Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

anandtech.com

Post reply on HN
Print view View original

161–170 of 172 posts

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#161

Post by zinekeller »

otabdeveloper4 wrote: post #147
xvilka wrote: post #78

I wonder if it will be one of the inferior technologies that were forced by Microsoft even outside of their Windows world. Like it happened with UEFI (that has no multithreading, uses PE as a format, Microsoft C ugly coding convention, bloated), SecureBoot (that was designed to stop anything non-Windows instead of real security), UTF-16 (everyone except them and JavaScript uses UTF-8), and so on. The list is long.

Well, it could be worse. Python did the whole Py3k own-goal purely for the purpose of forcing everyone onto UTF-16. (Facepalm, yes.)

> for the purpose of forcing everyone onto UTF-16.

Honestly, Py2 was a PITA when handling raw data, it could corrupt your data if you don't know exactly what you are doing.

The goal was to separate (Unicode) text from binary data. It wasn't to UTF-16 though. In fact, you should just assume that text variables are encoded in Unicode points and not care whether it is UTF-16 or UTF-8 (and on Unix-like systems, it is definitely represented to UTF-8). If you are converting it into binary, at least you know what encoding is it: no "Oh no my Python code was broken on Windows/Unix" because even Py2 has already the UTF-16/UTF-8 OS split.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#162

Post by 7786655 »

otabdeveloper4 wrote: post #147
xvilka wrote: post #78

I wonder if it will be one of the inferior technologies that were forced by Microsoft even outside of their Windows world. Like it happened with UEFI (that has no multithreading, uses PE as a format, Microsoft C ugly coding convention, bloated), SecureBoot (that was designed to stop anything non-Windows instead of real security), UTF-16 (everyone except them and JavaScript uses UTF-8), and so on. The list is long.

Well, it could be worse. Python did the whole Py3k own-goal purely for the purpose of forcing everyone onto UTF-16. (Facepalm, yes.)

Python uses UCS-4.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#163

Post by baby »

floatboth wrote: post #139
baby wrote: post #122

Earlier quoted context omitted.

Problem of a TPM is that it’s not an integrated chip, you can easily intercept messages going to and coming from the TPM

Discrete TPMs have been going out of fashion, fTPM (firmware tpm, i.e. soft TPM located in ME/PSP) has been standard for a few years now.

Yeah I've read the fTPM paper that made use of SGX, but it sounded like it had some limitation (needed fuses to prevent rollbacks, etc.)

From the article it also looks like Pluton will implement the TPM API, but I guess that's just to remain compatible.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#164

Post by [deleted] »

qayxc wrote: post #156
GeekyBear wrote: post #86

Earlier quoted context omitted.

> Consoles aren't general computing devices, though. Consoles are absolutely general computing devices. Microsoft just uses DRM to prevent you from running non approved software.

> Consoles are absolutely general computing devices. Repeating a false statement doesn't make it true. A general computation device is a device that manipulates data without detailed, step-by step control by human hand and is designed to be used for many different types of problems. A gaming console is strictly not designed to be used for many different types problems. It's a piece of hardware designed to run a speci…

[deleted]

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#165

Post by MaxBarraclough »

core-questions wrote: post #143
MaxBarraclough wrote: post #134

Earlier quoted context omitted.

> How long until someone has a device which can go to Netflix, social networking, etc. but doesn't have a web browser on it that can load arbitrary pages, and it's impossible to jailbreak? Such a locked-down device wouldn't really be anything new, we already have Roku, Chromecast, Chromebook, and games consoles. They don't threaten the 'ordinary' PC market.

It's been an incremental war. For context, I've been posting about this for 20 years; during that time all the devices you say "we already have" were invented. This has eaten away at the average person's computing freedom, ironically while providing them a ton more computing power and capability. > They don't threaten the 'ordinary' PC market. Not directly, but think about this: * I know people who do not own a PC an…

> ton of kids growing up without early exposure to general purpose computing

I agree that's a problem. It's possible to learn to code on an iPad, [0] but the system is generally closed to exploration.

[0] https://apps.apple.com/us/app/grasshopper-learn-to-code/id13...

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#166

Post by beagle3 »

fefe23 wrote: post #153

The marketing for this chip is vague and confusing because the chip does absolutely nothing for you. This chip is not here to protect you from compromised or malicious IoT devices, or to protect you from compromised or malicious cloud services. This chip is here to protect the Microsoft cloud from compromised or malicious IoT devices. They would also like you to believe that the chip improves security in the cloud. I…

A while ago (2006? Not sure) I was trying to buy a CD in a Tower Records store in SF, and I found the disk I wanted but it said it was "copy protected". I would have had no problem ripping it with abcde or cdparanoia or something, but refusing to support this, I asked the store employee: "Do you, by any chance, have another copy of this without copy protection?"

