Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The GPU, not the TPM, is the root of hardware DRM

mjg59.dreamwidth.org

Post reply on HN
Print view View original

201–210 of 493 posts

Re: The GPU, not the TPM, is the root of hardware DRM

#201

Post by p_ing »

sidewndr46 wrote: post #198
p_ing wrote: post #103

Earlier quoted context omitted.

> TPM provides no added security value for the vast majority of users[1] Yes it does. The vast majority of users aren't going to have their laptop stolen by the CIA/NSA and have their DIMMs popped and cryofreezed. The vast majority of users aren't going to have the case opened and a special-purpose PCIe device installed to steal keys over DMA. The vast majority of users aren't going to have a dTPM vulnerable to SPI s…

What is the argument here about the CIA / NSA or any other US Federal 3 letter agency? If your device is secured via TPM or some other scheme that relies on an industry to secure your device they aren't going to be doing "DIMM popping". They are just going to get the master keys from whomever issued them and use that bypass whatever they need to on the device.

You're missing the forest.

The point being is that Microsoft's implementation on Win 11 Home ("device encryption", aka unconfigurable BitLocker) is sufficient for nearly all of their user base. If you're a target of a 3-letter agency, additional security measures are required.

Re: The GPU, not the TPM, is the root of hardware DRM

#202

Post by Neonlicht »

theshackleford wrote: post #195
soerxpso wrote: post #61

Earlier quoted context omitted.

It doesn't matter at all how out of reach it is for most people. As long as one kid in Russia can do it, the torrent is available for everyone in the world just as soon. This has already been shown with videogame DRM like Denuvo. It's so hard to crack that only a handful of people know how, and yet they end up racing eachother so eagerly every time a new game comes out that it's usually done in under 24 hours. Unless…

> This has already been shown with videogame DRM like Denuvo. No it hasn’t. > Everytime a new game comes out that it’s usable done in under 24 hours This is not even remotely true and is not based in any kind of reality.

Back in the day when piracy was quite literally just copy and paste it was a very active scene.

But cracking Denuvo takes real skill- and there's no financial reward in it. Back in the 90s bootleg DVDs and CD-ROMs had organised crime making money from it.

Re: The GPU, not the TPM, is the root of hardware DRM

#203

Post by p_ing »

baby_souffle wrote: post #108
tedunangst wrote: post #80

Earlier quoted context omitted.

This is rather contradictory. There's way less friction to selling Windows 11 licenses to existing hardware owners. Requiring a new PC only means fewer people will be running 11.

> This is rather contradictory. Not necessarily. I'd bet that the fraction of $ microsoft makes from selling windows licenses _retail_ is a rounding error away from zero compared to what they get selling bulk/volume licenses to corporate / OEM. It's in microsoft's interest to make sure that dell/hp/lenovo ... etc have reasons to keep buying licenses to put on the new computers they're selling. I suspect that TPM is a…

> Not necessarily. I'd bet that the fraction of $ microsoft makes from selling windows licenses _retail_ is a rounding error away from zero compared to what they get selling bulk/volume licenses to corporate / OEM.

Corporate customers already have a VLK which will cover Windows 11 [Pro/Enterprise]. The hardware is the only cost for VLK customers -- Windows licensing is already covered under the existing Enterprise Agreement. EAs often have current version and current version - 1 covered, thus a VLK will entitle one to both Windows 10 and 11 as of today.

It would be odd to think that corporate customers haven't been using BitLocker w/ TPM since at least Windows 7, if not Vista. FDE has been a Corporate Security Checkmark(TM) since it became available.

> I suspect that TPM is about making the PC less open than it traditionally has been.

By traditionally, do you mean prior to 2006 as that is when we first saw and started using TPMs?

Re: The GPU, not the TPM, is the root of hardware DRM

#204

Post by sidewndr46 »

p_ing wrote: post #200
sidewndr46 wrote: post #196

Earlier quoted context omitted.

But it doesn't even do that. If I want to perform the "evil maid" attack why would I screw around with the bootloader? I'm just going to replace the entire device with something that captures the password & sends it to me remotely.

I'm not groking what you're saying. Replace what "entire device"?

You're at an industry conference. I want the data on your laptop's hard drive. You leave your laptop in the hotel room. Which one is easier:

1. Go into your room and screw around with the boot loader to somehow give me unencrypted access to your laptop after you login next time.

2. Go into your room. Take your laptop. Put an identical looking laptop in place that runs software that boots and looks identical. Have it send me all of your password attempts over WiFi to my van in the parking lot.

I'm going with option 2 every time. I have your original device. I have your password. TPM, SecureBoot, or whatever is irrelevant at this point.

Re: The GPU, not the TPM, is the root of hardware DRM

#205

Post by buran77 »

sidewndr46 wrote: post #204
p_ing wrote: post #200

Earlier quoted context omitted.

I'm not groking what you're saying. Replace what "entire device"?

You're at an industry conference. I want the data on your laptop's hard drive. You leave your laptop in the hotel room. Which one is easier: 1. Go into your room and screw around with the boot loader to somehow give me unencrypted access to your laptop after you login next time. 2. Go into your room. Take your laptop. Put an identical looking laptop in place that runs software that boots and looks identical. Have it…

The attacker must be able to fake any pre-boot drive unlock screen and OS login screen to look exactly as the user's real screens but accept any password.

Legend goes that security oriented people will visually customize their machines with stickers (and their associated aging patina) and all kinds of digital cues on the different screens just to recognize if anything was changed.

