Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Dangers of Microsoft Pluton

gabrielsieben.tech

Post reply on HN
Print view View original

271–280 of 554 posts

Re: The Dangers of Microsoft Pluton

#271

Post by adev_ »

npteljes wrote: post #124
Aeolun wrote: post #89

Earlier quoted context omitted.

> if you have root Because god forbid you have control of your own PC?

Yep! Basically, it's safer if you don't own your PC. Think about users with a million toolbars and Bonzi Buddy installed. Of course, the system for it is rudimentary, and puts a disproportionate amount of control in the hands of providers. And that works very well for them too.

> Yep! Basically, it's safer if you don't own your PC. Think about users with a million toolbars and Bonzi Buddy installed.

And it is a pretty terrible solution to the problem.

- It is also keeping the good guys outside too: Anyone that want to analyse and understand the security of the system for good reasons cannot. Excepted if explicitly allowed by the corporation X and that is a terrible security property.

- No root access also means very little control or ability to scan the system itself if your are not the X corporation controlling it. That means no possibility to mandate reviewer corporation Y to check that corporation X is doing the right thing. TPMs currently make that even worst by design, they are undocumented and complex, therefore rely on blind trust that company X do the rthe ight thing. And since the Intel management engine fiasco, we do know they are not doing the right thing.

- Bonzi Buddy and toolbar type of problem can be easily avoided by separating properly the normal user account from any admin account(the unix way). It should be painful to be admin but not impossible, just to make sure your grandma do not install a rootkit by mistake when she want her 20% coupon.

In summary: That is mainly bullshit from company X to keep full control on the entire user device, and not for their own good.

Re: The Dangers of Microsoft Pluton

#272

Post by _abox »

dx034 wrote: post #241
ftyhbhyjnjk wrote: post #50

Earlier quoted context omitted.

What you can install on YOUR pc will be at the sole mercy of microsoft/or maybe someone else.... That's the cusp of it. Not that it can be used for good, but that it sets the way for heavy misuse by large corporations. Wait a few years. Smaller companies won't even be allowed to order high end cpu's. You'll be at 100% mercy of these corporations. If after 2 years they decide to brick your pc, they'll just do it. You…

Secure chips like this are already in all devices but PCs. And in none of these areas has any of that happened. Quite the opposite, Apple got a fine when they slowed down older devices to save battery (at least what they said). So the government will clearly help out here. And none of these companies has an incentives to stop sales to smaller companies, they make a lot of money with those.

Try to install a BitTorrent client on your iphone, or a game emulator, a sexually explicit game or even a browser with a different engine.

All this has already happened since 2008 when the app store came out.

Re: The Dangers of Microsoft Pluton

#273

Post by autoexec »

hammyhavoc wrote: post #130
UberFly wrote: post #37

I've always thought that at some point the only "stomachable" version of windows is going to be some hacked offering, by god-knows-who or from where, but it'll still end up being preferable to what MS is requiring.

Isn't that the way it's been for several versions now with scripts to disable all the telemetry and shovelware?

As far as I know there are no scripts that are capable of disabling all of the telemetry and nothing that can't be undone the instant the computer has an internet connection and connects to windows update.

Re: The Dangers of Microsoft Pluton

#274

Post by VoodooJuJu »

userbinator wrote: post #11

What is to prevent school WiFi from one day requiring a Pluton assertion that your Windows PC hasn’t been tampered with before you can join the network? Remote attestation is the true enemy of your freedom. The power of the authoritarian corporatocracy to force you to use only the (entire) systems they control. It's worth reading https://www.gnu.org/philosophy/right-to-read.en.html again just to see how prescient Sta…

It's so true, but I'm trying to imagine a normie's reaction to reading this, and all I'm coming up with is, "This guy is a paranoid schizo, back to TikTok for me...", and so unfortunately, I don't see us steering away from this fate anytime soon.

These people won't respect you until you start taking their money. Become one of their techno-corporate overloads. Demonstrate how you're controlling/profiting off them, why it's bad. Maybe then they'll start listening. Or not. At least you'll have made a nice profit.

Re: The Dangers of Microsoft Pluton

#275

Post by qweqwerwerwerwr »

autoexec wrote: post #255
qweqwerwerwerwr wrote: post #213

Earlier quoted context omitted.

what's stopping someone from taking photos of your precious document and posting them on 4chan? nothing. there's nothing you can do to stop that.

