Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

anandtech.com

Post reply on HN
Print view View original

131–140 of 172 posts

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#131

Post by tsbinz »

pyuser583 wrote: post #108
kmeisthax wrote: post #62

Earlier quoted context omitted.

So, the Trusted Platform Module itself isn't a DRM solution. It's a chip that hangs off the LPC/ISA bus and holds a crypto key generated from boot stage hashes that your BIOS, bootloader, and operating system provide to it. The idea is that all of those hashes together form a key that would change if any stage were tampered with, and that by encrypting things with the key you can prove that those particular things ha…

Why does MS full disk encryption require TPM?

It doesn't (it does heavily push you towards it, but you don't need it), you can edit a group policy in order to be able to store the key on a usb drive or to use a passphrase.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#132

Post by gotstad »

intricatedetail wrote: post #75
gotstad wrote: post #26

Earlier quoted context omitted.

They already said it is OS agnostic. MS 2020 is far away from MS 2010. With regards to the auditing need, can you audit a CPU down to the silicon level today?

They could set a new standard. I think when it comes to security these things should be transparent. You know, documentation can say one thing and implementation another.

Exactly my point. You're asking to set a new standard that even todays CPUs does not adhere to, even though they process equally sensitive data and operations. Seemingly, because you are sceptical of MS.

And to your point about documentation vs implementation, it would not be difficult for anyone, to state one thing in the documentation and produce another thing, unless perhaps, you give access to the manufacturing facilities.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#133

Post by [deleted] »

qayxc wrote: post #43
1vuio0pswjnm7 wrote: post #27

Earlier quoted context omitted.

Will the final purchaser of the computer chip, i.e., the consumer, have r/w access to the contents of the enclave? EDIT: s/access/r\/w & to the contents of/

I don't know. I can't even speculate without knowing what you mean by "access to the enclave". If you mean access as in being able to arbitrarily read and write keys or data to/from it, then no, you won't be able to access it that way. After all that's the whole point - even physical access to the hardware won't enable you to extract information (keys, etc.) from it. This means any data or firmware stored on the chip…

[deleted]

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#134

Post by MaxBarraclough »

core-questions wrote: post #48
gotstad wrote: post #24

Earlier quoted context omitted.

How do you see it being anti-free-speech?

Virtually every technology that can be used to create a walled garden with moderation can be bent to limit people's ability to speak freely. How long until someone has a device which can go to Netflix, social networking, etc. but doesn't have a web browser on it that can load arbitrary pages, and it's impossible to jailbreak? Since we have no freedom of speech within FAANG properties, that would be a considerable res…

> How long until someone has a device which can go to Netflix, social networking, etc. but doesn't have a web browser on it that can load arbitrary pages, and it's impossible to jailbreak?

Such a locked-down device wouldn't really be anything new, we already have Roku, Chromecast, Chromebook, and games consoles. They don't threaten the 'ordinary' PC market.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#135

Post by gotstad »

raxxorrax wrote: post #130
gotstad wrote: post #26

Earlier quoted context omitted.

They already said it is OS agnostic. MS 2020 is far away from MS 2010. With regards to the auditing need, can you audit a CPU down to the silicon level today?

> MS 2020 is far away from MS 2010. I haven't seen evidence of this. Their OS is at least as user hostile as before and they desperately seek developers. If I have a specific technical problem I have to slay hundreds of sales people before I find someone with real expertise. That they aren't as dominant as before is probably due to the fact that they have few developers and need to regain some. Financially Office is…

I am not sure you were ever looking for evidence in the first place.

WSL and .NET as open-source?

Their R&D budget in 2019 was twice that in 2010, meanwhile sales and marketing budget increased by 30%.

Their Productivity and Business Processes (which includes Office, Dynamics, ERP and LinkedIn) accounted for 1/3 of global sales revenue in 2019.

Sure, there are some things that have stayed the same in the last 10 years, but of all the FAANGS I would argue that MS is the company that changed the most in the last 10 years.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#136

Post by azalemeth »

api wrote: post #57
azalemeth wrote: post #51

Earlier quoted context omitted.

He says in pretty much literally the opening sentence that it's for DRM: "we want to prevent the piracy of games", and then goes on to justify that their business model involves making a loss on each xbox sold, and wants to ensure that the CPU only runs Microsoft code against the wishes of the Xbox owner. A later direct quote is "the fundamental difference between Windows security and Xbox security is that the owner…

Then don't buy stuff like that. None of this stuff will change unless people vote with their wallets. Companies have the idea that nobody cares. I've actually heard "nobody cares about privacy and security" repeated as a mantra in multiple circles.

I personally don't. I haven't bought a single Sony product since their rootkit fiasco 15 years ago [1]. I don't buy products with DRM on them: I buy classical music DRM free from an excellent record label called Hyperion (many of my friends in the choral music circuit have been recorded by them); I don't buy DVDs; I legally format-shift media freely streamed on OTA TV broadcasts, and I don't buy DRM encumbered things online. My indie games come from itch.io and my "indie" games come from gog.com.

The trouble is, (a) doing this is a bit of a giant PITA, and (b) companies never know that you're not there. Sony doesn't know, and doesn't care, that I don't buy their products because of their aggressive pro-DRM stance. I am one consumer, many sigma away from mu, and slowly but surely I look like an antiquated relic: streaming has been so successful, and Widevine so ubiquitous, that it's almost impossible to join the "normal world" without being subjected to (unwanted) DRM.

[1] https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk...

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#137

Post by floatboth »

cm2187 wrote: post #23
darzu wrote: post #17

I worked extensively with Pluton when I was employed on Azure Sphere (an IoT platform marketed as highly secure and composed of a linux-based OS, ARM SoC, and cloud service). I might be able to answer questions about this. Here’s a blog by the engineer lead on Azure Sphere that discusses Pluton: https://azure.microsoft.com/en-us/blog/anatomy-of-a-secured-... Disclaimer: I still work at MSFT but in a different org.

A TPM integrated into the CPU makes sense (and I am puzzled why TPMs aren't a standard feature of all MB given the modest cost). But what about that diagram in the article with a link to the cloud? Will this thing phone home outside of the control of the OS?

fTPMs have been standard for a few years now. As I understand it, this Pluton thing is mostly about having a fully "hardware" TPM inside the SoC instead of a "firmware" one.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#138

Post by dathinab »

skohan wrote: post #6
wmf wrote: post #3

Earlier quoted context omitted.

Booting Linux is really a policy question, not technical.

Is it a policy question without Pluton? I.e. will this allow hardware vendors additional means to prevent me from installing Linux?

Technically hardware vendors can already prevent this since years (secure boot without custom keys and only including Microsoft Windows keys).

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#139

Post by floatboth »

baby wrote: post #122
Reelin wrote: post #118

Earlier quoted context omitted.

I thought that specific implementations had issues in the past but that the concept of a TPM in general was fine? The Intel ME and AMD PSP, on the other hand, are proper nightmares. For that matter, so is any other "security co-processor" that operates as an unauditable black box below ring 0 (presumably this applies to both Apple's and Google's solutions).

Problem of a TPM is that it’s not an integrated chip, you can easily intercept messages going to and coming from the TPM

Discrete TPMs have been going out of fashion, fTPM (firmware tpm, i.e. soft TPM located in ME/PSP) has been standard for a few years now.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#140

Post by dathinab »

gruez wrote: post #5

Isn't this basically fTPM (basically software TPM implemented in the trusted execution environment of the CPU) that both AMD and Intel already offer?

It seems to be explicit about being a hardware TPM which is included in the CPU instead of an extra chip, so I guess no.
Post reply on HN