Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardware Attestation as Monopoly Enabler

grapheneos.social

Post reply on HN
Print view View original

541–550 of 799 posts

Re: Hardware Attestation as Monopoly Enabler

#541

Post by peterm4 »

socalgal2 wrote: post #535
khriss wrote: post #528

The superhuman efforts that folks on HN make to find technical workarounds and solutions is wonderful to see, but we must realize that this is not a technical problem. It's a social and legislative one. It can't be fought on technical grounds. The push back has to be via putting pressure on politicians by making regular people more aware. Right now, the vast majority of users are being bombarded with a one sided narr…

> In my experience, once the issue is framed as 'Google will decide what you can do with your phone' every single person is immediately outraged. Apple already does this and practically no one is outraged

> It doesn't take much to convince them that Google et al don't have their best interests in mind. They already know it and have experienced it.

I think with Apple in particular, this is the issue. Apple have largely demonstrated that they _do_ often have the users best interests in mind (or at least at some point have had) on the basis that the users are Apple’s primary customers. Yes, Apple lock down iOS functionality but this has often been to deliver innovative features. Users don’t mind that they’re in a walled garden because, they like the walled garden.

This is where Google is a different case. Google’s interests are aligned with mass data collection rather than products people love. Most Google users have experienced how this impacts them negatively at some point, usually with the degradation of their products, and constant advert spam.

Google is an example of a company that the mass majority assumes to be in the wrong. Apple often isn’t.

Re: Hardware Attestation as Monopoly Enabler

#542

Post by sevenzero »

comandillos wrote: post #540
sevenzero wrote: post #539

Earlier quoted context omitted.

Because Apple always did this, everybody knew this and people buy Apple exactly because of this. Google now pulls the rug on Android which is a whole different story because it used to be open. The whole idea of Android was to be open.

The biggest mistake is that people trusted a company that, in reality, isn't that different from Apple. Just because everyone claimed Android as the true open source alternative to iOS, when only AOSP was that.

Yea agree. I reeeeally dont get why Google or Apple have good reputation at all.

Re: Hardware Attestation as Monopoly Enabler

#543

Post by khriss »

socalgal2 wrote: post #535
khriss wrote: post #528

The superhuman efforts that folks on HN make to find technical workarounds and solutions is wonderful to see, but we must realize that this is not a technical problem. It's a social and legislative one. It can't be fought on technical grounds. The push back has to be via putting pressure on politicians by making regular people more aware. Right now, the vast majority of users are being bombarded with a one sided narr…

> In my experience, once the issue is framed as 'Google will decide what you can do with your phone' every single person is immediately outraged. Apple already does this and practically no one is outraged

Yes, but most people don't realize it, simply because they have been conditioned from the beginning that the only way to run anything on an iOS device is via the app store.

With Apple customers, a better argument to make is to say that Apple applies a 30% 'tax' on all activity on their phones. That they are being forced to pay more compared to non Apple users in spite of having bought their device fair and square.

Re: Hardware Attestation as Monopoly Enabler

#544

Post by PxldLtd »

superloika wrote: post #507
brabel wrote: post #427

Earlier quoted context omitted.

As someone who wanted to improve users security, that’s exactly why I find this thread fanatical opposition to attestation baffling. Nearly everyone uses a device that supports hardware attestation. It’s the best available tool to protect users from malware. We do implement a fallback that lowers security but lets the few users who have devices not able to attest properly to continue, but that really lowers security…

If the price to pay for security is freedom, then let users's devices be insecure. With time, they will learn good security hygiene. And if they don't, maybe they don't deserve it.

I would be the safest citizen, free from experiencing crime and violence if I'm imprisoned in my house for life.

Re: Hardware Attestation as Monopoly Enabler

#545

Post by jeroenhd »

jorvi wrote: post #364
userbinator wrote: post #161

In 1999, Intel received an absolutely massive amount of opposition when they decided to include a software-readable serial number in their CPUs, so much that they reversed the decision. Then the "security" and Trusted Computing authoritarians continued pushing for TPMs and related tech, and contributed to the rise of mobile walled gardens. Windows 11's TPM requirements were another step towards their goal. The amount…

Weird rant. TPMs are great. The modern computing landscape needs a safe place to put secrets. It's what made the iPhone (Secure Enclave is effectively a TPM) years ahead of Android in terms of security. The problem isn't the TPM, but attestation. As soon as the TPM is required to not be under your control to get access to Y, bad things happen. Hell, in actuality, the problem isn't even attestation, its policy. The EU…

Attestation isn't even the problem. I'd love to be able to verify that my server's kernel hasn't been tampered with.

The problem lies in companies like Apple/Google/Microsoft rejecting attestation that they do not control.

People confusing big tech's policy choices with tech features have made "I want my laptop's auth token to only be usable on my laptop" a controversial opinion.

