German government warns Windows 8 is a security risk

Where do you see that a trusted party has full access? Yes, the NSA could probably create a Windows build with a backdoor, and forge a signature that the TPM would accept, but they could (and probably did) just ask Microsoft to do that and save the bother.

What attack vector, exactly, does the TPM enable that isn't present pre-TPM?

> The article is basically saying that, because the malware protection is not good enough (i.e. not securing against NSA malware), it's worse than no protection at all.

No. If the OS is locked down so only MS-signed applications can run, it is impossible to run software that can detect malware that has been approved by MS. It is also impossible to run software that can remove such malware.

If the OS makes it impossible to detect or remove malware, it is less secure than OS that do allow detection and removal of malware. This is not FUD.

What should happen, is that MS should be held strict liable for any illegal acts which their restrictions helps to propagate. Held under vicarious liability by non-US markets (so they can't get immunity by the US government), MS shareholders would demand the elimination of the restrictions in favor of less legal risk for the company.

I have a Windows 8 notebook and for the first time in my life I have no control over my own general purpose computer:

- I can't enter BIOS before entering OS.

- Once I enter the BIOS from the OS I can't activate the hard disk password.

- I can't install the Windows 8 OS clean. The MSFT has the deal with the computer producers that doesn't allow them to deliver the pure OS medium, you can only backup the already present installed files to some external HDD.

- Because of the previous and the fact that the binaries are controlled on the hardware level (TPM), I have no control of what's running on my computer -- I can't know, to be precise.

- It's even worse than that, there is some Intel built-in technology on the hardware/BIOS/drivers level which also has built-in "features" that allow communication with some external "command and control center" which I don't control. It supposedly allows, among other "features" disabling the notebook once it's stolen. But I don't control how it's done, and I don't know if it has additional backdoors. It proudly claims to facilitate "remote access."

It's scary how it looks like all together. I haven't even figured out how I'd be able to install Linux on the computer. In some forums people claim that the OEM should allow that, but apparently a lot of people haven't managed to actually install it on different specific computers -- there are BIOS problems that can't be avoided, and the OEMs don't give you support or the updates. Mine is an Intel i5 processor-based modern Acer. It's fast, but I have no control. Definitely not FUD.

Personally I like Apple approach more: thanks to their approach of the OSX or iOS (no third party pre-installed crap) at least I have to just trust Apple. Here I have to trust Microsoft, Intel and every company who has the drivers on my machine. Much more chance for some of them to do what they want, in the name of "cloud." Remember routers that are controlled from the producer of the router, even "protecting" you from browsing all the sites? Remember Android phones which upload all your passwords to the cloud of the mobile operator? That's where the "cloud" support of the driver writers goes now. It is scary.

(Globally, we're talking about this: http://xkcd.com/743/ -- We've been giving up the control of "infrastructures" for a long time)

The core-argument is that the Windows 8 way of using, implementing and enforcing TPM and establishing a so called feudal security approach isn't considered good security practice any longer.

It's not so hard to understand.

You are right that MSFT has the "update". The bigger problem with Windows 8 computers is that similar things are in practice available to all the "third parties" who have hardware or kernel-driver components. And you have less control than before about them all. It's a broader problem than just Microsoft.

The new "you as the user can't control the kernel stuff, even with the debugger" concept is really about the user (you) giving up the control. The excuse is that you as the user aren't supposed to be able to copy movies. In practice, you have no more control of your own computer whereas the companies have real-time control even of the content by directly controlling your computer. Some routers already did such stuff. It is really worrying -- having the part of the "great firewall of China/whateverothercountry" on your own computer which you paid with your own money.