MS chose to impose TPM because it allows encryption without interactive password typing (BitLocker without PIN or password which is what most machines are running). That's it. The users get all the convenience of not having to type extra passwords when the machine starts, and some (not all) of the security offered by encryption. Some curious thief can't just pop your drive into their machine and check for nudes. The TPM is not there to protect against NSA, or proverbial $5 wrench attacks but as a thick layer of convenience over the thinner layer of security.

Re: The GPU, not the TPM, is the root of hardware DRM

#206

Post by HeatrayEnjoyer »

wkat4242 wrote: post #181
XorNot wrote: post #161

Earlier quoted context omitted.

No one wants a preboot password though. TPM means the system can boot and then do face login or whatever using the user's password in exactly one place. This is as much as most users will tolerate. And it also means Microsoft account recovery can work to unlock a forgotten password. The whole point is Microsoft don't want user devices to ever be trivially bypassed, regardless of how unlikely that is (probably more li…

Every phone has it these days. Doesn't seem to be a big deterrent? Laptops also need a password to log in. In fact in many cases a preboot password is safer. Because the comms between the TPM and the OS can often be sniffed. And if the TPM doesn't need validation because it hands off its keys, it can be bypassed that way. Again not really something that consumers have to worry about, but it's not quite difficult anym…

TPM 2.0 uses encrypted bus. TPMs are also often built into the CPU

Re: The GPU, not the TPM, is the root of hardware DRM

#207

Post by tasn »

soerxpso wrote: post #61
tasn wrote: post #20

Earlier quoted context omitted.

The end goal is DRM all the way to the screen. No capture cards will be allowed. It's a cat and mouse game, but I wouldn't discount these efforts as a mere speed bump. Screen enforced DRM will make things much harder. A motivated individual with the right tools and hardware hacking know how may be able to jailbreak a screen to record stuff, but that's going to make things out of reach for most people.

It doesn't matter at all how out of reach it is for most people. As long as one kid in Russia can do it, the torrent is available for everyone in the world just as soon. This has already been shown with videogame DRM like Denuvo. It's so hard to crack that only a handful of people know how, and yet they end up racing eachother so eagerly every time a new game comes out that it's usually done in under 24 hours. Unless…

Not quite. The problem is that when you involve hardware, things are exponentially harder. When you tie it with content streaming, it's essentially a losing battle.

Hardware: makes cracking much much harder and out of reach for a lot of people. Even the people that can do it are going to be drastically slowed down due to this.

Streaming: means you can block specific device keys once you know they are compromised (the hacker managed to mod the TV to be able to record from it).

Re: The GPU, not the TPM, is the root of hardware DRM

#208

Post by everdrive »

osy wrote: post #26

> I'm going to be honest here and say that I don't know what Microsoft's actual motivation for requiring a TPM in Windows 11 is. It is quite obvious: to force people to buy a new PC. TPM provides no added security value for the vast majority of users[1] but it is a convenient hardware that has only started to become standard (fTPM) in PCs built in the last ~8 years so it provides an excuse for Microsoft to declare co…

I'm embarrassed to admit that I don't actually understand what a TPM does. My vague and probably incorrect impression is that it performs some sort of encrypted verification of firmware or hardware modules? Can anyone expand on what this does? My impression would be that this is not useful for most users, and would be much of a concern in industrial espionage situations. I have no confidence that I'm correct here.

Re: The GPU, not the TPM, is the root of hardware DRM

#209

Post by WorldMaker »

jsnell wrote: post #124
wtallis wrote: post #118

Earlier quoted context omitted.

> If that was the motivation, there's a far more direct option available. Just charge for the upgrade. That's a far more direct option, which also largely doesn't work . Corporate IT doesn't like doing in-place major OS upgrades. Consumers just plain won't , unless it's free and easy.

Sure, let's say that's true. The obvious implication is that these users actually don't care about whether they're running Windows 11 or not, and thus the Windows 11 TPM requirement is utterly irrelevant in their decision to buy a new computer. I don't see how this supports the theory that this is all about revenue from Windows OEM licenses from forced hardware upgrades.

The theory, as I understand it, is that the wider ecosystem of OEMs is better at selling new hardware than Microsoft alone is at selling Windows upgrades. The users don't care what makes new hardware "new hardware", just that a dozen different companies are telling them that "new hardware" is exciting to buy for the holidays and "more secure" and "better". The TPM requirement on paper is an easy shibboleth for "more secure", so an easy thing to sell through the multi-channel telephone game of OEMs to ad companies to retail stores to mainstream zeitgeist. They don't have to just take Microsoft's word that Windows 11 is "better", they have "word on the street" and their pal who works "Geek Squad" at Best Buy and all those HP commercials on TV telling them they need a new Windows 11 machine for "more secure" hardware.

(I think it is gross that this is how Microsoft and the PC OEMs think is the best way to increase revenue together, but I think there's enough evidence that this theory is relatively accurate portrait of one of the factors for why Windows 11 is the way that it is.)

Re: The GPU, not the TPM, is the root of hardware DRM

#210

Post by happymellon »

sidewndr46 wrote: post #204
p_ing wrote: post #200

Earlier quoted context omitted.

I'm not groking what you're saying. Replace what "entire device"?

You're at an industry conference. I want the data on your laptop's hard drive. You leave your laptop in the hotel room. Which one is easier: 1. Go into your room and screw around with the boot loader to somehow give me unencrypted access to your laptop after you login next time. 2. Go into your room. Take your laptop. Put an identical looking laptop in place that runs software that boots and looks identical. Have it…

Passwords are generally defeated by a hammer to the fingers.

Repeat until password is extracted.

Post reply on HN