4 ms·

I think people should be able to sue companies that do this. They surely did not advertise it as "secure unless we lose the key". Having a backdoor in the first

I think people should be able to sue companies that do this. They surely did not advertise it as "secure unless we lose the key". Having a backdoor in the first place could be counted as negligent (should be counted as outright fraud).

netsharc 10y ago
Is it really a backdoor? Basically it's a policy with very permissive settings, but even without this policy, the manufacturer still needs to use encryption to sign software, and they'd still need to have a master key which they need to keep very safe. For example, in the FBI vs. Apple case, the FBI wanted Apple to write a custom version of iOS and sign it so that the phone would verify that it's legitimately from Apple, and install it. Obviously it's different than the FBI also having keys, but only because of protections of the law. I guess in Russia or China the 3 letter agencies can be a lot more persuasive about asking the manufacturers for their master keys, although the USA also has NSL's...
josteink 10y ago
> I think people should be able to sue companies that do this. They surely did not advertise it as "secure unless we lose the key". I think you misunderstand what this is. This is not a remote backdoor, which can be used by MS/NSA to hack your machine. Windows RT devices comes with a bootloader locked to only allow UEFI secure-boot signed boot media. Effectively that means Windows RT only. No Linux, FreeBSD or other free OSen for you. This is a hack, which requires you to have full admin-access on the device, which uses Microsoft's own UEFI mechanisms (policies and what not), to allow booting other non-signed media as well. Effectively this is a bootloader unlocking. With this hack in place, you can now boot Linux. Or run malware. Anything goes. It's the same as being able to disable secure-boot. And would you honestly sue HTC or whoever if you found out that the bootloader on your phone could be unlocked, to allow the installation of third party firmware? Surely you would only see that as a positive thing? Or am I missing something?
- allendoerfer 10y ago
  I got what this is, my point is, that it is not what they advertised. Maybe I should have made this more clear. I myself would be thankful to be able to install Linux if I had a device like that. Nevertheless some (enterprise) users would maybe like it otherwise and were screwed by Microsoft claiming something is secured, when they in fact knew, that it was not. A scenario I can think of is when the machine is not owned by the one using it and the owner wants to sandbox the user as much as possible. In this in the view of the owner it really is a backdoor. I would love to see companies getting punished for things like that. This case does not seem severe, still, what I want is that you are accountable for stuff you say. You cannot have a backdoor - being remote or not remote - if you say that the thing is secure. You knew it was not, you have committed fraud.
  - josteink 10y ago
    Seeing as this bypass requires admin rights to execute in the first place, a sandboxed user should by all accounts remain sandboxed anyway. But fair enough point about different use cases.

netsharc 10y ago

Is it really a backdoor? Basically it's a policy with very permissive settings, but even without this policy, the manufacturer still needs to use encryption to sign software, and they'd still need to have a master key which they need to keep very safe. For example, in the FBI vs. Apple case, the FBI wanted Apple to write a custom version of iOS and sign it so that the phone would verify that it's legitimately from Apple, and install it. Obviously it's different than the FBI also having keys, but only because of protections of the law. I guess in Russia or China the 3 letter agencies can be a lot more persuasive about asking the manufacturers for their master keys, although the USA also has NSL's...

josteink 10y ago

> I think people should be able to sue companies that do this. They surely did not advertise it as "secure unless we lose the key". I think you misunderstand what this is. This is not a remote backdoor, which can be used by MS/NSA to hack your machine. Windows RT devices comes with a bootloader locked to only allow UEFI secure-boot signed boot media. Effectively that means Windows RT only. No Linux, FreeBSD or other free OSen for you. This is a hack, which requires you to have full admin-access on the device, which uses Microsoft's own UEFI mechanisms (policies and what not), to allow booting other non-signed media as well. Effectively this is a bootloader unlocking. With this hack in place, you can now boot Linux. Or run malware. Anything goes. It's the same as being able to disable secure-boot. And would you honestly sue HTC or whoever if you found out that the bootloader on your phone could be unlocked, to allow the installation of third party firmware? Surely you would only see that as a positive thing? Or am I missing something?

allendoerfer 10y ago
I got what this is, my point is, that it is not what they advertised. Maybe I should have made this more clear. I myself would be thankful to be able to install Linux if I had a device like that. Nevertheless some (enterprise) users would maybe like it otherwise and were screwed by Microsoft claiming something is secured, when they in fact knew, that it was not. A scenario I can think of is when the machine is not owned by the one using it and the owner wants to sandbox the user as much as possible. In this in the view of the owner it really is a backdoor. I would love to see companies getting punished for things like that. This case does not seem severe, still, what I want is that you are accountable for stuff you say. You cannot have a backdoor - being remote or not remote - if you say that the thing is secure. You knew it was not, you have committed fraud.
- josteink 10y ago
  Seeing as this bypass requires admin rights to execute in the first place, a sandboxed user should by all accounts remain sandboxed anyway. But fair enough point about different use cases.