post #31
azalemeth wrote: post #9

A previous HN link is here -- https://news.ycombinator.com/item?id=25131431 -- which links to MS's original press release -- https://www.microsoft.com/security/blog/2020/11/17/meet-the-... . That article explicitly states that it was designed originally for the xbox. I worry that going to be a very anti-consumer, anti-free-speech, DRM heavy chip that MS want to popularise as an alternative to the (still hated in some…

Imagine it being capable of enforcing something like which executables you are able to load... Quite in the vein of Apple sending the executables hash to some random server

> Quite in the vein of Apple sending the executables hash to some random server

Isn't Microsoft already doing that on a default Windows installation?

Edit: Yes, SmartScreen, enabled by default, seems to send:

Hash, name and signature for executables. (Also hashes of urls you visit (though I guess only in Edge?))

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#72

Post by xenocratus »

josh2600 wrote: post #70
darzu wrote: post #32

Earlier quoted context omitted.

In Azure Sphere, Pluton didn't do any direct network communication, that was all handled by the main core. Also there was no cellular so the whole system depended on user interaction to get online. When the main core wanted to talk to the Azure Sphere cloud service (from Linux user land), it would go through a remote attestation process that involved Pluton. Pluton can securely track what software was booted on the m…

I guess I’m wondering how Pluton and SGX coexist...

From what I understand, Pluton is more in the vein of TPMs, so able to store and handle your cryptographic keys and to do measurements during your boot process. SGX is a hardware feature that allows an app to run securely (i.e. Without any possible interference from other apps or even the OS) in a hardware-enforced enclave. Completely different tasks and use cases, which might overlap - maybe you can use keys with Pluton from within an SGX enclave?

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#73

Post by gentleman11 »

api wrote: post #57
azalemeth wrote: post #51

Earlier quoted context omitted.

He says in pretty much literally the opening sentence that it's for DRM: "we want to prevent the piracy of games", and then goes on to justify that their business model involves making a loss on each xbox sold, and wants to ensure that the CPU only runs Microsoft code against the wishes of the Xbox owner. A later direct quote is "the fundamental difference between Windows security and Xbox security is that the owner…

Then don't buy stuff like that. None of this stuff will change unless people vote with their wallets. Companies have the idea that nobody cares. I've actually heard "nobody cares about privacy and security" repeated as a mantra in multiple circles.

As time goes on, we don’t have a lot of choices in a lot of these sorts of cases. There are dozens of hardware and software things I would love to replace if there were a viable alternative

Speaking of, I heard the librem phone just started shipping

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#74

Post by p1necone »

api wrote: post #55
bitL wrote: post #52

Earlier quoted context omitted.

Boiling frog stuff... We complained about this 20 years ago, all these moves were known back then, yet here we are. More to come - TPM required to connect to the Internet and access news sources without any ability to store information on our own devices. Followed by rewriting historical articles to properly "sanitize" content.

User experience is everything, and without a good profitable business model FOSS can't afford the massive investment of time and effort required to bring a competitive user experience. Making stuff work is only maybe 20% of the work required to build a product... sometimes less. I've been yelling about that for years and years and very few people seem to get it. Free as in freedom got conflated with free as in beer y…

There's a lot of open source software that provides a fantastic user experience to developers, perhaps the solution is somehow getting some users to work on your open source product when developers aren't your intended users.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#75

Post by intricatedetail »

gotstad wrote: post #26
intricatedetail wrote: post #21

Call me sceptical, but I hope m$ is not pulling Apple tricks to lock computers to their OS. Is this open source? Will consumer be able to audit it down to the silicon level?

They already said it is OS agnostic. MS 2020 is far away from MS 2010. With regards to the auditing need, can you audit a CPU down to the silicon level today?

They could set a new standard. I think when it comes to security these things should be transparent. You know, documentation can say one thing and implementation another.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#76

Post by qayxc »

Dylan16807 wrote: post #69
qayxc wrote: post #50

Earlier quoted context omitted.

That's not how that works. At all.

Another commenter familiar with the tech said: Pluton can securely track what software was booted on the main core (called "measure boot") and it basically sends a hash of that to the cloud to prove to the cloud what software is currently running. That sounds like most of what you need to build a system that can enforce what executables you're allowed to load and prevent you from attaching a debugger.

You omitted the context there: the poster was talking about Azure Sphere - IoT devices that use Pluton for verification with remote services.

That's a different use case (chip-to-cloud). It can also not prevent you from attaching a debugger when all you need to do is to go offline.

In fact, the whole point is that you can run anything without compromising the security of the data in the secure enclave. That's what Zero-Trust is all about.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#77

Post by mcbits »

api wrote: post #55
bitL wrote: post #52

Earlier quoted context omitted.

Boiling frog stuff... We complained about this 20 years ago, all these moves were known back then, yet here we are. More to come - TPM required to connect to the Internet and access news sources without any ability to store information on our own devices. Followed by rewriting historical articles to properly "sanitize" content.

User experience is everything, and without a good profitable business model FOSS can't afford the massive investment of time and effort required to bring a competitive user experience. Making stuff work is only maybe 20% of the work required to build a product... sometimes less. I've been yelling about that for years and years and very few people seem to get it. Free as in freedom got conflated with free as in beer y…

People complaining the loudest about "not OSI compliant" etc. are not complaining about the software being non-FOSS. They're complaining about non-FOSS software masquerading as/lying about being FOSS.

If the solution to making FOSS more competitive with non-FOSS is to make FOSS non-FOSS, well, that's not much of a solution.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#78

Post by xvilka »

I wonder if it will be one of the inferior technologies that were forced by Microsoft even outside of their Windows world. Like it happened with UEFI (that has no multithreading, uses PE as a format, Microsoft C ugly coding convention, bloated), SecureBoot (that was designed to stop anything non-Windows instead of real security), UTF-16 (everyone except them and JavaScript uses UTF-8), and so on. The list is long.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#79

Post by aidenn0 »

xvilka wrote: post #78

I wonder if it will be one of the inferior technologies that were forced by Microsoft even outside of their Windows world. Like it happened with UEFI (that has no multithreading, uses PE as a format, Microsoft C ugly coding convention, bloated), SecureBoot (that was designed to stop anything non-Windows instead of real security), UTF-16 (everyone except them and JavaScript uses UTF-8), and so on. The list is long.

You can't blame MS for UTF-16. They adopted it when it was UCS-2 and unicode only had 64k codepoints. They are stuck on the older technology because they were early adopters.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#80

Post by blackearl »

azalemeth wrote: post #51
qayxc wrote: post #49

Earlier quoted context omitted.

> Why else would they design it for the xbox, of all things? If you really want to know the answer, here's the lead engineer explaining it en detail: https://www.youtube.com/watch?v=quLa6kzzra0

He says in pretty much literally the opening sentence that it's for DRM: "we want to prevent the piracy of games", and then goes on to justify that their business model involves making a loss on each xbox sold, and wants to ensure that the CPU only runs Microsoft code against the wishes of the Xbox owner. A later direct quote is "the fundamental difference between Windows security and Xbox security is that the owner…

Is that on the newest Xbox? Saw articles earlier that you can simply switch to dev mode and run retroarch emulators already.
Post reply on HN