Live data from Hacker News

Windows 11: TPMs and Digital Sovereignty

secret.club

31–40 of 66 posts

Re: Windows 11: TPMs and Digital Sovereignty

#31
post #7

Earlier quoted context omitted.

If Windows is required for work then you've already lost. Seriously I'm unable to be productive in Windows (or Mac, I tried). I don't know what the stats are on employers requiring Windows but my current one doesn't (mainly because of a sizable chunk of Mac users, not that there's any support for Linux).

Then how are you going to do the majority of native desktop app/game development (where most of your users use Windows)?

I would bet the majority of gamers are actually on console by raw numbers. Appliances are super useful for normies.

And native desktop development is, like, 2% of enterprise development. Tops. And all the paying users are over on the mac side.

Re: Windows 11: TPMs and Digital Sovereignty

#32
post #7
post #4

I have to believe most of us here on HN are in the boat of keeping a W11 partition for work and a Linux partition for everything else at this point.

If Windows is required for work then you've already lost. Seriously I'm unable to be productive in Windows (or Mac, I tried). I don't know what the stats are on employers requiring Windows but my current one doesn't (mainly because of a sizable chunk of Mac users, not that there's any support for Linux).

So you’re used to Linux. But there are people who can do your job faster than you who use windows or macOS. Just like there are people who will work slower and be limited compared to you.

Use what you prefer. I can use any and get my job done. All 3 have their own pros and cons.

Re: Windows 11: TPMs and Digital Sovereignty

#33
post #4

I have to believe most of us here on HN are in the boat of keeping a W11 partition for work and a Linux partition for everything else at this point.

I don’t use Windows for work or home. I keep a VM around for the couple of times a year someone sends me a word document.

You can run older Word versions (up to 2016 I believe) very well inside wine. It’s even easy to install (PlayOnLinux e.g. guided you through the install). No need for a windows license.

Re: Windows 11: TPMs and Digital Sovereignty

#34
post #16
post #4

I have to believe most of us here on HN are in the boat of keeping a W11 partition for work and a Linux partition for everything else at this point.

Except, in the future, your Linux partition will be unable to access most online services because they'll all rely on remote attestation to check if your device is running an unmodified Windows OS, similar to what many android apps already do.

Except some will fake that attestation too.

Re: Windows 11: TPMs and Digital Sovereignty

#35
post #16
post #4

I have to believe most of us here on HN are in the boat of keeping a W11 partition for work and a Linux partition for everything else at this point.

Except, in the future, your Linux partition will be unable to access most online services because they'll all rely on remote attestation to check if your device is running an unmodified Windows OS, similar to what many android apps already do.

> to check if your device is running an unmodified windows OS

Remote attestation sounds secure in theory but its Achilles heel is that at the remote end sb will have to perform a judgement of what „an modified OS“ is. And any wrong decision will stress test that sb‘s support division and might be subject to litigation. Likely there will be some industry standard white list which itself might be subject to manipulation (similar to the compromised SSL root certificates we had years ago).

I can’t imagine this will be set in place for all available PC software.

Furthermore, attestation happens during run time of a software stack that might itself be vulnerable to exploits. An attacker might find a way to short-circuit remote attestation w/o the remote party knowing.

See also:

https://courses.cs.washington.edu/courses/csep590/06wi/final...

(TFA linked this, too.)

Re: Windows 11: TPMs and Digital Sovereignty

#36
Regarding TPM’s security see also:

https://gbatemp.net/threads/nintendo-reportedly-issues-dmca-...

„ specifically, Lockpick bypasses the Console TPMs to permit unauthorized access to, extraction of, and decryption of all the cryptographic keys, including product keys, contained in the Nintendo Switch“

Re: Windows 11: TPMs and Digital Sovereignty

#37
post #11

Earlier quoted context omitted.

When Microsoft originally published a short page with their justification of the advantages of UEFI and GPT drive layout, everything touted as an advantage was false. As this was foisted and users became accustomed to the migration away from more well-proven traditional operation, the page was edited into oblivion as it could be seen users would have better recognized the falsehood by then after having some direct ex…

Do you know the URL of that page? Is it available on archive.org?

This was about 2012 to 2014.

The page is long gone now but I definitely saved a copy because it was so blatant. Don't know how easy I can find it. May be on the Wayback Machine.

It had recently become possible to bypass Windows 7 activation using "Windows Loader" (by DAZ), a sophisticated hacker tool which loaded the proper BIOS hardware key[0] not from the mainboard, but optionally from a replaced MBR sector 0 on the HDD which then pointed to a file containing a copy of the original sector 0, from which the non-W7 MB then could boot W7 normally without needing activation.

