Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Dangers of Microsoft Pluton

gabrielsieben.tech

Post reply on HN
Print view View original

91–100 of 554 posts

Re: The Dangers of Microsoft Pluton

#91

Post by 01100011 »

SQueeeeeL wrote: post #24
userbinator wrote: post #11

What is to prevent school WiFi from one day requiring a Pluton assertion that your Windows PC hasn’t been tampered with before you can join the network? Remote attestation is the true enemy of your freedom. The power of the authoritarian corporatocracy to force you to use only the (entire) systems they control. It's worth reading https://www.gnu.org/philosophy/right-to-read.en.html again just to see how prescient Sta…

Damn, now I'm nostalgic for the older days of hacker news where RMS was quoted every other post. The community is forgetting it's roots.

That sounds more like /. than HN.

Re: The Dangers of Microsoft Pluton

#92

Post by aplanas »

POPOSYS wrote: post #78
aplanas wrote: post #61

Earlier quoted context omitted.

Windows security models and policies are the enemy, not remote attestation (RA). RA is a technology that has its fair use, and can be desired for other systems, like in Linux. With a pure RA system your services can decide to trust or not those devices on your network that can be compromised, and report to other devices that there is something suspicious. As anything, this can be used properly to increase the securit…

Is it possible to realize this with Linux systems / networks today? Do you have any good project / description / URL? Thanks!

It is still under development, but try Keylime[1]. They have also a nice agent written in Rust[2] with low footprint.

I write some notes[3] about how to use it in openSUSE MicroOS / Tumbleweed, but can be extrapolated to many other distributions too.

[1] https://github.com/keylime/keylime [2] https://github.com/keylime/rust-keylime [3] https://en.opensuse.org/Portal:MicroOS/RemoteAttestation

Re: The Dangers of Microsoft Pluton

#93

Post by RedComet »

aaronbrethorst wrote: post #59
BiteCode_dev wrote: post #52

Earlier quoted context omitted.

The capacity for abuse is huge, way beyong the potential benefits. From the USA, we get news of banned book in some states. When I read that, my head goes back to my european history, and I reach the Godwin point very quickly. Those kind of people will abuse such system to prevent things to be shared. It will be used for putting DRM on everything and create a more and more closed web. It will be used by corporations…

Ron DeSantis doesn't need hardware-level DRM to ban math books. https://www.baynews9.com/fl/tampa/news/2022/05/06/florida-ba... If you're worried about book bannings in states like Florida, DeSantis is up for reelection in just over 3 months . Go volunteer or donate money to his opponent (probably Charlie Crist).

No post body was provided.

Re: The Dangers of Microsoft Pluton

#94

Post by nine_k »

squiffsquiff wrote: post #54
Gh0stRAT wrote: post #46

I'm completely missing how his example of a Word document that can only be opened by approved users on approved hardware within the corporation is supposed to be a bad thing. Honestly, that sounds pretty fantastic. I've been using 3rd party tools/extensions to do this sort of thing in corporate and government environments for years, but having the attestation go all the way down to the hardware level is a big value-a…

Sure it's fantastic in a corporate environment. Not so fantastic for personal devices. Basically this: https://youtu.be/XgFbqSYdNK4

Well, don't put that on a personal device.

It's like your company giving you serious protecting gear to wear while doing your work on a nuclear reactor is a good thing. But having to wear such gear at home is not a popular choice, and should not be required.

Re: The Dangers of Microsoft Pluton

#95

Post by Ycombigatorz »

Aeolun wrote: post #89
fulafel wrote: post #83

Earlier quoted context omitted.

Yes, lots of Linux devices apply it like that today: You can't use your banking app or consume DRM crippled media on your Android phone if you have root or run a open source Android distribution.

> if you have root Because god forbid you have control of your own PC?

Because if you have control, so many numerous other parties.

Re: The Dangers of Microsoft Pluton

#96

Post by tbjoern »

metadat wrote: post #40
pmontra wrote: post #29

Earlier quoted context omitted.

Reminds me of computer magazines bundled first with cassettes, then floppy disks then CDROMS, 80s to 90s. Occasionally some other gadgets too. Everybody like us was buying them.

I'm so confused... What are you two getting on about? Is it just me or is it like two GPT-3 bots having a conversation?

Quite scary isn’t it? What a time to be alive. I’d never have believed that I am seriously questioning whether a conversation on the internet is real. Even after all the gpt3 quiz sites, like the one where you have to guess if the code is generated or real.

Re: The Dangers of Microsoft Pluton

#97

Post by fsflover »

p_l wrote: post #60
walterbell wrote: post #19

Earlier quoted context omitted.

On-premise, open-source, customer-owned remote attestation servers are possible. Avoid outsourcing integrity verification to 3rd-party clouds.

Yes, they are possible... And they are implemented using all the evil things like Secure Boot, TPM, and Pluton. MS remote attestation doesn't require remote cloud or anything like that, I recall it supporting air-gapped environment from the start (guess why, the top-price enterprise clients want that , including resigning windows with their own secure boot keys). Disclaimer: for various reasons open source remote att…

> And they are implemented using all the evil things like Secure Boot, TPM, and Pluton.

There is nothing evil with TPM when you fully control it. See: Librem Key.

Re: The Dangers of Microsoft Pluton

#98

Post by pjmlp »

selfhoster11 wrote: post #77
pjmlp wrote: post #56

Earlier quoted context omitted.

Smartphones and tablets are electronic gadgets. If you want a general purpose computer get a laptop. Most likely one sold by Linux OEMs, like Tuxedo and System76.

That's an invalid argument for multiple reasons, not the least of which is that some people can afford just one device. That device is likely to be a smartphone because everything is slowly moving in the direction of requiring one. If I need to spend extra money to get an additional "freedom device" and can't afford it, I just won't have one and will miss out on the good stuff.

Welcome to the 8 and 16 bit home computer days when OSes were written in ROMs.

Re: The Dangers of Microsoft Pluton

#99

Post by fsflover »

sofixa wrote: post #67
intelVISA wrote: post #34

Earlier quoted context omitted.

I don't really care for the reason, why can't we as consumers opt out if it's consumer oriented then? For me it's not even about the egregious security and privacy implications -- I just simply want the (illusion of) choice w/r/t silicon rootkit 'features' that I'll never use.

You can, it even says in the article that Lenovo and Dell are shipping with the Pluton chips disabled by default. If they can do it, a user can disable it to (for now at least).

Proprietary software with full system access tells that it's disabled. Do you trust that?

Re: The Dangers of Microsoft Pluton

#100

Post by zaptheimpaler »

bodge5000 wrote: post #80

Just to be clear, is this a case where you can't dual boot windows and another OS, or you can't boot another OS at all (in either case, the other OS being non Microsoft authorised)? Or something else entirely? Would it be possible to disable this at all, even that means you can't boot Windows?

You cannot boot the other OS at all if secure boot is enabled and Microsoft drops support for the 3rd party UEFI CA list. The machine will refuse to boot any kernel that has not been signed by the CAs already included in the machine. This is typically only Microsoft and sometimes the OEM like Lenovo or Dell.
Post reply on HN