3 ms·

how would you patch them out? the disk will be encrypted with a key stored in the TPM that will only be supplied to a signed OS, so you can't alter the content

how would you patch them out? the disk will be encrypted with a key stored in the TPM that will only be supplied to a signed OS, so you can't alter the contents on disk if you've booted in secure mode you can't interfere with the boot process and the OS won't let you patch it online if they pull it off correctly there's not much you can do they can even detect the effects of exploits using remote attestation if a machine has had its environment compromised it won't be able to get updates/watch youtube/play games/... (using old software/firmware with known exploits can be similarly blocked, until you upgrade)

arsome 5y ago
You're talking about a fantasy world that doesn't exist where Microsoft has gone to extreme precautions like you see on mobile devices and game consoles where there are constant attempts to steal the ownership from users. In the actual world they don't even enforce disk encryption right now and correct me if I'm wrong, but currently having your BitLocker "recovery code" is enough to decrypt the disk on another machine and changing that would be a massive issue for many data recovery processes. Unless they plan to do massive changes to the system this is very likely to not be a problem and cracking is likely to still be quite possible.
- userbinator 5y ago
  that doesn't exist ...yet. Unless they plan to do massive changes to the system this is very likely to not be a problem and cracking is likely to still be quite possible. The frog is boiling slowly.
- viraptor 5y ago
  It's not as much "doesn't exist" but rather "hasn't been turned on". We can speculate/disagree on the future plans of course, but in general the whole process as described in the previous comment is in place. Enabling you to lock down the whole boot process is the goal of SecureBoot. Right now Windows is not preventing you from modifying the startup binaries and system permissions, but they could easily do that. Apple already partially did that with the forced encryption and T2. These are not "massive changes to the system". Probably still a lot of effort, but closer to "MS now owns the ActualAdmin user who is the owner of system files; you get Administrator who can't touch them". On Linux you can already prepare system like that fairly easily, with Arch wiki describing most of the steps.
- blibble 5y ago
  it does already exist, just not on Windows Android now has remote attestation required to use several banking apps, presumably with games and video coming down the line soon the lack of the mandatory TPM is the only thing missing that will allow MS to do the same thing to Windows

arsome 5y ago

You're talking about a fantasy world that doesn't exist where Microsoft has gone to extreme precautions like you see on mobile devices and game consoles where there are constant attempts to steal the ownership from users. In the actual world they don't even enforce disk encryption right now and correct me if I'm wrong, but currently having your BitLocker "recovery code" is enough to decrypt the disk on another machine and changing that would be a massive issue for many data recovery processes. Unless they plan to do massive changes to the system this is very likely to not be a problem and cracking is likely to still be quite possible.

userbinator 5y ago
that doesn't exist ...yet. Unless they plan to do massive changes to the system this is very likely to not be a problem and cracking is likely to still be quite possible. The frog is boiling slowly.
viraptor 5y ago
It's not as much "doesn't exist" but rather "hasn't been turned on". We can speculate/disagree on the future plans of course, but in general the whole process as described in the previous comment is in place. Enabling you to lock down the whole boot process is the goal of SecureBoot. Right now Windows is not preventing you from modifying the startup binaries and system permissions, but they could easily do that. Apple already partially did that with the forced encryption and T2. These are not "massive changes to the system". Probably still a lot of effort, but closer to "MS now owns the ActualAdmin user who is the owner of system files; you get Administrator who can't touch them". On Linux you can already prepare system like that fairly easily, with Arch wiki describing most of the steps.
blibble 5y ago
it does already exist, just not on Windows Android now has remote attestation required to use several banking apps, presumably with games and video coming down the line soon the lack of the mandatory TPM is the only thing missing that will allow MS to do the same thing to Windows