Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft terminates VeraCrypt account, halting Windows updates

404media.co

Post reply on HN
Print view View original

71–80 of 259 posts

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#71

Post by ghighi7878 »

wat10000 wrote: post #65
tosti wrote: post #43

Earlier quoted context omitted.

Computers should abide by their owners. Any computer not doing that is broken.

This gets tricky. If I click on a link intending to view a picture of a cat, but instead it installs ransomware, is that abiding by its owner or not? It did what I told it to do, but not at all what I wanted.

We dont need to get philosophical here. You(the admin) can require you (the user) to input a password to signify to you(the admin) to install a ransomware when a link is clicked. That way no control is lost.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#72

Post by Galanwe »

astrobe_ wrote: post #25
romaniv wrote: post #22

I still hope that one of these days people in general will realize that executable signing and SecureBoot are specifically designed for controlling what a normal person can run, rather than for anything resembling real security. The premises of either of those "mitigations" make absolutely no sense for personal computers.

I don't know about executable signing, but in the embedded world SecureBoot is also used to serve the customer; id est provide guarantees to the customer that the firmware of the device they receive has not been tampered with at some point in the supply chain.

> id est provide guarantees to the customer that the firmware of the device they receive has not been tampered with

The firmware of the device being a binary blob for the most part... Not like I trust it to begin with.

Whereas my open source Linux distribution requires me to disables SecureBoot.

What a world.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#73

Post by petcat »

mort96 wrote: post #69
astrobe_ wrote: post #25

Earlier quoted context omitted.

I don't know about executable signing, but in the embedded world SecureBoot is also used to serve the customer; id est provide guarantees to the customer that the firmware of the device they receive has not been tampered with at some point in the supply chain.

It's to serve the regulators. The Radio Equipment Directive essentially requires the use of secure boot fir new devices.

I happen to like knowing that my mobile device did not have a ring 0 backdoor installed before it left the factory in Asia. SecureBoot gives me that confidence.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#74

Post by tsujamin »

VadimPR wrote: post #58

A year ago I used Azure Trusted Signing to codesign FOSS software that I distribute for Windows. It was the cheapest way to give away free software on that platform. A couple of months ago I needed to renew the certificate because it expired, and I ran into the same issue as the author here - verification failed, and they refused to accept any documentation I would give them. Very frustrating experience, especially s…

For what it’s worth, Trusted Signing verification has been a moving target over the last 12 months. It was open for individuals, then it was closed to anyone except (iirc) US businesses with DUNS numbers, then it opened again to US based individuals (and a few other countries perhaps).

My completely uninformed guess was that someone had done something naughty with Trusted Signing-issued code signing certificates.

Anyway, when I first saw the VeraCrypt thing this morning my initial reaction was “I wonder if this is them pushing developers onto trusted signing the hard way?”

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#75

Post by mikestew »

samlinnfer wrote: post #36
gjsman-1000 wrote: post #33

Earlier quoted context omitted.

Tradeoffs. Which is more likely here? 1. A customer wants to run their own firmware, or 2. Someone malicious close to the customer, an angry ex, tampers with their device, and uses the lack of Secure Boot to modify the OS to hide all trace of a tracker's existence, or 3. A malicious piece of firmware uses the lack of Secure Boot to modify the boot partition to ensure the malware loads before the OS, thereby permanent…

1. P(someone wants to run their own firmware) 2. P(someone wants to run their own firmware) * P(this person is malicious) * P(this person implants this firmware on someone else’s computer) 3. The firmware doesn’t install itself Yeah I think 2 and 3 is vastly less likely and strictly lower than 1.

As an embedded programmer in my former life, the number of customers that had the capability of running their own firmware, let alone the number that actually would, rapidly approaches zero. Like it or not, what customers bought was an appliance, not a general purpose computer.

(Even if, in some cases, it as just a custom-built SBC running BusyBox, customers still aren't going to go digging through a custom network stack).

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#76

Post by root_axis »

dns_snek wrote: post #59
gjsman-1000 wrote: post #33

Earlier quoted context omitted.

Tradeoffs. Which is more likely here? 1. A customer wants to run their own firmware, or 2. Someone malicious close to the customer, an angry ex, tampers with their device, and uses the lack of Secure Boot to modify the OS to hide all trace of a tracker's existence, or 3. A malicious piece of firmware uses the lack of Secure Boot to modify the boot partition to ensure the malware loads before the OS, thereby permanent…

#2 and #3 are fearmongering arguments and total horseshit, excuse the strong language. Should either of those things happen the bootloader puts up a big bright flashing yellow warning screen saying "Someone hacked your device!" I use a Pixel device and run GrapheneOS, the bootloader always pauses for ~5 seconds to warn me that the OS is not official.

Yes. They're making the point that your flashing yellow warning is a good thing, and that it's helpful to the customer that a mechanism is in place to prevent it from being disabled by an attacker.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#77

Post by red-iron-pine »

shevy-java wrote: post #44

Microsoft wants to control computers. This is why they came up with InsecureBoot - or ad-hoc eliminating accounts willy-nilly style. Microsoft kind of acts like Google here. It is also interesting that the US government is doing absolutely nothing against this despicable behaviour.

the US government is owned by corporate interests and has been in some capacity since inception. special mention to the Russians and Israelis and Saudis who also own a piece.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#78

Post by wat10000 »

ghighi7878 wrote: post #71
wat10000 wrote: post #65

Earlier quoted context omitted.

This gets tricky. If I click on a link intending to view a picture of a cat, but instead it installs ransomware, is that abiding by its owner or not? It did what I told it to do, but not at all what I wanted.

We dont need to get philosophical here. You(the admin) can require you (the user) to input a password to signify to you(the admin) to install a ransomware when a link is clicked. That way no control is lost.

What if the cat pictures are an app too? The computer can't require a password specifically for ransomware, just for software in general. The UI flow for cat pictures apps and ransomware will be identical.

Re: Microsoft terminates VeraCrypt account, halting Windows updates

#80

Post by repelsteeltje »

Galanwe wrote: post #72
astrobe_ wrote: post #25

Earlier quoted context omitted.

I don't know about executable signing, but in the embedded world SecureBoot is also used to serve the customer; id est provide guarantees to the customer that the firmware of the device they receive has not been tampered with at some point in the supply chain.

> id est provide guarantees to the customer that the firmware of the device they receive has not been tampered with The firmware of the device being a binary blob for the most part... Not like I trust it to begin with. Whereas my open source Linux distribution requires me to disables SecureBoot. What a world.

+1

An unsigned hash is plenty guard to against tampering. The supply chain and any secret sauce that went into that firmware is just trust. Trust that the blob is well intentioned, trust that you downloaded from the right URL, checked the right SHA, trust that the organization running the URL is sanctioned to do so by Microsoft...

Once all of that trust for every piece of software is concentrated in one organization, Microsoft, Apple or Google, is has become totally meaningless.

Post reply on HN