3 ms·

TPM,Secure boot,Pluton,memory encryption... These are all the puzzle pieces of a locked down system more akin to an xbox than a PC. One by one they are harmless

TPM,Secure boot,Pluton,memory encryption... These are all the puzzle pieces of a locked down system more akin to an xbox than a PC. One by one they are harmless but together they can completely take away control from the user. These technologies could be good for everyone but right now they are good for whoever hold the encryption keys built into them (not you). With the user override feature detailed in the eff link we could have the best of both worlds (superb security, personal freedom to run anything). Too bad we are heading in the exact opposite direction... I invite you to read this https://www.eff.org/wp/trusted-computing-promise-and-risk https://www.eff.org/wp/trusted-computing-promise-and-risk or this http://www.diva-portal.org/smash/record.jsf?pid=diva2%3A206552&dswid=-525 http://www.diva-portal.org/smash/record.jsf?pid=diva2%3A2065...

scrps 5y ago
Sure, of course there is tension between security and control, the same systems that allow me to secure my system from tampering or theft can also be used against me by the vendor to stop me from having full access. I don't think that problem can be attacked by blaming the underlying tech, that quickly heads into the same territory of thought governments use to try and justify weakening encryption because it can be used by bad actors. I think the options (and to be fair all of them are hard) are: competition from vendors that allow full control, regulation from governments forcing vendors to give users full access, or subverting the implementation to regain control. Also forgot to mention with secure boot you are able to sign with keys you have generated.
- no_time 5y ago
  >competition from vendors that allow full control, All major manufacturers of modern processors are part of the "Trusted" Computing Group. There will be no meaningful competition in that space. >regulation from governments forcing vendors to give users full access This would be the best but also the most unlikely scenario. The status quo can only benefit from what will happen. Imagine the government standing up to big corporations to benefit the people. Yeah, I can't either. >subverting the implementation to regain control I think this is what will happen from time and time. Every 5 years we will have a brief time when people possessing certain hardware will have full control yet again, only for it to be patched out (like in the case of the Nintendo Switch) >Also forgot to mention with secure boot you are able to sign with keys you have generated. Oh sure you can. The question is whether will it make you fail hardware based attestation like in the case of android custom roms. Google effectively killed the custom rom scene by giving app developers a bulletproof way to block them.

scrps 5y ago

Sure, of course there is tension between security and control, the same systems that allow me to secure my system from tampering or theft can also be used against me by the vendor to stop me from having full access. I don't think that problem can be attacked by blaming the underlying tech, that quickly heads into the same territory of thought governments use to try and justify weakening encryption because it can be used by bad actors. I think the options (and to be fair all of them are hard) are: competition from vendors that allow full control, regulation from governments forcing vendors to give users full access, or subverting the implementation to regain control. Also forgot to mention with secure boot you are able to sign with keys you have generated.

no_time 5y ago
>competition from vendors that allow full control, All major manufacturers of modern processors are part of the "Trusted" Computing Group. There will be no meaningful competition in that space. >regulation from governments forcing vendors to give users full access This would be the best but also the most unlikely scenario. The status quo can only benefit from what will happen. Imagine the government standing up to big corporations to benefit the people. Yeah, I can't either. >subverting the implementation to regain control I think this is what will happen from time and time. Every 5 years we will have a brief time when people possessing certain hardware will have full control yet again, only for it to be patched out (like in the case of the Nintendo Switch) >Also forgot to mention with secure boot you are able to sign with keys you have generated. Oh sure you can. The question is whether will it make you fail hardware based attestation like in the case of android custom roms. Google effectively killed the custom rom scene by giving app developers a bulletproof way to block them.