3 ms·

Is Windows 11 likely to perform some sort of attestation for this? Or are we likely to see something like the way the old Windows cracks used to work - a hacked

• userbinator 5y ago
  Unless it's doing some sort of remote-code-download-and-execute(!) based on the attestation results, it will always be possible to crack everything locally. All the checks just need to be patched out, and finding them all is the hard part, but it is theoretically possible as long as you still have full control over the hardware. But such a setup will be very fragile to automatic updates (which are already difficult enough to turn off completely as it is), and with this whole "update mentality" I wouldn't be surprised if they eventually leave in certain security holes and use those as an additional force to coerce people to take their updates --- along with everything else the users didn't want.
  • blibble 5y ago
    how would you patch them out? the disk will be encrypted with a key stored in the TPM that will only be supplied to a signed OS, so you can't alter the contents on disk if you've booted in secure mode you can't interfere with the boot process and the OS won't let you patch it online if they pull it off correctly there's not much you can do they can even detect the effects of exploits using remote attestation if a machine has had its environment compromised it won't be able to get updates/watch youtube/play games/... (using old software/firmware with known exploits can be similarly blocked, until you upgrade)
    • arsome 5y ago
      You're talking about a fantasy world that doesn't exist where Microsoft has gone to extreme precautions like you see on mobile devices and game consoles where there are constant attempts to steal the ownership from users. In the actual world they don't even enforce disk encryption right now and correct me if I'm wrong, but currently having your BitLocker "recovery code" is enough to decrypt the disk on another machine and changing that would be a massive issue for many data recovery processes. Unless they plan to do massive changes to the system this is very likely to not be a problem and cracking is likely to still be quite possible.
      • userbinator 5y ago
        that doesn't exist ...yet. Unless they plan to do massive changes to the system this is very likely to not be a problem and cracking is likely to still be quite possible. The frog is boiling slowly.
      • viraptor 5y ago
        It's not as much "doesn't exist" but rather "hasn't been turned on". We can speculate/disagree on the future plans of course, but in general the whole process as described in the previous comment is in place. Enabling you to lock down the whole boot process is the goal of SecureBoot. Right now Windows is not preventing you from modifying the startup binaries and system permissions, but they could easily do that. Apple already partially did that with the forced encryption and T2. These are not "massive changes to the system". Probably still a lot of effort, but closer to "MS now owns the ActualAdmin user who is the owner of system files; you get Administrator who can't touch them". On Linux you can already prepare system like that fairly easily, with Arch wiki describing most of the steps.
      • blibble 5y ago
        it does already exist, just not on Windows Android now has remote attestation required to use several banking apps, presumably with games and video coming down the line soon the lack of the mandatory TPM is the only thing missing that will allow MS to do the same thing to Windows