4 ms·

You can access TPMs on Linux just fine so this entire "but then what if" chain kinda makes no sense. A TPM restricts nothing on its own, it's just a hardware cr

You can access TPMs on Linux just fine so this entire "but then what if" chain kinda makes no sense. A TPM restricts nothing on its own, it's just a hardware crypto token. I mean sure, if Microsoft decided that it wanted to do all of the things you said, and could convince all of the OEMs to help, and a bunch of services and ISPs or whatever, yes, that would suck. It's a totally fabricated hypothetical that would never play out, but sure.

shadilay 5y ago
Linux is "insecure", Society^TM supports Windows only, please install Windows to continue using Bank^TM, School^TM, and irs.gov. 'Legacy' tax paying is now unsupported, please use new and improved windows.irs.gov
- michaelmrose 5y ago
  Worse Ubuntu is "insecure" please upgrade to Microsoft Linux 2024.
  - shadilay 5y ago
    Worse, now that WSL2 exists why would you want to run Linux on baremetal anyways. EEE
tehbeard 5y ago
So if it's just a hardware crypto token, how does it work with secure boot? Just the other chips on the mobo working in concert, no OS oversight?
- staticassertion 5y ago
  It's unrelated to secure boot.
  - michaelmrose 5y ago
    It's party of an overarching set of standards called Trusted Computing.
josefx 5y ago
There are quite a few computers already where Linux only runs as long as Microsoft provides a signed shim for the boot loader. There was quite a bit of a controversy because of this when secure boot came out.
- staticassertion 5y ago
  Really? Which computers? I don't know of any. To my knowledge the entire secure boot thing was blown way out of proportion - Linux users still can install Linux, they can even sign their own bootloaders.
  - josefx 5y ago
    At least HP sold some where it seemed to intentionally disable setup mode for consumer grade hardware[1]. Arm based Surface devices where locked down to WindowsRT using secure boot[2]. The WindowsRT case was basically the foundation of the outrage, not only did Microsoft claim to not abuse its position as only entity able to sign code that would run on nearly all secure boot enabled devices, it immediately released a secure boot enabled product that locked out Linux. [1]https://superuser.com/questions/1024111/adding-keys-to-secure-boot-database-on-an-hp-pavilion-14-ab057ca https://superuser.com/questions/1024111/adding-keys-to-secur... [2]https://www.mickaelwalter.fr/linux-on-surface-rt/ https://www.mickaelwalter.fr/linux-on-surface-rt/
    - staticassertion 5y ago
      > not only did Microsoft claim to not abuse its position as only entity able to sign code that would run on nearly all secure boot enabled devices ??? And how is HP fucking their eufi up a Microsoft problem?
      - josefx 5y ago
        > And how is HP fucking their eufi up a Microsoft problem? My claim was that there where computers where Linux only ran with Microsofts signature. I listed two systems (HP/Surface) where this is the case. Mainly because finding more is a pain, with support requests more likely to go off to nowhere instead of outright showing that no support for it exists. One might make the case that Microsoft claimed it would require the ability to add alternative keys and conveniently failed to enforce that claim. If the goal was to blame Microsoft instead of just showing that Secure Boot can be easily used to lock users into one top down approved system.
michaelmrose 5y ago
It's a token and the ability to attest to others that you are running software signed with a key you don't control making it the root of any effective set of controls. Without it how do you keep someone from running whatever they please and lying to the machine on the other side of the connection?
michaelmrose 5y ago
When trusted computing was first discussed everything but the "trusted" browser blocking a particular website was discussed as a feature not a threat model and you can absolutely see how many consumer devices are currently locked down in just such a fashion. Accessing the tpm doesn't mean what you think it means. You can't by design get the key out of the tpm nor necessarily control which keys are trusted by local software nor remote machines. Control of what software is allowed to run is ultimately control over everything else because one kind of control gives you every other variety. The fact that you can disable secure boot or control which keys are trusted is a nicety that could be withdrawn next year along with your ability to run Linux. Your vendor approved software can then implement any sort of restrictions it pleases and remotely attest to the efficacy of such restrictions. Yes sir mr Amazon sir user id running trusted windows 11 and can't save or share this video as per your contract with Disney nor are they allowed to view any known pirate sites or sites that look like pirate sites according to our heuristics. Alternatively. Please upgrade to a trusted windows 11 machine to view this content. https://www.gnu.org/philosophy/can-you-trust.en.html https://www.gnu.org/philosophy/can-you-trust.en.html
- staticassertion 5y ago
  > You can't by design get the key out of the tpm nor necessarily control which keys are trusted by local software nor remote machines. I know this... I've even repeatedly stated as such in this thread. The rest of your post is just a silly hypothetical and frankly linking gnu is just discrediting.
  - michaelmrose 5y ago
    It's not silly hypothetical there have already been devices that used secure boot to lock out alternative OS and allowing third parties a say in what software is run is literally the entire point of remote attestation. The last sentence is particularly disappointing. The article's analysis is correct and not particularly complicated it stands on its own regardless of whatever bias you possess.
    - 5y ago

