Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

anandtech.com

Post reply on HN
Print view View original

101–110 of 172 posts

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#101

Post by whereistimbo »

wahern wrote: post #33
merb wrote: post #28

Earlier quoted context omitted.

well apple's enclave is broken aswell. https://arstechnica.com/information-technology/2020/10/apple... well at least it needs physical access.

FWIW, I meant Apple secure enclave hacks get all the attention because they're more of an achievement, at least in terms of published hacks being more rare. I tried to keep track of published Qualcomm breaks--which usually don't require physical access as they involve classic software bugs--several years ago but gave up because they were too numerous yet not as widely publicized. I had plenty of fodder by then, thoug…

Lol. Even Google had to put Titan M on its Snapdragon based Pixels.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#102

Post by Dylan16807 »

mjg59 wrote: post #98
Dylan16807 wrote: post #69

Earlier quoted context omitted.

Another commenter familiar with the tech said: Pluton can securely track what software was booted on the main core (called "measure boot") and it basically sends a hash of that to the cloud to prove to the cloud what software is currently running. That sounds like most of what you need to build a system that can enforce what executables you're allowed to load and prevent you from attaching a debugger.

Pluton can securely track what software was booted on the main core as long as the previous component in the boot chain participates . If your OS doesn't participate, you don't get any measurements beyond that point. And that means there's no way for Pluton to block execution.

At which point the server will refuse to send you the protected portion of the software, or the decryption key for it. This blocks the execution.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#103

Post by fwip »

core-questions wrote: post #48
gotstad wrote: post #24

Earlier quoted context omitted.

How do you see it being anti-free-speech?

Virtually every technology that can be used to create a walled garden with moderation can be bent to limit people's ability to speak freely. How long until someone has a device which can go to Netflix, social networking, etc. but doesn't have a web browser on it that can load arbitrary pages, and it's impossible to jailbreak? Since we have no freedom of speech within FAANG properties, that would be a considerable res…

I can't use my shoe to post on Hacker News.

Why is it a free speech issue for a device to exist that can go to Twitter but doesn't host your blog for you?

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#104

Post by canada_dry »

gruez wrote: post #47
warkdarrior wrote: post #16

Earlier quoted context omitted.

It'll be built into the CPU, instead of having a separate chip, and seems to have secret-management functionality for user-specified keys, biometrics, etc.

>It'll be built into the CPU, instead of having a separate chip so are the trusted execution environments used by fTPMs? >seems to have secret-management functionality for user-specified keys AFAIK TPMs already have that functionality. random search: https://github.com/tpm2-software/tpm2-tools/blob/master/man/... >biometrics, etc. AFAIK some fingerprint readers already use trusted execution environments to handle aut…

The huge difference, and most tin-foil-hat worthy, is that all this functionality is extended to reach the cloud.

What's frightening is that - by design - the user will have little/no control or even awareness of what data is being sent or received.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#105

Post by kevingadd »

blackearl wrote: post #80
azalemeth wrote: post #51

Earlier quoted context omitted.

He says in pretty much literally the opening sentence that it's for DRM: "we want to prevent the piracy of games", and then goes on to justify that their business model involves making a loss on each xbox sold, and wants to ensure that the CPU only runs Microsoft code against the wishes of the Xbox owner. A later direct quote is "the fundamental difference between Windows security and Xbox security is that the owner…

Is that on the newest Xbox? Saw articles earlier that you can simply switch to dev mode and run retroarch emulators already.

Dev mode apps run under a hypervisor (so do retail games), so there's still a security platform underneath everything protecting apps from each other (and the OS from the apps)

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#106

Post by Dylan16807 »

dleslie wrote: post #94
p1necone wrote: post #74

Earlier quoted context omitted.

There's a lot of open source software that provides a fantastic user experience to developers , perhaps the solution is somehow getting some users to work on your open source product when developers aren't your intended users.

Even as a developer the things I want just don't work reliably: 1. Bluetooth; Audio especially, but all BT is flaky. 2. Low Latency audio; I have tried Jack on numerous machines and always find myself staring at high latency buffers because the kernel audio driver can't perform any better, and then there's how often it just ... goes silent without any trace in the logs. 3. Suspend and battery usage are, in general, s…

Those first two don't work very well on my proprietary systems either.

And, come to think of it, hibernation's been broken on my Windows install too lately.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#107

Post by thayne »

api wrote: post #55
bitL wrote: post #52

Earlier quoted context omitted.

Boiling frog stuff... We complained about this 20 years ago, all these moves were known back then, yet here we are. More to come - TPM required to connect to the Internet and access news sources without any ability to store information on our own devices. Followed by rewriting historical articles to properly "sanitize" content.

User experience is everything, and without a good profitable business model FOSS can't afford the massive investment of time and effort required to bring a competitive user experience. Making stuff work is only maybe 20% of the work required to build a product... sometimes less. I've been yelling about that for years and years and very few people seem to get it. Free as in freedom got conflated with free as in beer y…

User experience is definitely not everything. Plenty of successful "enterprise" software products have terrible user experiences.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#108

Post by pyuser583 »

kmeisthax wrote: post #62
azalemeth wrote: post #9

A previous HN link is here -- https://news.ycombinator.com/item?id=25131431 -- which links to MS's original press release -- https://www.microsoft.com/security/blog/2020/11/17/meet-the-... . That article explicitly states that it was designed originally for the xbox. I worry that going to be a very anti-consumer, anti-free-speech, DRM heavy chip that MS want to popularise as an alternative to the (still hated in some…

So, the Trusted Platform Module itself isn't a DRM solution. It's a chip that hangs off the LPC/ISA bus and holds a crypto key generated from boot stage hashes that your BIOS, bootloader, and operating system provide to it. The idea is that all of those hashes together form a key that would change if any stage were tampered with, and that by encrypting things with the key you can prove that those particular things ha…

Why does MS full disk encryption require TPM?

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#109

Post by 29athrowaway »

An unnecessary solution for an inexisting problem.

I hope they lose their investment.

I also hope all their hordes of fanboys wake up to reality now. Yes, the people that "<3 open source" and "<3 Linux" and gave you VS Code for free, will now own your CPU now and you have nothing to do about it. And then, if they change their mind and don't want you to run Linux, you won't run Linux.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#110

Post by darzu »

michaelt wrote: post #66
darzu wrote: post #17

I worked extensively with Pluton when I was employed on Azure Sphere (an IoT platform marketed as highly secure and composed of a linux-based OS, ARM SoC, and cloud service). I might be able to answer questions about this. Here’s a blog by the engineer lead on Azure Sphere that discusses Pluton: https://azure.microsoft.com/en-us/blog/anatomy-of-a-secured-... Disclaimer: I still work at MSFT but in a different org.

Will this be virtualisable so multiple VMs sharing a host will see separate, independent devices? On desktops and laptops, will this device have a hardwired user-presence sensor, like Yubikeys do? Would this device be performance-oriented enough to, for example, terminate SSL? I gather TPMs can, but only unhelpfully slowly [1] Would it be performance-oriented enough to perform disk encryption? What about memory encry…

I’m pretty sure Azure Sphere used Pluton to do encryption for SSL. I don’t have any numbers, but one of the goals of Pluton was to accelerate crypto operations. But this was for a microcontroller context so I’m not sure about desktop/laptop class performance.

I don’t think pluton was used for disk or memory encryption, in Azure Sphere but I believe the possibility was discussed.

I’m afraid I don’t have anything more than speculation for the rest.

Post reply on HN