301–310 of 554 posts
Earlier quoted context omitted.
Could this be disabled by the user? Presumably doing so would mean you cannot boot Windows, but if thats a trade off Microsoft is forcing me to make, I'll accept it. If you can't, it goes without saying that that is unacceptable
Yes, you can disable secure boot.
That's not always the case: https://www.softwarefreedom.org/blog/2012/jan/12/microsoft-c... "Disabling Secure [Boot] MUST NOT be possible on ARM systems."
Earlier quoted context omitted.
Among that, the TPM enables verification of a particular state of your system, i.e., a particular set of binaries and OS configuration. Simplifying the description of the process a bit - at every bootup it checks the checksum of all programs loaded at every boot stage (UEFI, kernel, userspace) with respect to one that is known to be approved - process called "attestation". So in worst case, if your attestation server…
> the TPM enables verification of a particular state of your system, i.e., a particular set of binaries and OS configuration That is a bit misleading. The TPM is a passive device, it cannot verify any state. It is the OS who measure the system (in Linux via the IMA system). And is the Linux kernel the one that, if you have a TPM, can produce a process where a 3rd party can be sure that the measurements are "true" and…
The evil is that the "Trusted" in "Trusted Computing" and "Trusted Platform Module (TPM)" means that one deeply distrusts the user (who might tamper with the system), but instead the trust lies in the computing (trusted computing) or TPM. In other words: Trusted Computing and TPM means a disempowerment of the user.
Earlier quoted context omitted.
> imagine if the proponents of these systems had their way, they'd add remote attestation to websites too. Imagine your bank's website only loading on a "secure" windows environment, non-rooted android phone or an iphone. Actually, IIUC this is already the case on Android[0]. Some (many? most?) banks/banking apps are rejecting (and/or complaining about) access from rooted phones right now . I can't confirm this perso…
> I'd rather have my tonsils extracted through my ears than use a surveillance device^W^W smart phone to do anything financially related. Well, it gets even better, even for folks with principles like you have. If you want to use general computer, you need to log in. For logging in, you need second factor. That second factor is going to be in 99,99% cases exactly the app in the smartphone, that refuses to run on root…
The administrator of my network does not require multi-factor authentication for my logins.
That's probably because I am said administrator.
As for professional settings, if my employer wants me to use a surveillance device and/or an app on said device, they can provide that device to me.
As an alternative, I suppose I could use whatever subsidy is provided by my employer to purchase/use a separate device for such things.
If they choose not to do one of those thing, I guess I won't be logging in and will soon be working elsewhere.
Requiring me to use my personal equipment for work purposes is inappropriate IMHO, and I've yet to hear an argument (other than folks not wanting to carry multiple devices, which is a personal choice) that changes my mind about that.
I'd welcome anyone to make such an argument, mostly to discuss why it's inappropriate, but I'd certainly keep an open mind about it -- perhaps there's an angle(s) I haven't considered.
What is to prevent school WiFi from one day requiring a Pluton assertion that your Windows PC hasn’t been tampered with before you can join the network? Remote attestation is the true enemy of your freedom. The power of the authoritarian corporatocracy to force you to use only the (entire) systems they control. It's worth reading https://www.gnu.org/philosophy/right-to-read.en.html again just to see how prescient Sta…
> Remote attestation is the true enemy of your freedom. Technology is a tool. What is true however is that under the current way how the economy is structured remote attestation weakens freedoms of individuals mostly. If Facebook was under remote attestation that private information was only used in limited and specific ways and even the NSA can not get to them without breaking the remote attestation, that would be a…
Remote attestation would prevent a firmware written by first party and passed certification processes WHAT?
nowadays 98% of things implying "security" are actually unwanted products, protections for "the other side" or trivial distortions of reality where, conveyed by "security" itself, the user himself becomes the product - no, I don't need protections for the side channel, I never asked for them - no, I don't need a unique identifier, who is the demented person who asked you for it - no, I am not going to glitch the powe…
Absolutely. Security is just a PR term for these, like how "think of the children" narrative is pushed when pushing for certain legislations.
Ew. Why are all the chip manufacturers going along with this stupid plan? I want to buy a processor and then own it and have it work in my best interests, not consume electricity and generatie heat enforcing draconian 3rd party DRM policies.
Because China and Russia might be hacking your hardware. Don't people listen when a guy like Pompeo speaks he has pretty much outlined the plan with his Clean Network Initiative, I wouldn't be surprised that within a decade CloudFlare and other US cloud services will be used as the great firewall of the western sphere.
Ew. Why are all the chip manufacturers going along with this stupid plan? I want to buy a processor and then own it and have it work in my best interests, not consume electricity and generatie heat enforcing draconian 3rd party DRM policies.
The conspiratorial answers here are emotionally satisfying, but ultimately wrong. The reason chip makers and OS vendors are adding this is customer demand, by which I mean enterprises. Companies want remote attestation and guaranteed-immutable OS images on their networks, and I honestly can't say I blame them. In a perfect world they could have it and we could somehow firewall it away from the consumer space entirely…
Earlier quoted context omitted.
> the TPM enables verification of a particular state of your system, i.e., a particular set of binaries and OS configuration That is a bit misleading. The TPM is a passive device, it cannot verify any state. It is the OS who measure the system (in Linux via the IMA system). And is the Linux kernel the one that, if you have a TPM, can produce a process where a 3rd party can be sure that the measurements are "true" and…
> Maybe I am too simplistic, but I do not see the evil in the TPM here, but only in the 3rd party policy. The evil is that the "Trusted" in "Trusted Computing" and "Trusted Platform Module (TPM)" means that one deeply distrusts the user (who might tamper with the system), but instead the trust lies in the computing (trusted computing) or TPM. In other words: Trusted Computing and TPM means a disempowerment of the use…
Sure Infineon can probably get my data, but that's far beyond the scope of my threat model.
As long as the system is open to putting your own keys on there I'm fine with it.
Earlier quoted context omitted.
> the TPM enables verification of a particular state of your system, i.e., a particular set of binaries and OS configuration That is a bit misleading. The TPM is a passive device, it cannot verify any state. It is the OS who measure the system (in Linux via the IMA system). And is the Linux kernel the one that, if you have a TPM, can produce a process where a 3rd party can be sure that the measurements are "true" and…
> Maybe I am too simplistic, but I do not see the evil in the TPM here, but only in the 3rd party policy. The evil is that the "Trusted" in "Trusted Computing" and "Trusted Platform Module (TPM)" means that one deeply distrusts the user (who might tamper with the system), but instead the trust lies in the computing (trusted computing) or TPM. In other words: Trusted Computing and TPM means a disempowerment of the use…
Earlier quoted context omitted.
Anything that prevents me from modding or cheating in my single player games is anathema to me. And companies like Activision, Ubisoft and Rockstar would love a hardware-based system that takes control away from gamers.
I didn’t say anything about single player games.