Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The GPU, not the TPM, is the root of hardware DRM

mjg59.dreamwidth.org

Post reply on HN
Print view View original

251–260 of 493 posts

Re: The GPU, not the TPM, is the root of hardware DRM

#251

Post by dingnuts »

michaelt wrote: post #247
osy wrote: post #26

> I'm going to be honest here and say that I don't know what Microsoft's actual motivation for requiring a TPM in Windows 11 is. It is quite obvious: to force people to buy a new PC. TPM provides no added security value for the vast majority of users[1] but it is a convenient hardware that has only started to become standard (fTPM) in PCs built in the last ~8 years so it provides an excuse for Microsoft to declare co…

The TPM is a great thing, from Microsoft's perspective. Because Microsoft have the Secure Boot code signing keys. And none of their users expect a "free software philosophy" that lets them use their own modified kernel, or DKMS to build new copies of kernel modules on demand - so you don't have to make users jump through any "machine owner key" hoops. And a lot of your customers are big corporations who barely trust…

> while most Linux users are quite happy remembering long unique disk encryption passwords thanks very much.

Which brings something up: how do you get back in if you suffer a traumatic brain injury or something like that? I feel like a lot of software assumes the operator can do things like remember unique passwords for a long time.

Sure, I can do that NOW, but will I still be able to in my seventies?

Re: The GPU, not the TPM, is the root of hardware DRM

#252

Post by p_ing »

michaelt wrote: post #247
osy wrote: post #26

> I'm going to be honest here and say that I don't know what Microsoft's actual motivation for requiring a TPM in Windows 11 is. It is quite obvious: to force people to buy a new PC. TPM provides no added security value for the vast majority of users[1] but it is a convenient hardware that has only started to become standard (fTPM) in PCs built in the last ~8 years so it provides an excuse for Microsoft to declare co…

The TPM is a great thing, from Microsoft's perspective. Because Microsoft have the Secure Boot code signing keys. And none of their users expect a "free software philosophy" that lets them use their own modified kernel, or DKMS to build new copies of kernel modules on demand - so you don't have to make users jump through any "machine owner key" hoops. And a lot of your customers are big corporations who barely trust…

> TPM is superior to things like Yubikeys, precisely because of its inflexibility

TPM also offers PIN or Password options. It is flexible.

Re: The GPU, not the TPM, is the root of hardware DRM

#253

Post by cryptonector »

dannyobrien wrote: post #21
MadnessASAP wrote: post #4

I have to wonder A) What does DRM realistically accomplish for the media companies? And, B) How are these DRM schemes actually being defeated? I do occasionally don my pirate hat* and have never had an issue finding what I want at the quality I want within an hour of a episode/movie being released to streaming. That would seem to indicate that these efforts at DRM are actually failing to have any noticeable effect at…

IIUI it's mostly a question of a mess of contractual language and incentives. Rightsholders license content, and in their licensing contracts they require a certain level of DRM for certain products. So streamers, etc, implement the DRM to comply with those contracts. Nobody at any level has an incentive or leverage to change the contracts, so the DRM continues.

That and also various principals are under the impression that DRM is possible, therefore they should implement it because it protects their IP, and protecting their IP is a fiduciary duty, therefore they must if they can.

Re: The GPU, not the TPM, is the root of hardware DRM

#254

Post by hiatus »

sidewndr46 wrote: post #204
p_ing wrote: post #200

Earlier quoted context omitted.

I'm not groking what you're saying. Replace what "entire device"?

You're at an industry conference. I want the data on your laptop's hard drive. You leave your laptop in the hotel room. Which one is easier: 1. Go into your room and screw around with the boot loader to somehow give me unencrypted access to your laptop after you login next time. 2. Go into your room. Take your laptop. Put an identical looking laptop in place that runs software that boots and looks identical. Have it…

Have you been to an industry conference? So many laptops are covered in stickers, good luck recreating that.

Re: The GPU, not the TPM, is the root of hardware DRM

#255

Post by LegionMammal978 »

watermelon0 wrote: post #159
majormajor wrote: post #10

Earlier quoted context omitted.

DRM has likely had a big impact in shifting the casual consumer conversation to "hey they're gonna start down on account sharing" from early-2000s style "here's a straight-up copy I made for you." And this helps prop up the "they'll get a Netflix account to binge the same three shows over and over" part of the business model. The cumulative monthly cost adds up but it feels cheaper than forking over a few hundred buc…

In many cases, downloading torrents and watching on a laptop/PC has a better UX than using streaming services. For example, it's impossible to watch 4k content on popular streaming services if you use Linux, and even with macOS/Windows you need a specific combination of hardware + OS + browser, if a service even offers it.

To be fair, UX isn't only about the point of consumption. 4k torrents don't grow on trees (luckily, 1080p is good enough for my own tastes), and for old or less-popular movies, it's often tough to find seeders, or they all upload at 100 kbps or only have half the file or something dumb like that. (At least on the public trackers I'm aware of: I have no clue what goes on in the super-duper-exclusive private trackers that some love to boast about.)

So I'd put accessibility and consistency as important parts of UX that torrenting can often miss out on. For the common person who is using Windows/Chrome, macOS/Safari, or a gaming console, those parts can easily be more important.

Of course, these methods start to shine when legitimate methods are even less accessible. For instance, U.S. sports streaming is an absolute mess with multiple networks, regional blackouts, etc., on top of buggy apps, so that you sometimes can't watch a game legally for any price. People have widely picked up illegal streams as an alternative, usually preferring familiar platforms like YouTube if the streams aren't taken down quickly enough.

