Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft terminates VeraCrypt account, halting Windows updates

404media.co

Post reply on HN
Print view View original

141–150 of 259 posts

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#141

Post by Zak »

gjsman-1000 wrote: post #41
samlinnfer wrote: post #40

Earlier quoted context omitted.

And where are the stats for people running their own firmware and are not running stalkerware for comparison? You don’t need firmware access to install malware on Android, so how many of stalkerware victims actually would have been saved by a locked bootloader?

The entirety of GrapheneOS is about 200K downloads per update. Malicious use therefore is roughly 5-1. > You don’t need firmware access to install malware on Android, so how many of stalkerware victims actually would have been saved by a locked bootloader? With a locked bootloader, the underlying OS is intact, meaning that the privileges of the spyware (if you look in the right settings panel) can easily be detected,…

This assumes a high level of technical skill and effort on the part of the stalkerware author, and ignores the unlocked bootloader scare screen most devices display.

If someone brought me a device they suspected was compromised and it had an unlocked bootloader and they didn't know what an unlocked bootloader, custom ROM, or root was, I'd assume a high probability the OS is malicious.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#142

Post by fsflover »

arcfour wrote: post #91
romaniv wrote: post #22

I still hope that one of these days people in general will realize that executable signing and SecureBoot are specifically designed for controlling what a normal person can run, rather than for anything resembling real security. The premises of either of those "mitigations" make absolutely no sense for personal computers.

I strongly disagree on the Secure Boot front. It's necessary for FDE to have any sort of practical security, it reduces malicious/vulnerable driver abuse (making it nontrivial), bootkits are a security nightmare and would otherwise be much more common in malware typical users encounter, and ultimately the user can control their secure boot setup and enroll their own keys if they wish. Does that mean that Microsoft do…

Instead of proprietary SecureBoot controlled by megacorps, you can use TPM with Heads based entirely on FLOSS with a hardware key like Librem Key. Works for me and protects from the Evil Maid attack.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#143

Post by fsflover »

bakugo wrote: post #128
jmye wrote: post #105

Earlier quoted context omitted.

Then that customer shouldn't buy a device that doesn't allow for their use case. Exercise some personal agency. Sheesh.

What happens when there are no more devices that allow for that use case? This is already pretty much the case for phones, it's only a matter of time until Microsoft catches up.

There are still phones not obeying the megacorps. Sent from my Librem 5.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#144

Post by TitaRusell »

gusfoo wrote: post #120
romaniv wrote: post #22

I still hope that one of these days people in general will realize that executable signing and SecureBoot are specifically designed for controlling what a normal person can run, rather than for anything resembling real security. The premises of either of those "mitigations" make absolutely no sense for personal computers.

> I still hope that one of these days people in general will realize that executable signing and SecureBoot are specifically designed for controlling what a normal person can run, rather than for anything resembling real security For home/business users I'd agree. But in Embedded / money-handling then it's a life-saver and a really important technology.

Videogames are increasingly demanding secure boot.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#145

Post by jrm4 »

arcfour wrote: post #91
romaniv wrote: post #22

I still hope that one of these days people in general will realize that executable signing and SecureBoot are specifically designed for controlling what a normal person can run, rather than for anything resembling real security. The premises of either of those "mitigations" make absolutely no sense for personal computers.

I strongly disagree on the Secure Boot front. It's necessary for FDE to have any sort of practical security, it reduces malicious/vulnerable driver abuse (making it nontrivial), bootkits are a security nightmare and would otherwise be much more common in malware typical users encounter, and ultimately the user can control their secure boot setup and enroll their own keys if they wish. Does that mean that Microsoft do…

Secure Boot provides no useful security for an individual user on the machine they own, and as such should be disabled by default.

If you want to enable it for enterprise/business situations, thats fine, but one should be clear about that. Otherwise you get the exact Microsoft situation you mentioned and also no one knows about it.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#146

Post by jrm4 »

dwattttt wrote: post #135
thisislife2 wrote: post #131

Earlier quoted context omitted.

Do you lock your house or car and permanently handover the keys to some stranger, who you then have to depend on always to lock or unlock it for you?

No? I have locks on my house and car that I have the keys for. That an argument _for_ secure boot.

It is absolutely not.

It's a decent one for "locks on an apartment building that someone else owns."

But no, purchasing a house ought not include by default "a set of locks that you must work around, permission-wise."

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#147

Post by bakugo »

fsflover wrote: post #143
bakugo wrote: post #128

Earlier quoted context omitted.

What happens when there are no more devices that allow for that use case? This is already pretty much the case for phones, it's only a matter of time until Microsoft catches up.

There are still phones not obeying the megacorps. Sent from my Librem 5.

Does your Librem 5 run banking apps, though?

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#148

Post by AnthonyMouse »

riedel wrote: post #103
VadimPR wrote: post #58

A year ago I used Azure Trusted Signing to codesign FOSS software that I distribute for Windows. It was the cheapest way to give away free software on that platform. A couple of months ago I needed to renew the certificate because it expired, and I ran into the same issue as the author here - verification failed, and they refused to accept any documentation I would give them. Very frustrating experience, especially s…

I like the idea of a central signing authority for open source. While this might go against the spirit of open source, I think it eventually creates a critical mass and outcry if Microsoft or Google would play games with them. Also foundations might be a good way to protect against legal trouble distributing OSS under different regulations. I am imagining e.g. an FDroid that plays Googles game. With reproducible or a…

There is no real advantage of a central signing authority. If you use Debian the packages are signed by Debian, if you use Arch they're signed by Arch, etc. And then if one of them gets compromised, the scope of compromise is correspondingly limited.

You also have the verification happening in the right place. The person who maintains the Arch curl package knows where they got it and what changes they made to it. Some central signing authority knows what, that the Arch guy sent them some code they don't have the resources to audit? But then you have two different ways to get pwned, because you get signed malicious code if a compromised maintainer sends it to the central authority be signed or if the central authority gets compromised and signs whatever they want.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#149

Post by robotresearcher »

jrm4 wrote: post #146
dwattttt wrote: post #135

Earlier quoted context omitted.

No? I have locks on my house and car that I have the keys for. That an argument _for_ secure boot.

It is absolutely not. It's a decent one for "locks on an apartment building that someone else owns." But no, purchasing a house ought not include by default "a set of locks that you must work around, permission-wise."

Funnily enough, when you buy a house, the first task is to change all the locks.

Y’know, for security.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#150

Post by fl0id »

riedel wrote: post #103
VadimPR wrote: post #58

A year ago I used Azure Trusted Signing to codesign FOSS software that I distribute for Windows. It was the cheapest way to give away free software on that platform. A couple of months ago I needed to renew the certificate because it expired, and I ran into the same issue as the author here - verification failed, and they refused to accept any documentation I would give them. Very frustrating experience, especially s…

I like the idea of a central signing authority for open source. While this might go against the spirit of open source, I think it eventually creates a critical mass and outcry if Microsoft or Google would play games with them. Also foundations might be a good way to protect against legal trouble distributing OSS under different regulations. I am imagining e.g. an FDroid that plays Googles game. With reproducible or a…

isn't the issue more that this also needs to be included by default in Windows?
Post reply on HN