He looked at me, with complete disbelief, saying "But why wouldn't you want your copy to be protected?" I asked him "Do you know what kind of protection this is?" to which he replied, "yes, it's a copy less likely to break".

After this incident, I started asking a lot of people if they are aware of what's special about their "copy protected" disks - and the more technical people knew it was an attempt to restrict copying, but the rest thought it was probably a good thing (it says protection, and its on the label, it must be good, or reasoning as such).

It was at that point that I started religiously using RMS style acronyms, like Digital Restriction Management, Copy Restriction, etc. and I recommend everyone does.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#167

Post by xg15 »

qayxc wrote: post #82
Dylan16807 wrote: post #67

Earlier quoted context omitted.

> The whole project isn't targeted at end-users. It's IoT, businesses, hospitals, government agencies, utility companies, etc. > It's the security needs of these organisations that are addressed by this technology, not yours, not mine. It's perfectly fine to let a sysadmin lock down a computer to reduce what the end user can do. None of these use cases or security benefits require taking power away from the sysadmin.…

> None of these use cases or security benefits require taking power away from the sysadmin. Yes, they do! That's the whole point of the product. Why would you even trust the sysadmin in the first place? The fact of the matter is that a lot of data leaks have been caused by insiders - either willingly or via social engineering. This technology provides a method of closing this loophole and aims to enable users (not pr…

> This technology provides a method of closing this loophole and aims to enable users (not private people) to have a secure domain that not even someone with physical access to the system and all administrative privileges has access to.

Whether it works as advertised is another story of course, but the gist of it is that no one is to be trusted; especially not the sysadmin.

Who exactly is the user in this scenario? Who exactly sets the rules that the pluton architecture should enforce here?

> And that's fine and you are free to not use these products then because they're not made for you anyway. This is not consumer level hardware (at least not yet).

I don't understand why you are so sure about this not being intended for consumer-level hardware. There are plenty of scenarios where locking consumers out of their own devices would be highly desireable from a business perspective - DRM being only one of them.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#168

Post by xg15 »

qayxc wrote: post #155
anfilt wrote: post #96

Earlier quoted context omitted.

Its fine to say dont buy such hardware. The concern is what happens if thats all AMD, Intel and qualcomm sell to people. Apple already does this with the iPhones and tablets, and unless you find a bootrom exploit good luck running an other OS on the device. You also start running into problems where more software and content may require such hardware.

> Apple already does this with the iPhones and tablets, and unless you find a bootrom exploit good luck running an other OS on the device. These devices are not general computing devices (according to Apple), so in their mind that's fine. It also makes no difference to the customer since alternatives exist. The fact that pretty much all other products in the smartphone and tablet market are inferior in terms of hardw…

> These devices are not general computing devices (according to Apple), so in their mind that's fine. It also makes no difference to the customer since alternatives exist.

Yeah, well, if that's all it takes, then we'll probably not have any more "general computing devices" being sold in a few years. (Where did I hear that before?)

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#169

Post by xg15 »

qayxc wrote: post #53
core-questions wrote: post #48

Earlier quoted context omitted.

Virtually every technology that can be used to create a walled garden with moderation can be bent to limit people's ability to speak freely. How long until someone has a device which can go to Netflix, social networking, etc. but doesn't have a web browser on it that can load arbitrary pages, and it's impossible to jailbreak? Since we have no freedom of speech within FAANG properties, that would be a considerable res…

> principles matter To whom, though? Everybody is praising Apple for their (admittedly quite excellent) M1 hardware and no one seems to take issue with that either. You cannot have truly open hardware as long as (software-) patents and IP exist, simple as that. Companies need to protect their investment, since the days of comparatively simple CPUs are over and a lot of "secret sauce" is actually software and licensed…

This is all probably true, but doesn't change the point that the consequences of those perfectly reasonable business descisions will have massive effects on personal freedom.

Re: “Microsoft Pluton Hardware Security Coming to Our CPUs”: AMD, Intel, Qualcomm

#170

Post by antman »

darzu wrote: post #32
cm2187 wrote: post #23

Earlier quoted context omitted.

A TPM integrated into the CPU makes sense (and I am puzzled why TPMs aren't a standard feature of all MB given the modest cost). But what about that diagram in the article with a link to the cloud? Will this thing phone home outside of the control of the OS?

In Azure Sphere, Pluton didn't do any direct network communication, that was all handled by the main core. Also there was no cellular so the whole system depended on user interaction to get online. When the main core wanted to talk to the Azure Sphere cloud service (from Linux user land), it would go through a remote attestation process that involved Pluton. Pluton can securely track what software was booted on the m…

" it basically sends a hash of that to the cloud to prove to the cloud what software is currently running."

oh dear

Post reply on HN