Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The GPU, not the TPM, is the root of hardware DRM

mjg59.dreamwidth.org

Post reply on HN
Print view View original

181–190 of 493 posts

Re: The GPU, not the TPM, is the root of hardware DRM

#181

Post by wkat4242 »

XorNot wrote: post #161
wkat4242 wrote: post #152

Earlier quoted context omitted.

> That's kind of the point. The vast majority of users aren't going to have their laptop stolen at all, if they do it will 99% of the time be by someone who only wants to wipe it and fence it, and attempts to access data are most likely to be by unsophisticated family members who would be defeated by a simple password without any TPM. True, any preboot password method (even fully software) will be sufficient to preve…

No one wants a preboot password though. TPM means the system can boot and then do face login or whatever using the user's password in exactly one place. This is as much as most users will tolerate. And it also means Microsoft account recovery can work to unlock a forgotten password. The whole point is Microsoft don't want user devices to ever be trivially bypassed, regardless of how unlikely that is (probably more li…

Every phone has it these days. Doesn't seem to be a big deterrent? Laptops also need a password to log in.

In fact in many cases a preboot password is safer. Because the comms between the TPM and the OS can often be sniffed. And if the TPM doesn't need validation because it hands off its keys, it can be bypassed that way.

Again not really something that consumers have to worry about, but it's not quite difficult anymore to pull this off.

Re: The GPU, not the TPM, is the root of hardware DRM

#182

Post by BlueTemplar »

torginus wrote: post #144
osy wrote: post #26

> I'm going to be honest here and say that I don't know what Microsoft's actual motivation for requiring a TPM in Windows 11 is. It is quite obvious: to force people to buy a new PC. TPM provides no added security value for the vast majority of users[1] but it is a convenient hardware that has only started to become standard (fTPM) in PCs built in the last ~8 years so it provides an excuse for Microsoft to declare co…

hard disagree. All security requires a root of trust. If you don't have that, how can you ensure you're not running on a mailicious hypervisor, you've not loaded any bad drivers etc. You can only guess, and badly at that. Because we don't have it, that's why we get crap like kernel-level anti-cheat, various 'security' solutions made by companies of dubious reputation and technical ability, just because you refused to…

And trusting Microsoft is the equivalent of thinking the Earth is flat.

See, I can make insulting comparisons too...

Re: The GPU, not the TPM, is the root of hardware DRM

#183

Post by snvzz »

CamperBob2 wrote: post #5
shmerl wrote: post #3

DMCA 1201 should be reversed and DRM itself should be illegal.

DRM shouldn't be illegal, but works protected by DRM should be ineligible for copyright protection unless a key is placed in escrow somewhere. Basically, rightsholders should be be able to choose enforceable legal protection or unbreakable technological protection, but not both. Copyright was supposed to be a two-way street, but DRM permanently barricades one lane.

>should be be able to choose enforceable legal protection or unbreakable technological protection

No. The latter would effectively mean rightsholders make their own laws, rather than follow the law.

DRM should simply be abolished, as it interferes with the premise of copyright: To grow the public domain.

Re: The GPU, not the TPM, is the root of hardware DRM

#184

Post by jasomill »

Rohansi wrote: post #92
osy wrote: post #26

> I'm going to be honest here and say that I don't know what Microsoft's actual motivation for requiring a TPM in Windows 11 is. It is quite obvious: to force people to buy a new PC. TPM provides no added security value for the vast majority of users[1] but it is a convenient hardware that has only started to become standard (fTPM) in PCs built in the last ~8 years so it provides an excuse for Microsoft to declare co…

Requiring TPM can actually benefit multiplayer video games because it introduces a secure way to identify hardware being used by cheaters. Right now everything being used by games is easily spoofed by cheats so cheaters just need to get a new account to continue cheating after being banned.

While I have no idea how (or even if) it's being used, League of Legends requires TPM 2.0 to be present and enabled on Windows 11 PCs:

https://support-leagueoflegends.riotgames.com/hc/en-us/artic...

Re: The GPU, not the TPM, is the root of hardware DRM

#185

Post by BlueTemplar »

stackghost wrote: post #60
talldayo wrote: post #24

Earlier quoted context omitted.

I think that's a misunderstanding of what the FSF stands for overall, though. The FSF can never be a diplomatic negotiator for the benefit of free software; they are idealists, even when it serves against their own interests. Their whole shtick is not settling for half-baked appeasements, and so they're destined to be a pariah of the tech industry at-large. Neither you nor me can stop them, it's entirely within their…

There's no misunderstanding on my part; it's why I said that their ignorance is totally on-brand. >more like the mainstream has abandoned free software. Indeed, because free software development is largely driven by ideological purity rather than feature parity. Mainstream users see Free Software people as irrelevant kooks, and thus easy to dismiss, which is why Free Software has so utterly failed as a movement. >You…

The flat earthers are the people dismissing the concerns of the FSF though.

(The Earth being round doesn't directly matter in practice to most people. It does have inevitable consequences though.)

Or perhaps a better example is anthropogenic climate change : here too the implications are extremely inconvenient for most people, so denial is rampant.