Re: Hardware Attestation as Monopoly Enabler

#546

Post by [deleted] »

monocasa wrote: post #126
grishka wrote: post #6

Our civilization desperately needs a method to modify modern microelectronics after manufacturing that can be used at least in a well-equipped repair shop, and it needs it yesterday. Alternatively, just make it illegal to ship any kind of initial bootloader as part of a CPU's/SoC's mask ROM in any computing device that is marketed as a general-purpose one. I.e. the first instruction that the CPU executes after reset…

That's probably not going to happen for a very long time. Relatively simple SoCs already do tons of work before the architectural reset vector in undocumented boot ROMs in order to assist the reset process. There's also tons of value in a boot ROM that can't be accidentally erased to add low level DFU routines.

[deleted]

Re: Hardware Attestation as Monopoly Enabler

#547

Post by ACCount37 »

monocasa wrote: post #126
grishka wrote: post #6

Our civilization desperately needs a method to modify modern microelectronics after manufacturing that can be used at least in a well-equipped repair shop, and it needs it yesterday. Alternatively, just make it illegal to ship any kind of initial bootloader as part of a CPU's/SoC's mask ROM in any computing device that is marketed as a general-purpose one. I.e. the first instruction that the CPU executes after reset…

That's probably not going to happen for a very long time. Relatively simple SoCs already do tons of work before the architectural reset vector in undocumented boot ROMs in order to assist the reset process. There's also tons of value in a boot ROM that can't be accidentally erased to add low level DFU routines.

Having DFU in BootROM is good. Having "secure boot" with only the vendor keys in BootROM is evil.

Re: Hardware Attestation as Monopoly Enabler

#548

Post by ACCount37 »

userbinator wrote: post #101
grishka wrote: post #6

Our civilization desperately needs a method to modify modern microelectronics after manufacturing that can be used at least in a well-equipped repair shop, and it needs it yesterday. Alternatively, just make it illegal to ship any kind of initial bootloader as part of a CPU's/SoC's mask ROM in any computing device that is marketed as a general-purpose one. I.e. the first instruction that the CPU executes after reset…

Alternatively, just make it illegal to ship any kind of initial bootloader as part of a CPU's/SoC's mask ROM in any computing device that is marketed as a general-purpose one. No, you just need to make it illegal to have the bootloader contain hardcoded key material and use it for verifying the code it loads.

Most of those are less "hardcoded" and more "fused into internal non-eraseable memory at manufacturing time".

Not that it changes much. It really should be illegal to enforce "secure boot" with no way for the device owner to opt out of it or enroll his own keys.

Re: Hardware Attestation as Monopoly Enabler

#549

Post by jeroenhd »

jojobas wrote: post #377
jorvi wrote: post #364

Earlier quoted context omitted.

Weird rant. TPMs are great. The modern computing landscape needs a safe place to put secrets. It's what made the iPhone (Secure Enclave is effectively a TPM) years ahead of Android in terms of security. The problem isn't the TPM, but attestation. As soon as the TPM is required to not be under your control to get access to Y, bad things happen. Hell, in actuality, the problem isn't even attestation, its policy. The EU…

TPMs add security against a narrow case of evil maid attacks. They might be useful for corporate computing (for cargo cult compliance purposes more than actual security) but they trojan horse more of "not owning the device you bought" with it to people that don't and shouldn't care about evil maid attacks at all.

Adding brute force resistance to consumer hardware is pretty useful. Now your password can be John1985 without fear of getting brute forced within seconds.

"I don't use a TPM in my computer so it shouldn't exist" has always sounded like a weird argument against the tech in my opinion.

Many Android phones have their secret storage implemented as a virtual machine rather than a TPM. The lack of a TPM doesn't suddenly give me any more freedom, although it does come with security downsides.

Re: Hardware Attestation as Monopoly Enabler

#550

Post by quietbritishjim »

peterm4 wrote: post #541
socalgal2 wrote: post #535

Earlier quoted context omitted.

> In my experience, once the issue is framed as 'Google will decide what you can do with your phone' every single person is immediately outraged. Apple already does this and practically no one is outraged

> It doesn't take much to convince them that Google et al don't have their best interests in mind. They already know it and have experienced it. I think with Apple in particular, this is the issue. Apple have largely demonstrated that they _do_ often have the users best interests in mind (or at least at some point have had) on the basis that the users are Apple’s primary customers. Yes, Apple lock down iOS functional…

Most people just do not think about this as much as we do.

We understand that, as the saying goes, if you're not paying for something then you are the product.

But less technical people don't consider that, and don't have hoards of technical friends to convince them otherwise. They just think: they using the product, so they're the user, right? We know that's true but it's not the same thing as customer. Most people don't have that distinction in their head.

It's even partially true that Google does want to do things that attracts and retains users, because that's a prerequisite for selling them to advertisers. In my experience, that's an upper bound on the amount of thought most non-technical people would give it.

Post reply on HN