Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Dangers of Microsoft Pluton

gabrielsieben.tech

Post reply on HN
Print view View original

331–340 of 554 posts

Re: The Dangers of Microsoft Pluton

#331

Post by FridayoLeary »

raxxorraxor wrote: post #171
userbinator wrote: post #11

What is to prevent school WiFi from one day requiring a Pluton assertion that your Windows PC hasn’t been tampered with before you can join the network? Remote attestation is the true enemy of your freedom. The power of the authoritarian corporatocracy to force you to use only the (entire) systems they control. It's worth reading https://www.gnu.org/philosophy/right-to-read.en.html again just to see how prescient Sta…

Same with TPM and why it had so many critics. Some people still seem adamant to say that boot viruses are the greatest threat in the 21st century, but the economic interest are far more dangerous for general computing in my opinion. And it isn't even close.

Agreed. For proof, just look at how so much anti virus software can be considered malware in their own right.

Re: The Dangers of Microsoft Pluton

#333

Post by _23sd »

zaptheimpaler wrote: post #86
Gh0stRAT wrote: post #46

I'm completely missing how his example of a Word document that can only be opened by approved users on approved hardware within the corporation is supposed to be a bad thing. Honestly, that sounds pretty fantastic. I've been using 3rd party tools/extensions to do this sort of thing in corporate and government environments for years, but having the attestation go all the way down to the hardware level is a big value-a…

The same things that make it good in a corporate environment can make it abusive in a personal machine. By forcing the kernel to be untamperable, Microsoft can arbitrarily enforce ANY policy they choose on your PC. They could spy on every single piece of network communication. They could ban any given software from being able to run on Windows - maybe Chrome, maybe Steam, any competitor at all. They actually could ea…

Microsoft doesn't need an "untamperable" kernel to force spying on users. Windows 10/11 has horrible invasive telemetry that can't be disabled, but no one has figured out how to modify the OS and strip it out, all the "solutions" involve temporarily disabling services or blocking network traffic. Is there actually some new capability here that points to future surveillance and censorship, or are you just fitting everything Microsoft does into a narrative where these things are just around the corner and waiting for the right technology? In my opinion the technology has been there for many years, it's just waiting for the US to go insane enough to implement massive censorship.

Re: The Dangers of Microsoft Pluton

#336

Post by userbinator »

SSLy wrote: post #239
eertvertvbw wrote: post #58

Earlier quoted context omitted.

still waiting on the secure boot lockdown everyone has insisted is coming for the better part of two decades...

>As of January 2021 deleting SecureBoot keys and installing your own keys (for example by using KeyTool) will brick the device. This is a problem that is similar to one which has been reported on some other Lenovo laptops [0] and is likely due to a faulty firmware. If the device is stuck in a boot loop after replacing the SecureBoot keys, the only way to repair it is by replacing the mainboard of the device. [0] http…

Does reflashing the BIOS EEPROM (via hardware clip) work? Or have they "secured" that out of the question too?

Re: The Dangers of Microsoft Pluton

#338

Post by npteljes »

feanaro wrote: post #321
npteljes wrote: post #284

Earlier quoted context omitted.

I think if I pick two groups: all iPhone users, and all PC users, PC users en bloc are in greater general digital danger than iPhone users. By digital danger, I'm thinking of malware, ransomware, phishing and successful hacking. And I think this is because of how tightly Apple controls their devices. And so, I'd consider an iPhone a safe choice - for example a safe recommendation for someone who doesn't want to spend…

> [...] which is, I think, very similar to how we don't really have control over a great many of things. This is a very handwavey sentence and is doing far too much work in your reasoning. Yes, you don't have control "over a great many things", because the point is so vague so as to be meaningless. But it doesn't at all follow from that vague sentence that we should allow total corporate/government control over our p…

I agree. It's basically appointing a dictator and hope that they'll stay benevolent.

With my reasoning I wanted to capture what people might think, while accepting something that they have no control of. I have a hard time with this, because I got a PC in my formative years and I loved to tinker with it, and hated, and still do, everything that stood in the way of that. But the general population doesn't share this experience. And if I look at my own life, I only have this experience with computers (and smartphones), all the other things are, even if not centrally managed, out of my control. At the first wrong noise I have to call an expert who hopefully fixes it and is hopefully benevolent to me, because I have no clue what happens to the device I own. Or even my own body, now that I think about it. And so, the PC and the phone is just in a long list of things that people depend on, but not control.

The addendum being here, and what most people miss who feel the way I described above, is that our ever-connected devices make a "paper trail" unprecendented in history. And it can be centrally managed, activated, replayed, assembled, or even more tracking could be remotely controlled to an extent[0] - and to an even larger extent with a specialized application[1]. This is where the otherwise similar level of "not being controlled" can lead to a much worse situation than ever before. And I wish I could point this out empathetically to people without sounding like a lunatic.

[0] https://money.cnn.com/2014/06/06/technology/security/nsa-tur...

[1] https://en.wikipedia.org/wiki/Pegasus_(spyware)

Re: The Dangers of Microsoft Pluton

#339

Post by lotsofpulp »

userbinator wrote: post #326
npteljes wrote: post #124

Earlier quoted context omitted.

Yep! Basically, it's safer if you don't own your PC. Think about users with a million toolbars and Bonzi Buddy installed. Of course, the system for it is rudimentary, and puts a disproportionate amount of control in the hands of providers. And that works very well for them too.

Think about users with a million toolbars and Bonzi Buddy installed. I say let them be. As long as they also have the freedom to remove or not install such software, it's a good thing. Instead we have locked-down devices with the functional equivalent of such unwanted software, protected so that you cannot remove it without somehow getting root. "Those who give up freedom for security deserve neither."

My parents grew up in a non English speaking developing country, and they cannot be reasonably expected to learn the nuances of malware laden links to figure out which English text link is good or bad.

Do they deserve to not be able to shop online without fear of having their payment information stolen? Or mistyping a URL in their non native language and ending up at a scam website that installs malware? Or simply having a device that comes to a crawl such that they cannot reliably video call their grandkids?

Re: The Dangers of Microsoft Pluton

#340

Post by choeger »

I think the fear mongering is spot-on and there's no way back. The only positive way forward would be a non-profit org taking over the role of key manager. No for-profit org and no government should be in the position to control computing. So instead of blocking the technology that inevitably will come (or is already there), let's focus on legislation that prevents corporate entities from controlling computation.
Post reply on HN