British right to repair law excludes smartphones and computers • Hacker News Board

Re: British right to repair law excludes smartphones and computers

#121

Post by jandrese » Thu, Jul 01, 2021, 5:24 PM UTC

tremon wrote: post #112

jandrese wrote: post #66

Earlier quoted context omitted.

A TPM is just a bit of memory that is "hacker proof" so you can store a private key with a guarantee that it can't leak out. You can then sign, encrypt, or decrypt using the key. They were controversial because it was originally thought they would be used to lock parts of your computer away from you, being used to do DRM and the like. At the end of the day the chips were hard to use, slow, and flaky enough that it di…

A TPM is much more than "just a bit of memory". It is a cryptographic coprocessor, with its own microcode and its own security domain. And I don't think a fully-secured future for PC's is as impossible as you think. The primary reason this is impossible right now is because TPM's aren't ubiquitous (none of my machines came with one installed). That problem will be solved by Windows 11.

The fundamental problem with the secure enclave on PC is that to make it work you have to basically lock out all of the untrusted hardware on the box, which is pretty much all of it. So while you are doing your secure computation nobody is servicing the PCIe bus. The graphics card drivers aren't getting any CPU cycles. Ring buffers on your network cards aren't emptied. From the perspective of everything else on the machine the whole thing just crashed.

If your computation is quick you might be able to get away with this sometimes, but the potential for problems is almost unlimited. The fact that the TPM itself is pretty slow throws another monkeywrench into the plan.

In order for it to work the whole system needs to be designed from the bottom up to support it, which means you need to touch every layer of the PC stack. It's a lot of work. It is a lot easier on something like a cellphone where you can control the hardware from top to bottom and don't have to consider the case where someone installs additional hardware to suit their needs.

Re: British right to repair law excludes smartphones and computers

#122

Post by AnthonyMouse » Thu, Jul 01, 2021, 5:25 PM UTC

my123 wrote: post #102

foolmeonce wrote: post #98

Earlier quoted context omitted.

Most phones secured bootloaders are hacked in less than 6 months if there is sufficient interest in the model. So if treatment of this as a huge security threat that makes other rights moot is valid then most of us should be able to return our improperly secured phones before their warranty is up.

Not the case, it takes significantly longer... if it happens at all. Much longer. It took until 2019 for checkra1n to become a thing to unlock Apple A7 to A11 devices. Apple A11 is a 2017 SoC. A12, A13, A14 remain uncracked today. In Android lands, bootloaders starting from quite some years ago are quite solid too, with no bypasses except when the device maker provides you the possibility to unlock it.

None of which is relevant to the premise that someone is going to do [insert something evil here - perhaps involving the radio]. Because if any device is cracked after any period of time then someone wanting to do [insert something evil] will just buy that device in order to do it.

Re: British right to repair law excludes smartphones and computers

#123

Post by BackBlast » Thu, Jul 01, 2021, 5:25 PM UTC

fsflover wrote: post #54

nerdawson wrote: post #47

Earlier quoted context omitted.

TV manufacturers are responding, often clumsily and based on their self-interest (data collection), to what consumers want. Trying to find a dumb TV is like trying to find a car without a built in radio. You're welcome to leave it switched off. Smart TVs are dumb if they aren't connected to the internet. Some may be slow. Some may have a poor interface. I'd worry about solving for that rather than expecting manufactu…

> Smart TVs are dumb if they aren't connected to the internet. Unless they find an open WiFi network.

Or if they have Alexa, it should be able to mesh to the next Amazon device in range and use their connected internet to do it's thing.

Re: British right to repair law excludes smartphones and computers

#124

Post by toast0 » Thu, Jul 01, 2021, 5:26 PM UTC

plainnoodles wrote: post #90

emouryto wrote: post #16

Well, smartphones must be updated to include better spyware. And newer computers are also better locked down to allow better surveillance. So, the older ones can't break down fast enough! You don't want a repairable computer so creeps install, like, a Linux distro. You want disposable TPM machines with Windows 11 Home Edition and unstoppable "telemetry".

To be fair, TPM's are really cool from a hardware perspective. They're HSM's which can fundamentally change what threat models on your OS look like. Unfortunately, the purpose here will be to use the fact that most users use a non-free OS to turn these TPMs against the user in order to make DRM harder to break.

I see the value in using a TPM to protect a disk encryption key; but also the downside of it being harder for me to recover data when the TPM fails before the disk (or if the motherboard fails and the TPM is tamper resistant and doesn't want to be moved to another board, etc). For me, data recovery is more important.

Boot time security sounds kind of useful, but I don't have time or desire to audit and sign everything I run, and Microsoft doesn't either; they have historically signed all sorts of garbage that undermines the system security, and I expect that will continue.