Re: The GPU, not the TPM, is the root of hardware DRM

#186

Post by p_l »

pjmlp wrote: post #156
p_l wrote: post #125

Earlier quoted context omitted.

It was a big deal when Vista was released, with coincided with a lot of generational change in home computers (Watching Blu-Ray on computer still seemed to be a thing to expect, HDMI with HDCP was introduced, etc). There was a lot of talk about protected media path in Vista, how it linked with HDCP, how it killed hardware accelerated audio (including causing considerable death blow to promises made by OpenAL), etc.

Even game consoles moved into software accelerated audio, as it turns out doing it in software, with CPU vector instructions is fast enough, while being more flexible. This is also the way of the future for graphics, do way with any kind of hardware pipelines, and go back to software rendering, but having it accelerated on the GPU, as general purpose accelerator device.

EAX and the like were actually that - software components running on DSP inside sound card, and it was supposed that they would be something you would handle in the future akin to how GPUs are programmed.

However while audio accelerators came back the protected media path business means they aren't "generally programmable" from major OS APIs even when both AMD and Intel essentially ended up settling on common architecture including ISA (Xtensa w/ DSP extensions, iirc), and are mainly handled through device specific blobs with occassional special features (like sonar style presence detection)

Re: The GPU, not the TPM, is the root of hardware DRM

#187

Post by jasomill »

santoshalper wrote: post #34
osy wrote: post #26

> I'm going to be honest here and say that I don't know what Microsoft's actual motivation for requiring a TPM in Windows 11 is. It is quite obvious: to force people to buy a new PC. TPM provides no added security value for the vast majority of users[1] but it is a convenient hardware that has only started to become standard (fTPM) in PCs built in the last ~8 years so it provides an excuse for Microsoft to declare co…

If you're going to run Windows 11 anyway, why would Microsoft care if you do it on a new or older PC?

Customers are typically unhappy when Microsoft refuses to fix critical bugs that only arise when running Windows on older hardware.

To the average user, "Windows installs without error and hardware appears to work" = "Microsoft supports running Windows on this hardware", even if the hardware is EOL and requires drivers that haven't been updated since Windows Vista.

Re: The GPU, not the TPM, is the root of hardware DRM

#188

Post by zinekeller »

mjw_byrne wrote: post #172
XorNot wrote: post #161

Earlier quoted context omitted.

No one wants a preboot password though. TPM means the system can boot and then do face login or whatever using the user's password in exactly one place. This is as much as most users will tolerate. And it also means Microsoft account recovery can work to unlock a forgotten password. The whole point is Microsoft don't want user devices to ever be trivially bypassed, regardless of how unlikely that is (probably more li…

"No one wants a preboot password though" - really? Doesn't strike me as particularly inconvenient, especially given the relative rarity of actual bootups these days. I've been using bog-standard FDE for as long as I can remember. One extra password entry per bootup for almost-perfect security seems like great value to me.

It seems that you're looking at the wrong bubble here. Most people actually detests passwords and would rather use a different method if possible (this is why ordinary users turn on biometric authentication despite some here questioning its security). Adding another password will certainly make users - especially enterprises - complain.

Also for technical reasons, Windows can't do the fancy one login/password screen (which assumes a file-level encryption, which is how it is implemented nowadays to support multiple users [1] [2]). This is due to Windows software that are expecting that everything is an ordinary file (unlike Apple which don't care on that aspect and Android which has compartmentalized storage). Even if we have an EFS-style encryption here, it will be incompatible with enterprise authentication solutions.

1: https://support.apple.com/guide/security/encryption-and-data...

2: https://source.android.com/docs/security/features/encryption

Re: The GPU, not the TPM, is the root of hardware DRM

#189

Post by andy81 »

dataflow wrote: post #179
AnthonyMouse wrote: post #131

Earlier quoted context omitted.

So is an authenticator app. Also, SMS isn't , because attackers often get access to the SMS network itself (see e.g. Salt Typhoon) in which case they can do automatic mass account stealing because they can see all the totally unencrypted SMS codes. The security of SMS really is that bad.

> attackers often get access to the SMS network itself (see e.g. Salt Typhoon) "Often"?

Bit of an understatement, should be "always have access" if state attackers are included in the threat model.

Re: The GPU, not the TPM, is the root of hardware DRM

#190

Post by baybal2 »

AnthonyMouse wrote: post #127
p_ing wrote: post #103

Earlier quoted context omitted.

> TPM provides no added security value for the vast majority of users[1] Yes it does. The vast majority of users aren't going to have their laptop stolen by the CIA/NSA and have their DIMMs popped and cryofreezed. The vast majority of users aren't going to have the case opened and a special-purpose PCIe device installed to steal keys over DMA. The vast majority of users aren't going to have a dTPM vulnerable to SPI s…

> The vast majority of users aren't going to have their laptop stolen by the CIA/NSA and have their DIMMs popped and cryofreezed. That's kind of the point. The vast majority of users aren't going to have their laptop stolen at all, if they do it will 99% of the time be by someone who only wants to wipe it and fence it, and attempts to access data are most likely to be by unsophisticated family members who would be de…

[dead]
Post reply on HN