Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows 11: TPMs and Digital Sovereignty

secret.club

Post reply on HN
Print view View original

41–50 of 66 posts

Re: Windows 11: TPMs and Digital Sovereignty

#41

Post by mjevans »

kmeisthax wrote: post #29
judge2020 wrote: post #21

The underlying point you should be calling out if you want to present this argument is that "User freedom should prevail over companies' freedom". The only thing attestation enables is companies enacting their own policies along the lines of "I only want users who are willing to let their device attest x level of security". The user is not required to use that service, they're not required to run W11 or to enable the…

Ok, so instead of Microsoft turning my PC into an Xbox, it's banks asking Microsoft to turn my PC into a credit card reader. This is not materially different. We already know how this works on Android. Attestation requirements and DRM tend to creep beyond their initial scope if implementing them is easy. And those requirements will include not having owner-level control over your machine[0]. If you root Android, you…

I don't really understand why I can't also force my device to _lie_ to any app that demands that. Is it somehow checking the exact combination of my firmware against a database of allowed root certs?

Re: Windows 11: TPMs and Digital Sovereignty

#42

Post by emily-c »

hlandau wrote: post #39
emily-c wrote: post #9

>Did we mention that a TPM isn’t going to protect you from UEFI malware that was planted on the device by a rogue agent at manufacture time? DRTM, a technology supported by Windows 11 that is layered on top of the TPM, aims to solve this very problem.

Except that it can't actually do that, because x86 DRTM doesn't remove SMM handlers installed by the system firmware, ACPI tables also remain resident and could be changed to contain malicious code, etc.

DRTM does not remove any malicious firmware provided code or data. Traditionally it is merely a measurement mechanism that happens after ExitBootServices which measures platform state in an unforgable manner. Practically the DRTM event can also cause certain chipset registers to get locked or SMM supervisors to get launched depending on the platform. SMM and ACPI tables (on some x86 platforms certain tables are rebuilt) are measured into a PCR by the secure loader or security processor during the DRTM event. The idea is that if malicious code or data was present then the PCR values wouldn't match the previous boot session and TPM secrets wouldn't unseal.

While what you said is technically correct, it is by design and any compromised firmware can do as it pleases before the DRTM event at the cost of getting caught and having the device fail attestation or not be able to access encrypted data (depending on what policy is layered on top of DRTM itself as it is just a security primitive). By having PCRs get reset during the DRTM event secrets are much more reliably able to be sealed to specific PCR values.

Re: Windows 11: TPMs and Digital Sovereignty

#43

Post by hlandau »

emily-c wrote: post #42
hlandau wrote: post #39

Earlier quoted context omitted.

Except that it can't actually do that, because x86 DRTM doesn't remove SMM handlers installed by the system firmware, ACPI tables also remain resident and could be changed to contain malicious code, etc.

DRTM does not remove any malicious firmware provided code or data. Traditionally it is merely a measurement mechanism that happens after ExitBootServices which measures platform state in an unforgable manner. Practically the DRTM event can also cause certain chipset registers to get locked or SMM supervisors to get launched depending on the platform. SMM and ACPI tables (on some x86 platforms certain tables are rebui…

The claim that SMM is measured by (Intel) DRTM is interesting. Do you have any details on that? To my knowledge Intel was trying to solve this issue using the concept of an 'SMM Transfer Monitor (STM)' not simply by measuring the SMM environment [1]. But it's been 8 years since [1] was written so if you have links to more current information, it'd be welcome.

[1] https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf...

Re: Windows 11: TPMs and Digital Sovereignty

#44

Post by emily-c »

hlandau wrote: post #43
emily-c wrote: post #42

Earlier quoted context omitted.

DRTM does not remove any malicious firmware provided code or data. Traditionally it is merely a measurement mechanism that happens after ExitBootServices which measures platform state in an unforgable manner. Practically the DRTM event can also cause certain chipset registers to get locked or SMM supervisors to get launched depending on the platform. SMM and ACPI tables (on some x86 platforms certain tables are rebui…

The claim that SMM is measured by (Intel) DRTM is interesting. Do you have any details on that? To my knowledge Intel was trying to solve this issue using the concept of an 'SMM Transfer Monitor (STM)' not simply by measuring the SMM environment [1]. But it's been 8 years since [1] was written so if you have links to more current information, it'd be welcome. [1] https://blog.invisiblethings.org/papers/2015/x86_harmf…

Unfortunately, I don't believe there is any up to date and detailed public documentation on the modern DRTM flows that exist on both Intel and AMD platforms. Maybe documentation has been recently updated but I’m not sure if I’m able to share more beyond what I already have.

Re: Windows 11: TPMs and Digital Sovereignty

#45

Post by blkhawk »

mjevans wrote: post #41
kmeisthax wrote: post #29

Earlier quoted context omitted.

Ok, so instead of Microsoft turning my PC into an Xbox, it's banks asking Microsoft to turn my PC into a credit card reader. This is not materially different. We already know how this works on Android. Attestation requirements and DRM tend to creep beyond their initial scope if implementing them is easy. And those requirements will include not having owner-level control over your machine[0]. If you root Android, you…

I don't really understand why I can't also force my device to _lie_ to any app that demands that. Is it somehow checking the exact combination of my firmware against a database of allowed root certs?