I can discretely copy GBs of email messages and word docs in a reasonable amount of time, but I couldn't discretely take cell phone pictures of every page of every one of those messages and documents if I had years to do it. You don't always have to prevent something 100% of the time in every possible situation to have a devastating effect on people who want to do that thing.

I've just provided the easiest example of bypassing any boomer security nonmeasures. give a dedicated and competent attacker 15 minutes alone with your highly secure machine and highly sensitive documents, and if your entire security model depends on DRM rather than actually effective methods, they will figure out how to exfiltrate it all.

Re: The Dangers of Microsoft Pluton

#277

Post by dane-pgp »

gjsman-1000 wrote: post #16
jhanschoo wrote: post #15

While I disagree with the author's opinion, it was very informative for me.

Not mentioned in the article - but it begs the question, could this have something to do with Microsoft's insistence that everyone, even Pro users in the next update, use a Microsoft Account with Windows 11? If Pluton (or Pluton 2, someday) could be tied to a Microsoft Account, wouldn't that be something.

Imagine a future where everyone requires an online account to use a computer, where every computer can only run software approved by the few large corporations that issue those accounts, and where a government or governments have those corporations on speed dial, to periodically "suggest" to them which software and which users should be allowed to transact and communicate online.

If you can imagine that, then imagine that every human is given a number which is equivalent to (or even more significant than) their name, and that name/number appears in certificates which are signed by the name/number of a certificate authority's key. By accepting the signature, you have to accept an EULA that takes an hour to read, so no one does, and it changes every month anyway, with future changes automatically binding you.

Does that sound like a world where people are free?

Re: The Dangers of Microsoft Pluton

#278

Post by aplanas »

furtiman wrote: post #215
ChuckNorris89 wrote: post #208

Earlier quoted context omitted.

Can you explain what is the issue with TPM? I get the issue with Pluton but TPM is only a dedicated and certified secure key and random number generator that does a better job than CPUs doing it in software, and it's also a secure enclave for storing your encryption keys. Would you rather store the keys in memory where they can be easily grabbed by malicious apps like Mimikatz? Macs had the same feature for years in…

Among that, the TPM enables verification of a particular state of your system, i.e., a particular set of binaries and OS configuration. Simplifying the description of the process a bit - at every bootup it checks the checksum of all programs loaded at every boot stage (UEFI, kernel, userspace) with respect to one that is known to be approved - process called "attestation". So in worst case, if your attestation server…

> the TPM enables verification of a particular state of your system, i.e., a particular set of binaries and OS configuration

That is a bit misleading. The TPM is a passive device, it cannot verify any state. It is the OS who measure the system (in Linux via the IMA system). And is the Linux kernel the one that, if you have a TPM, can produce a process where a 3rd party can be sure that the measurements are "true" and "legit" (via PCR#10 extension).

As you state later, it is this 3rd party the one that assert (verify) if you are state considered OK or not.

Maybe I am too simplistic, but I do not see the evil in the TPM here, but only in the 3rd party policy.

TPM can be abused but, as a developer, I am happy that we can use the TPM for good and fair goals in open source projects.

It is the user who can decide to use the TPM or not, and should be noted that in the TCG specification it is stated that the TPM can be disabled and cleared by the user at any moment.

Re: The Dangers of Microsoft Pluton

#279

Post by aplanas »

xjay wrote: post #244
raxxorraxor wrote: post #171

Earlier quoted context omitted.

Same with TPM and why it had so many critics. Some people still seem adamant to say that boot viruses are the greatest threat in the 21st century, but the economic interest are far more dangerous for general computing in my opinion. And it isn't even close.

2013: German Federal Government Warns on the Security Dangers of Windows 8 https://www.infosecurity-magazine.com/news/german-federal-go... 2015: Governments recognize the importance of TPM 2.0 through ISO adoption https://www.microsoft.com/security/blog/2015/06/29/governmen... 2022: Microsoft Can Kiss My A* | Do You Own Your PC? [Smart App Control] https://www.youtube.com/watch?v=Lv5xHfZnk4s&t=163s The Trojan Platfor…

The common component here is Microsoft, not the TPM.

Re: The Dangers of Microsoft Pluton

#280

Post by fsflover »

dx034 wrote: post #270
fsflover wrote: post #246

Earlier quoted context omitted.

> Quite the opposite, Apple got a fine when they slowed down older devices to save battery But the devices were actually slowed down, so the danger is real.

And Apple had to revert it and got punished for it. What more do you want?

Good laws should prevent crimes, not just punish for committing them.
Post reply on HN