Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows 11: TPMs and Digital Sovereignty

secret.club

Post reply on HN
Print view View original

61–66 of 66 posts

Re: Windows 11: TPMs and Digital Sovereignty

#61

Post by nly »

blibble wrote: post #57
nly wrote: post #54

Earlier quoted context omitted.

QEMU emulates UEFI Secure Boot and a software TPM just fine. No need to dual boot.

they can block that extremely easily if they want to (the article even mentions this)

The same thing will happen that always happens... some TPM vendor that has millions upon millions of devices in the field will have their private signing key leaked. MS won't be able to cripple millions of machines. Bam, before you know it someone has a patch for QEMU to have it emulate a device with random identifiers signed using the leaked key.

Re: Windows 11: TPMs and Digital Sovereignty

#62

Post by JohnFen »

tashian wrote: post #18

I agree with the sentiment of the piece, but I disagree with the idea that TPMs don't add much value for end users. TPMs were originally designed in the early days of ecommerce, when it became clear that home computers would need better security if they were going to be used for financial transactions. Today's TPMs don't have a lot of compute power, but they have a lot of features. It's just that we don't have that m…

Yes, there are end-user uses for TPMs. But, personally, none of them are compelling enough to overcome my fundamental mistrust of how companies will use them.

Re: Windows 11: TPMs and Digital Sovereignty

#63

Post by JohnFen »

jimbob45 wrote: post #4

I have to believe most of us here on HN are in the boat of keeping a W11 partition for work and a Linux partition for everything else at this point.

Not me. Any work I'm doing for an employer is done solely on equipment they supply and everything else is done solely on my own equipment. Never the twain shall meet. So my personal machines are all 100% Linux, and my work machines are all whatever my employer wants them to be.

I guess I do have multiple partitions after all, they're just on different machines!

Re: Windows 11: TPMs and Digital Sovereignty

#64

Post by tashian »

xg15 wrote: post #49
tashian wrote: post #18

I agree with the sentiment of the piece, but I disagree with the idea that TPMs don't add much value for end users. TPMs were originally designed in the early days of ecommerce, when it became clear that home computers would need better security if they were going to be used for financial transactions. Today's TPMs don't have a lot of compute power, but they have a lot of features. It's just that we don't have that m…

> And, TPMs do have actual privacy mechanisms. End-user TPMs do not offer up their endorsement key to any third party. Attestation workflows shield third parties from the endorsement key. Then how do endorsement keys work? If I understood the OP correctly, the purpose of the endorsement key is so a third party can choose only to accept attestation from TPMs of "trusted" vendors. How does this work if the third party…

Ah, this was a grammar error on my part. Sorry about that, let me clarify.

TPMs do offer up their endorsement key (or an endorsement key certificate) to third parties.

And, TPMs can share attestations in a way that doesn't reveal the endorsement key. They use attestation keys for this. Attestation keys can sign TPM attestations, and these keys do not identify the TPM.

This approach requires a trusted CA. The CA confirms the TPM's identity (using an endorsement certificate issued by the TPM vendor), it confirms that the attestation key and endorsement key reside on the same TPM, and it issues a certificate for an attestation key.

The attestation certificate might contain TPM vendor info, firmware version number, and proof that the attestation private key is hardware-bound. But it need not contain any permanent identifier. The TPM can now use its attestation key and certificate to sign attestations for a third party.

Re: Windows 11: TPMs and Digital Sovereignty

#65

Post by DaiPlusPlus »

scott00 wrote: post #53
DaiPlusPlus wrote: post #47

Earlier quoted context omitted.

I agree with your assessment: desktop-browser online banking (with US banks in particular) is a depressing experience given how they’re full of ads for credit-card offers and manual (if not broken) OFX/QFX downloads that only contain a fraction of the actual backend txn data that the banks won’t ever share with their (retail-banking) customers… And yet, while lots of banks now use SMS 2FA, none of the banks I use (Ch…

What else is in the backend transaction data?

LOADS of data - especially for industry-verticals that have heavy integration with credit-card companies (e.g. airlines include ticketing and even seat info in the metadata they submit to banks: this dates back to how air-miles rewards cards originally worked in the late 1980s) and there was tight integration between banks and airlines - even (or so I'm told) to the point of where banks' in-house "main" databases and ssytems have dozens of very, very hardcoded fields because of that early collab work - which then ossified in-place and now everyone's too scared to remove those now unused fields for fear of breaking everything.

...which leads me to believe that Cobol does not lend itself well to unit and integration testing in isolation then.

Re: Windows 11: TPMs and Digital Sovereignty

#66

Post by trympet »

Bran_son wrote: post #2

> You’ve probably noticed that the marketing for this requirement is vague and confusing, and that’s intentional. It doesn’t do much for you, the consumer. However, it does set the stage for the future where Microsoft begins shipping their TPM on your processor. Enter Microsoft’s Pluton. The same technology is present in the Xbox. It would be an absolute dream come true for companies and vendors with special interest…

This is false. Here are technical docs on how the TPM is used: https://learn.microsoft.com/en-us/windows/security/informati...
Post reply on HN