Re: British right to repair law excludes smartphones and computers

#125

Post by swiley » Thu, Jul 01, 2021, 5:26 PM UTC

bluGill wrote: post #46

cunidev wrote: post #40

Not even mentioning the hardware bits, I have been collaborating with postmarketOS for a while now, and believe that the main thing we need to make those devices longer-lasting would be an unlockable bootloader by law. This sounds so logical (why cannot I run, by voiding the warranty, any code I want on my machine, whatever it is?), yet apparently so hard to make openly illegal, since the problem is barely acknowledg…

You can't do that because someone (probably not you) will then unlock the phone and [insert something evil here - perhaps involving the radio]

Many SoCs let you burn a hash for the second stage bootloader. If your threat model includes this then build a copy of uboot that will only load kernels signed with your keys and burn the hash into the fuses of your device.

Re: British right to repair law excludes smartphones and computers

#126

Post by tremon » Thu, Jul 01, 2021, 5:26 PM UTC

alias_neo wrote: post #93

pbhjpbhj wrote: post #75

Earlier quoted context omitted.

IME washing machines, dishwashers, washer-dryers all have relatively good repairability and good parts availability already (fridges too, though I've less experience of that). You even see them being scored on repairability or repair costs. Have they addressed a problem that is largely absent? It's hard to choose to repair when a secondhand replacement is as cheap though. Replaced a plastic pipe, and a hose on my dis…

I live in a London new-build flat. Mine and several of my neighbours washing machines gave out at the same time, all in the same month, all roughly 3 years in. These came with the flats of course. I would repair it, but having watched a YouTube video on how it's done, the cost in tools, parts and effort (it's a full disassembly) to make the relatively simple repair I cannot justify over buying a better model of my ch…

Right-to-repair laws aren't about you personally repairing every item you need. It means you have the freedom to buy the support and maintenance you need from the entire market, rather than being beholden to expensive options "blessed" by the original manufacturer.

Re: British right to repair law excludes smartphones and computers

#127

Post by yjftsjthsd-h » Thu, Jul 01, 2021, 5:27 PM UTC

TylerE wrote: post #110

jolmg wrote: post #80

Earlier quoted context omitted.

AFAIK, anything phones can do on a hardware level can be done on more open platforms. What could unlocking phones enable evil people to do? What's one of these valid points of the other side?

Phones are ubiquitous. A phone sitting on a desk is invisible, in a way a random enclosure with a fire wires sticking out of it isn’t.

On the other hand, a Pi/ESP32/whatever shoved into a plastic case instantly becomes almost as inconspicuous once again.

Re: British right to repair law excludes smartphones and computers

#128

Post by Smithalicious » Thu, Jul 01, 2021, 5:28 PM UTC

ShaneMcGowan wrote: post #26

ivoras wrote: post #21

It's all fun and games until your fridge gets reclasiffied as a computer.

Trying to find a good non smart tv is impossible now, I want dumb tv and dumb fridge

TV design decisions baffle me. Why no displayport? Why only optical audio out and no jack?

I just have mine hooked up to my pc with a long hdmi cable so my use case might be unusual, though.

Re: British right to repair law excludes smartphones and computers

#129

Post by bkallus » Thu, Jul 01, 2021, 5:29 PM UTC

fsflover wrote: post #54

nerdawson wrote: post #47

Earlier quoted context omitted.

TV manufacturers are responding, often clumsily and based on their self-interest (data collection), to what consumers want. Trying to find a dumb TV is like trying to find a car without a built in radio. You're welcome to leave it switched off. Smart TVs are dumb if they aren't connected to the internet. Some may be slow. Some may have a poor interface. I'd worry about solving for that rather than expecting manufactu…

> Smart TVs are dumb if they aren't connected to the internet. Unless they find an open WiFi network.

With TCL TVs, it's not hard to remove the wifi card. In the ones I've taken apart it's always just connected with USB internally.

Re: British right to repair law excludes smartphones and computers

#130

Post by lotsofpulp » Thu, Jul 01, 2021, 5:34 PM UTC

handrous wrote: post #87

lotsofpulp wrote: post #44

Earlier quoted context omitted.

I find Sony TVs to be pretty quick. I use it them in conjunction with Apple TV, and I never have to deal with the TV itself, and it is quick to turn itself off and on via HDMI CEC. They are not the high end models either, I have a $630 one from 2016 and a $600 one from 2020.

My Roku-built-in TV is usable in maybe 3-4 seconds—when it's in sleep mode. A cold boot (say, if it's lost power for any reason) does take tens of seconds. Meanwhile, my dumb LCD TV from ~2008 only does cold boots and comes up in maybe 2 seconds, no matter what.

I assume Roku does not have the sufficient resources to properly equip their products with the necessary hardware to cope with their software, resulting in a compromised product that manifests as slow start times.

Unfortunately, I do not see how some of these smaller players can come close to being competitive with the big players seeing how small the profit margins are on physical devices.

Unless they have a reputation for very high quality, I assume there are lots of compromises being made on the hardware side to be able to compete on price.