GPT as "standard" and UEFI with Microsoft SecureBoot were then rushed out in time for the W8 release. Therefore almost all PC's newer than the ones "designed for W7" would require not only a complete HDD refomatting, but a more extensive complete repartitioning (MBR-style) before anyone could even try to install W7 or anything else other than what the PC originally shipped with.

Seemed to me simply to make it more difficult to install W7 on all future PC's, which would turn out to be the main competition for W8 after all. Linux was not as much of a threat, but the collateral damage was not unintentional and set Linux PC and dual-boot approaches back at least two years.

Now there is supposedly a hack that allows W7 to be installed on GPT volumes.

One of the Microsoft claims was that one of the security "deficiencies" of MBR HDD layout not found with GPT was the unused sectors which padded the area from sector 1 up until the first sector of the first partition which is the partition's boot sector (usually up to sector 63 but at least sector 32 and sometimes 1024 or more). This normally unused area between sector 0 and the first partition's boot sector was a good place for GRUB to routinely use for its bootloader but had also been a location for the occasional "rootkit" that could not be removed by reformatting or often even repartioning (you would have to zero that part of the HDD using ordinary non-Windows tools, like a disk editor or dd in Linux). Also an optional location for Windows Loader. "Benefits" of GPT was that no sectors are unspecified, true but in practice sectors 5 through 31 are still never used unless you have created more than 8 GPT partitions on the HDD. You can also leave as much space in between GPT partitons as you would like (this is not the factory default), and Windows built-in tools can do the job.

If you were on top of this and had a plain MBR mainboard with protection from flashing the BIOS, there was no way the mainboard itself could contain any kind of malware. If the HDD was clean, or fully zeroed, you were fine.

With UEFI systems, which contain much more extensive and flexible firmware you were actually more subject to nefarious actions if any could be devised, which could then reside in the mainboard along with the UEFI firmware regardless how thoroughly you zero the HDD.

This seems to have now become possible, maybe with the recent leak alone.

With the slyly undocumented proprietary UEFI firmwares, it is also not too easy to know if "updating the BIOS" actually clears any possible malware that might be still lurking there along with the new factory firmware you put in.

As far as I know there is no routine malware scan to check for compromised UEFI firmware like there has been for decades with HDD's.

UEFI seemed to be very dependent on highly secret firmware keys never being revealed, otherwise I expected a UEFI MB would then be compromised in a way that BIOS MB's could not, and potentially much more difficult to detect & remove.

[0] factory key code for the Windows version that originally shipped within a W7 PC mainboard BIOS so it would not require retail-OS-style activation, could then be used to freely activate W7 on older Vista PC's and expected to function on W8 PC's to come if they had regular traditional BIOS and MBR HDD layout. Almost like they knew in advance that W8 PC buyers would massively prefer to install W7 if they could rather than the original Windows 8.0.

Re: Windows 11: TPMs and Digital Sovereignty

#38
post #33

Earlier quoted context omitted.

I don’t use Windows for work or home. I keep a VM around for the couple of times a year someone sends me a word document.

You can run older Word versions (up to 2016 I believe) very well inside wine. It’s even easy to install (PlayOnLinux e.g. guided you through the install). No need for a windows license.

I've found libreoffice to work well enough for any docx simple enough to have come from an older version of Word, but I might just be ignorant of how Word actually differs from the tools I use to view it; it just works for me ¯\_ (ツ) _/¯ I do find the suite rather large, but use functional package management to keep most of it's files abstracted away-- I bet the appimage or flatpak is pretty sweet in the same way

Re: Windows 11: TPMs and Digital Sovereignty

#39
post #9

>Did we mention that a TPM isn’t going to protect you from UEFI malware that was planted on the device by a rogue agent at manufacture time? DRTM, a technology supported by Windows 11 that is layered on top of the TPM, aims to solve this very problem.

Except that it can't actually do that, because x86 DRTM doesn't remove SMM handlers installed by the system firmware, ACPI tables also remain resident and could be changed to contain malicious code, etc.

Re: Windows 11: TPMs and Digital Sovereignty

#40
post #20

Wow ... I am getting old and jaded. I was so into locking down systems, making sure I knew where every packet was going, not trusting anything. Meanwhile I'm also "wardriving", phreaking with a red box, running an underground BBS ... all sorts of stuff. I had one of those fancy t-shirts with the export-restricted RSA encryption source code printed it. Because, why not? Now I just quickly skim a 2 year old article abo…

> It's like "if there's a will, there's a way".

and that's one of the reasons I see no use in TPM. This is also a layer of complexity which usually is the opposite of more security. TBH I don't get it why people cheer this TPM and Secure Boot stuff as much.

Post reply on HN