shadilay 5y ago

Linux is "insecure", Society^TM supports Windows only, please install Windows to continue using Bank^TM, School^TM, and irs.gov. 'Legacy' tax paying is now unsupported, please use new and improved windows.irs.gov

michaelmrose 5y ago
Worse Ubuntu is "insecure" please upgrade to Microsoft Linux 2024.
- shadilay 5y ago
  Worse, now that WSL2 exists why would you want to run Linux on baremetal anyways. EEE

tehbeard 5y ago

So if it's just a hardware crypto token, how does it work with secure boot? Just the other chips on the mobo working in concert, no OS oversight?

staticassertion 5y ago
It's unrelated to secure boot.
- michaelmrose 5y ago
  It's party of an overarching set of standards called Trusted Computing.

josefx 5y ago

There are quite a few computers already where Linux only runs as long as Microsoft provides a signed shim for the boot loader. There was quite a bit of a controversy because of this when secure boot came out.

staticassertion 5y ago
Really? Which computers? I don't know of any. To my knowledge the entire secure boot thing was blown way out of proportion - Linux users still can install Linux, they can even sign their own bootloaders.
- josefx 5y ago
  At least HP sold some where it seemed to intentionally disable setup mode for consumer grade hardware[1]. Arm based Surface devices where locked down to WindowsRT using secure boot[2]. The WindowsRT case was basically the foundation of the outrage, not only did Microsoft claim to not abuse its position as only entity able to sign code that would run on nearly all secure boot enabled devices, it immediately released a secure boot enabled product that locked out Linux. [1]https://superuser.com/questions/1024111/adding-keys-to-secure-boot-database-on-an-hp-pavilion-14-ab057ca https://superuser.com/questions/1024111/adding-keys-to-secur... [2]https://www.mickaelwalter.fr/linux-on-surface-rt/ https://www.mickaelwalter.fr/linux-on-surface-rt/
  - staticassertion 5y ago
    > not only did Microsoft claim to not abuse its position as only entity able to sign code that would run on nearly all secure boot enabled devices ??? And how is HP fucking their eufi up a Microsoft problem?
    - josefx 5y ago
      > And how is HP fucking their eufi up a Microsoft problem? My claim was that there where computers where Linux only ran with Microsofts signature. I listed two systems (HP/Surface) where this is the case. Mainly because finding more is a pain, with support requests more likely to go off to nowhere instead of outright showing that no support for it exists. One might make the case that Microsoft claimed it would require the ability to add alternative keys and conveniently failed to enforce that claim. If the goal was to blame Microsoft instead of just showing that Secure Boot can be easily used to lock users into one top down approved system.

michaelmrose 5y ago

It's a token and the ability to attest to others that you are running software signed with a key you don't control making it the root of any effective set of controls. Without it how do you keep someone from running whatever they please and lying to the machine on the other side of the connection?

michaelmrose 5y ago

When trusted computing was first discussed everything but the "trusted" browser blocking a particular website was discussed as a feature not a threat model and you can absolutely see how many consumer devices are currently locked down in just such a fashion. Accessing the tpm doesn't mean what you think it means. You can't by design get the key out of the tpm nor necessarily control which keys are trusted by local software nor remote machines. Control of what software is allowed to run is ultimately control over everything else because one kind of control gives you every other variety. The fact that you can disable secure boot or control which keys are trusted is a nicety that could be withdrawn next year along with your ability to run Linux. Your vendor approved software can then implement any sort of restrictions it pleases and remotely attest to the efficacy of such restrictions. Yes sir mr Amazon sir user id running trusted windows 11 and can't save or share this video as per your contract with Disney nor are they allowed to view any known pirate sites or sites that look like pirate sites according to our heuristics. Alternatively. Please upgrade to a trusted windows 11 machine to view this content. https://www.gnu.org/philosophy/can-you-trust.en.html https://www.gnu.org/philosophy/can-you-trust.en.html

staticassertion 5y ago
> You can't by design get the key out of the tpm nor necessarily control which keys are trusted by local software nor remote machines. I know this... I've even repeatedly stated as such in this thread. The rest of your post is just a silly hypothetical and frankly linking gnu is just discrediting.
- michaelmrose 5y ago
  It's not silly hypothetical there have already been devices that used secure boot to lock out alternative OS and allowing third parties a say in what software is run is literally the entire point of remote attestation. The last sentence is particularly disappointing. The article's analysis is correct and not particularly complicated it stands on its own regardless of whatever bias you possess.
  - 5y ago