To lie you need to have control of the TPM or trick it somehow - otherwise the remote service will know you are a liar. This is still possible on Android for instance but it gets more and more difficult - I have a health tacking app that complains daily about the fact that my device is rooted - I will have to see what setting i have to block from it so it stops doing that.

Re: Windows 11: TPMs and Digital Sovereignty

#46

Post by floatboth »

> Did you know that technologies such as Intel Boot Guard that have existed for the better part of a decade defend well against such attacks that might seek to overwrite flash memory?

It's rather funny to see Boot Guard as a "good" example here. Boot Guard is what's actually taking freedom away. With a vendor-locked Boot Guard configuration, you cannot replace the firmware with anything not signed by the vendor. Bye bye dreams of coreboot (until a private key leaks like it just did ha ha).

Netflix & co denying service to machines that don't pass Microsoft attestation? Literally who cares, just go to The Pirate Bay instead.

Re: Windows 11: TPMs and Digital Sovereignty

#47

Post by DaiPlusPlus »

Gigachad wrote: post #28
tashian wrote: post #18

I agree with the sentiment of the piece, but I disagree with the idea that TPMs don't add much value for end users. TPMs were originally designed in the early days of ecommerce, when it became clear that home computers would need better security if they were going to be used for financial transactions. Today's TPMs don't have a lot of compute power, but they have a lot of features. It's just that we don't have that m…

Seems like a lot of banking and other secure business is moving to mobile first or mobile only, presumably as it's likely the only secure device the user has.

I agree with your assessment: desktop-browser online banking (with US banks in particular) is a depressing experience given how they’re full of ads for credit-card offers and manual (if not broken) OFX/QFX downloads that only contain a fraction of the actual backend txn data that the banks won’t ever share with their (retail-banking) customers…

And yet, while lots of banks now use SMS 2FA, none of the banks I use (Chase, BoA, Citi, and a couple of credit-unions) offer the far more secure TOTP scheme, let alone any way for headless clients to download txn data except via the literally-25+-years-old Quicken/Intuit OFX endpoints - presumably without 2FA, but with zero documentation in their online help and their retail banking customer support people have no idea what I’m talking about when I say OFX - it’s maddening,

lots of banks’ legacy OFX endpoints are listed here: https://www.ofxhome.com/index.php/home/directory

Re: Windows 11: TPMs and Digital Sovereignty

#48

Post by franga2000 »

kmeisthax wrote: post #29
judge2020 wrote: post #21

The underlying point you should be calling out if you want to present this argument is that "User freedom should prevail over companies' freedom". The only thing attestation enables is companies enacting their own policies along the lines of "I only want users who are willing to let their device attest x level of security". The user is not required to use that service, they're not required to run W11 or to enable the…

Ok, so instead of Microsoft turning my PC into an Xbox, it's banks asking Microsoft to turn my PC into a credit card reader. This is not materially different. We already know how this works on Android. Attestation requirements and DRM tend to creep beyond their initial scope if implementing them is easy. And those requirements will include not having owner-level control over your machine[0]. If you root Android, you…

As a truly absurd example of "if you give developers the option, they will abuse it" : I am not allowed to check the train schedules for the Slovenian national rail service on phone with a custom ROM (not even rooted).

Turns out, the company that got the tender to build it encrypted all traffic to the API with a custom encryption scheme and added three layers of obfuscation/anti-tampering (presumably) in order to make it basically impossible for another company to take over the app, guaranteeing all subsequent tenders go to them. The only even remotely sensitive thing - buying a ticket - happens in a WebView anyways, 90% of the app is just timetable data.

Re: Windows 11: TPMs and Digital Sovereignty

#49

Post by xg15 »

tashian wrote: post #18

I agree with the sentiment of the piece, but I disagree with the idea that TPMs don't add much value for end users. TPMs were originally designed in the early days of ecommerce, when it became clear that home computers would need better security if they were going to be used for financial transactions. Today's TPMs don't have a lot of compute power, but they have a lot of features. It's just that we don't have that m…

> And, TPMs do have actual privacy mechanisms. End-user TPMs do not offer up their endorsement key to any third party. Attestation workflows shield third parties from the endorsement key.

Then how do endorsement keys work?

If I understood the OP correctly, the purpose of the endorsement key is so a third party can choose only to accept attestation from TPMs of "trusted" vendors. How does this work if the third party can't query the endorsement key?

Re: Windows 11: TPMs and Digital Sovereignty

#50

Post by xg15 »

judge2020 wrote: post #21

The underlying point you should be calling out if you want to present this argument is that "User freedom should prevail over companies' freedom". The only thing attestation enables is companies enacting their own policies along the lines of "I only want users who are willing to let their device attest x level of security". The user is not required to use that service, they're not required to run W11 or to enable the…

> The underlying point you should be calling out if you want to present this argument is that "User freedom should prevail over companies' freedom".

I'm still baffled by the DMCA's anti-circumvention clause in that regard. While users are given some rights in the DMCA, companies seem to be perfectly free to trample over those rights using technological restrictions. If users then try to circumvent those restrictions, suddenly they are in violation of the law.

Post reply on HN