Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft terminates VeraCrypt account, halting Windows updates

404media.co

Post reply on HN
Print view View original

101–110 of 259 posts

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#101

Post by PunchyHamster »

ghighi7878 wrote: post #67
tosti wrote: post #43

Earlier quoted context omitted.

Computers should abide by their owners. Any computer not doing that is broken.

Its a simple solution in law to enable. Force manufacturers to allow owners of computer to put any signing key in the BIOS. We need this law. Once we have this law, consumers csn get maximum benefit of secure boot withiut losing contorl

> Its a simple solution in law to enable. Force manufacturers to allow owners of computer to put any signing key in the BIOS.

...it's already allowed. The problem is that this isn't the default, but opt in that you need quite a lot of knowledge to set up

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#102

Post by kelseyfrog »

arcfour wrote: post #99
kelseyfrog wrote: post #94

Earlier quoted context omitted.

Anything that restricts user freedom is entirely bad, even if it's at the expense of security.

But...it doesn't restrict user freedom. If the user wishes to do so, they can disable SB.

They shouldn't _have_ to do anything. The point is that no demands should be placed upon users.

Same problem with age gating. It's fine, as long as zero additional demands are placed upon users.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#103

Post by riedel »

VadimPR wrote: post #58

A year ago I used Azure Trusted Signing to codesign FOSS software that I distribute for Windows. It was the cheapest way to give away free software on that platform. A couple of months ago I needed to renew the certificate because it expired, and I ran into the same issue as the author here - verification failed, and they refused to accept any documentation I would give them. Very frustrating experience, especially s…

I like the idea of a central signing authority for open source. While this might go against the spirit of open source, I think it eventually creates a critical mass and outcry if Microsoft or Google would play games with them. Also foundations might be a good way to protect against legal trouble distributing OSS under different regulations. I am imagining e.g. an FDroid that plays Googles game. With reproducible or at least audited builds also some trusted authorities could actually produce more trusted builds especially at times of supply chain attacks. However, I think such distribution authorities would need really good governance and a lot of funding.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#104

Post by Galanwe »

WhyNotHugo wrote: post #82
Galanwe wrote: post #72

Earlier quoted context omitted.

> id est provide guarantees to the customer that the firmware of the device they receive has not been tampered with The firmware of the device being a binary blob for the most part... Not like I trust it to begin with. Whereas my open source Linux distribution requires me to disables SecureBoot. What a world.

You can set up custom SecureBoot keys on your firmware and configure Linux to boot using it. There's also plenty of folks combining this with TPM and boot measurements. The ugly part of SecureBoot is that all hardware comes with MS's keys, and lots of software assume that you'll want MS in charge of your hardware security, but SecureBoot _can_ be used to serve the user. Obviously there's hardware that's the exception…

> You can set up custom SecureBoot keys on your firmware and configure Linux to boot using it.

Right, but as engineers, we should resist the temptation to equate _possible_ with _practical_.

The mere fact that even the most business oriented Linux distributions have issues playing along SecureBoot is worrying. Essentially, SB has become a Windows only technology.

The promise of what SB could be useful for is even muddier. I would argue that the chances of being victim of firmware tampering are pretty thin compared to other attack vectors, yet somehow we end up all having SB and its most significant achievement is training people that disabling it is totally fine.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#105

Post by jmye »

201984 wrote: post #30
astrobe_ wrote: post #25

Earlier quoted context omitted.

I don't know about executable signing, but in the embedded world SecureBoot is also used to serve the customer; id est provide guarantees to the customer that the firmware of the device they receive has not been tampered with at some point in the supply chain.

And what if that customer wants to run their own firmware, ie after the manufacturer goes out of business? "Security" in this case conveniently prevente that.

Then that customer shouldn't buy a device that doesn't allow for their use case. Exercise some personal agency. Sheesh.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#106

Post by CodesInChaos »

arcfour wrote: post #99
kelseyfrog wrote: post #94

Earlier quoted context omitted.

Anything that restricts user freedom is entirely bad, even if it's at the expense of security.

But...it doesn't restrict user freedom. If the user wishes to do so, they can disable SB.

And will then be locked out from an increasing amount of Applications, Media, and eventually even Websites.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#107

Post by arcfour »

serf wrote: post #97
arcfour wrote: post #91

Earlier quoted context omitted.

I strongly disagree on the Secure Boot front. It's necessary for FDE to have any sort of practical security, it reduces malicious/vulnerable driver abuse (making it nontrivial), bootkits are a security nightmare and would otherwise be much more common in malware typical users encounter, and ultimately the user can control their secure boot setup and enroll their own keys if they wish. Does that mean that Microsoft do…

>It's necessary for FDE to have any sort of practical security why? do you mean because evil maid attacks exist? anyone that cared enough about that specific vector just put their bootloader on a removable media. FDE wasn't somehow enabled by secure boot. >bootkits are a security nightmare and would otherwise be much more common in malware why weren't they more common before? serious question. Back in the 90s viruses…

> anyone that cared enough about that specific vector just put their bootloader on a removable media. FDE wasn't somehow enabled by secure boot.

Sure, but an attacker could still overwrite your kernel which your untouched bootloader would then happily run. With SB at least in theory you have a way to validate the entire boot chain.

> why weren't they more common before?

Because security of the rest of the system was not at the point where they made sense. CIH could wipe system firmware and physically brick your PC - why write a bootkit then? Malware then was also less financially motivated.

When malware moved from notoriety-driven to financially-driven in the 2000s, bootkits did become more common with things like Mebroot & TDL/Alureon. More recently, still before Secure Boot was widespread, we had things like the Classic Shell/Audacity trojan which overwrote your MBR: https://www.youtube.com/watch?v=DD9CvHVU7B4 and Petya ransomware. With SB this is an attack vector that has been largely rendered useless.

It's also a lot more difficult to write a malicious bootloader than it is to write a usermode app that runs itself at startup and pings a C2 or whatever.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#108

Post by UrMomsRobotLovr »

kelseyfrog wrote: post #102
arcfour wrote: post #99

Earlier quoted context omitted.

But...it doesn't restrict user freedom. If the user wishes to do so, they can disable SB.

They shouldn't _have_ to do anything. The point is that no demands should be placed upon users. Same problem with age gating. It's fine, as long as zero additional demands are placed upon users.

Are the demands that users become experts in provider their own security against more advanced actors not significantly worse? The control part is unfortunate but the defaults should make it so users can focus on sharing pictures of cats without fear or need for advanced cyber security knowledge.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#109

Post by realusername »

petcat wrote: post #85
mort96 wrote: post #81

Earlier quoted context omitted.

No it doesn't? The factory programs in the secure boot public keys

The public keys are provided by the developer. Google, or Apple, for example. It's how they know that nothing was tampered with before it left the factory.

Nothing has been tampered with doesn't mean there's no factory backdoor, it just only means same as factory, nothing more.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#110

Post by arcfour »

CodesInChaos wrote: post #106
arcfour wrote: post #99

Earlier quoted context omitted.

But...it doesn't restrict user freedom. If the user wishes to do so, they can disable SB.

And will then be locked out from an increasing amount of Applications, Media, and eventually even Websites.

I run Linux with Secure Boot and I don't feel locked out of any media, applications, or websites.

My mom uses Secure Boot with Windows and doesn't know or care that it's enabled at all.

Post reply on HN