Live data from Hacker News

Breaking the Chain

googleprojectzero.blogspot.com

11–18 of 18 posts

Re: Breaking the Chain

#11
post #10

"The Win32k filter is already used in Edge, however at the moment only Microsoft can use it as the executable signature is checked before allowing the filter to be enabled." I find this disturbing and anti-competitive. Microsoft is clearly giving Edge an edge here (pun intended).

Is the "edge" the same advantage chrome has on a chromebook? semi-serious question.

Re: Breaking the Chain

#12
post #8

Earlier quoted context omitted.

Windows has it's own crypto api, I'm pretty sure the drivers would use that. And why would game companies want to kill streaming? It's free advertising, not to mention that they all probably dream of making the next dota.

> And why would game companies want to kill streaming? Never underestimate the power of human greed. Apple (with iTunes) has proved that the availability of unprotected content doesn't hurt the bottom line, and when I go into a store today and buy a physical CD-ROM it more often than not lacks any copy protection. And this has been the situation for years. Meanwhile, the movie industry is soundly asleep at the wheel…

> Meanwhile, the movie industry is soundly asleep at the wheel and its execs don't recognize that the consumer demands (near-instant access, no copy protection, no unskippable FBI warnings, no unskippable teasers, and no freaking region lock) have greatly diverged from their offerings.

Are you implying that people still use DVDs or Blu-rays?

If you are, I got genuinely curious, because in Brazil at least, I'm quite certain they got nearly extinct. Here, is Netflix, cable (or satellite), online "channels" as HBO-Go or torrent.

Based on that, it appears to me that consumer demands already won.

Re: Breaking the Chain

#13
So tomorrow Microsoft ships an update for Windows that causes a runtime function to call an additional Win32k function and suddenly Chrome crashes?

This seems somewhat impossible to maintain.

Re: Breaking the Chain

#14
post #12

Earlier quoted context omitted.

> And why would game companies want to kill streaming? Never underestimate the power of human greed. Apple (with iTunes) has proved that the availability of unprotected content doesn't hurt the bottom line, and when I go into a store today and buy a physical CD-ROM it more often than not lacks any copy protection. And this has been the situation for years. Meanwhile, the movie industry is soundly asleep at the wheel…

> Meanwhile, the movie industry is soundly asleep at the wheel and its execs don't recognize that the consumer demands (near-instant access, no copy protection, no unskippable FBI warnings, no unskippable teasers, and no freaking region lock) have greatly diverged from their offerings. Are you implying that people still use DVDs or Blu-rays? If you are, I got genuinely curious, because in Brazil at least, I'm quite c…

Walmart has a huge selection. People buy them. Even the local grocery chain has all the new releases. People stay renting at the Redbox, too. I don't know what the absolute numbers are on the industry but plenty of people like them.

Re: Breaking the Chain

#15
post #8

Earlier quoted context omitted.

Windows has it's own crypto api, I'm pretty sure the drivers would use that. And why would game companies want to kill streaming? It's free advertising, not to mention that they all probably dream of making the next dota.

> And why would game companies want to kill streaming? Never underestimate the power of human greed. Apple (with iTunes) has proved that the availability of unprotected content doesn't hurt the bottom line, and when I go into a store today and buy a physical CD-ROM it more often than not lacks any copy protection. And this has been the situation for years. Meanwhile, the movie industry is soundly asleep at the wheel…

Streaming solved one of gaming's core problem of letting people demo software without harming sales. That's a major benefit for effectively zero cost. So sure, there are always plenty of dumb companies out there, but the major players are not clueless.

Re: Breaking the Chain

#16
post #3

Is it just me, or does it seem trivial to MitM this HDCP API by just faking out the certificate chain, then faking out the method return values? > Fortunately this doesn’t compromise the security guarantees of the original API because of the way Microsoft designed it. To prevent a MitM attack against the API calls (i.e. you hook the API and return the answer the caller expects, such as HDCP is enabled) the call is se…

You know what I'm waiting for? When game manufacturers start to require HDCP. The outrage of the youtube gamer kiddies (I personally dislike them all, but hey, they got enough influence) when they can't stream their stuff any more is going to be priceless and maybe enough to finally burn down the HDCP/DRM towers. Or when someone develops a malware that exploits vulnerabilities in the x.509 code. I mean, if it's prope…

It might just be that I hang out with more indie games; but I can't really see that happening. My sense is that the gaming industry has come to realize view the youtubers/twitchers as a form of free advertisement. Heck, a lot of game companies are giving their product away to streamers with a sufficient audience. Some even have built in twitch integration.

I suspect we will see a divergence between "gamy" games and story based games; with the latter being harsher of streamers.

Re: Breaking the Chain

#17

So tomorrow Microsoft ships an update for Windows that causes a runtime function to call an additional Win32k function and suddenly Chrome crashes? This seems somewhat impossible to maintain.

They've had similar problems with Windows 10 updates and other security measures. Yes, it's a headache.

Re: Breaking the Chain

#18
post #3

Is it just me, or does it seem trivial to MitM this HDCP API by just faking out the certificate chain, then faking out the method return values? > Fortunately this doesn’t compromise the security guarantees of the original API because of the way Microsoft designed it. To prevent a MitM attack against the API calls (i.e. you hook the API and return the answer the caller expects, such as HDCP is enabled) the call is se…

How would you get a key pair and certificate signed by Microsoft? The root certificate for this system is fixed so you can't just use your own.
Post reply on HN