Re: The GPU, not the TPM, is the root of hardware DRM

#256

Post by watermelon0 »

HeatrayEnjoyer wrote: post #212
botanical76 wrote: post #194

Earlier quoted context omitted.

There are cheats that give you more information than you should have. These typically require access to the game process's memory space. If you're cheating with a video capture card, this likely means you're allowing a program to rewrite your inputs to more accurately target player models. You will likely be banned if you do this on the same machine via screen capture. A video capture card can process the information…

Video capture cards can be countered with encrypted video from GPU to monitor. That's why you can't screencap 4k Disney+ movies.

HDFury devices allow stripping of HDCP 2.2, and vast majority of users currently don't have HDCP 2.3 compatible monitors/TVs, so that's not an option yet.

Re: The GPU, not the TPM, is the root of hardware DRM

#257

Post by p_ing »

nfriedly wrote: post #242
p_ing wrote: post #103

Earlier quoted context omitted.

> TPM provides no added security value for the vast majority of users[1] Yes it does. The vast majority of users aren't going to have their laptop stolen by the CIA/NSA and have their DIMMs popped and cryofreezed. The vast majority of users aren't going to have the case opened and a special-purpose PCIe device installed to steal keys over DMA. The vast majority of users aren't going to have a dTPM vulnerable to SPI s…

In my experience, FDE (Full Disk Encryption) is more of a hindrance than help to average users. It just means that when something goes wrong, such as a forgotten password or a botched update, their data that would have otherwise been recoverable is now lost forever. I'm not sure I know anyone who's had a computer stolen, but I know lots of people who have lost data. Edit: I do know one person who had a computer stole…

> It just means that when something goes wrong, such as a forgotten password or a botched update, their data that would have otherwise been recoverable is now lost forever.

Not at all. You can get your recovery key back via a few different means (for 11 Home, OneDrive/printed/PDF, for enterprises, various ways) and boot into the Windows Recovery Mode environment to perform the same repair options one would have without BitLocker in place.

Re: The GPU, not the TPM, is the root of hardware DRM

#258

Post by p_ing »

alerighi wrote: post #238
AnthonyMouse wrote: post #127

Earlier quoted context omitted.

> The vast majority of users aren't going to have their laptop stolen by the CIA/NSA and have their DIMMs popped and cryofreezed. That's kind of the point. The vast majority of users aren't going to have their laptop stolen at all, if they do it will 99% of the time be by someone who only wants to wipe it and fence it, and attempts to access data are most likely to be by unsophisticated family members who would be de…

The vast majority of users neither have a password on their computer, or if they have it it's a stupid one (like their name, their birthday, etc) or they have it written on a post-it that is attached on the monitor itself. Why do they need a TPM? Most of the time I setup a computer for a friend or family member they ask me to remove the password since they don't want to remember it. Vast majority of users neither hav…

Why do they need a firewall? Why do they need ACLs?

Let's just go back to single-user operating systems with exFAT drives.

If an individual expressly defeats the point of any particular security mechanism, that's on them. But to paint this broad brush of "I know someone who does X which makes Y pointless, so Y must be meaningless for everyone else" is silly.

Re: The GPU, not the TPM, is the root of hardware DRM

#259

Post by n144q »

nfriedly wrote: post #242
p_ing wrote: post #103

Earlier quoted context omitted.

> TPM provides no added security value for the vast majority of users[1] Yes it does. The vast majority of users aren't going to have their laptop stolen by the CIA/NSA and have their DIMMs popped and cryofreezed. The vast majority of users aren't going to have the case opened and a special-purpose PCIe device installed to steal keys over DMA. The vast majority of users aren't going to have a dTPM vulnerable to SPI s…

In my experience, FDE (Full Disk Encryption) is more of a hindrance than help to average users. It just means that when something goes wrong, such as a forgotten password or a botched update, their data that would have otherwise been recoverable is now lost forever. I'm not sure I know anyone who's had a computer stolen, but I know lots of people who have lost data. Edit: I do know one person who had a computer stole…

> I'm not sure I know anyone who's had a computer stolen, but I know lots of people who have lost data.

That's exactly where you got your priorities wrong.

Yes there is a tradeoff. But backing up your data is easy (especially in a corporate environment), while security is hard.

And computers do get stolen a lot all the time, just not in your circle.

Re: The GPU, not the TPM, is the root of hardware DRM

#260

Post by hansvm »

zinekeller wrote: post #188
mjw_byrne wrote: post #172

Earlier quoted context omitted.

"No one wants a preboot password though" - really? Doesn't strike me as particularly inconvenient, especially given the relative rarity of actual bootups these days. I've been using bog-standard FDE for as long as I can remember. One extra password entry per bootup for almost-perfect security seems like great value to me.

It seems that you're looking at the wrong bubble here. Most people actually detests passwords and would rather use a different method if possible (this is why ordinary users turn on biometric authentication despite some here questioning its security). Adding another password will certainly make users - especially enterprises - complain. Also for technical reasons, Windows can't do the fancy one login/password screen…

> this is why ordinary users turn on biometric authentication despite some here questioning its security

That's part of the reason. Another part is BigCo spamming the users asking for biometrics or whatever the current promotion-driver is, making opting out hard to find, and using their position of authority to assert that it's "more secure" (for your personal threat model no less, nice to be able to offload thought to a corporation).

Post reply on HN