5 ms·
> There's nothing to stop you from booting into another OS and deleting the files implementing the harmful functionality. If there are checks for the presence o
by ddalex 5y ago
> There's nothing to stop you from booting into another OS and deleting the files implementing the harmful functionality. If there are checks for the presence of these files in other parts of the OS, you can remove them
Encrypted disks with TPM-stored keys will certainly prevent unauthorised modification to a filesystem
> hardware allows booting arbitrary code
And this particular cat is already out of the bag with Win 11 REQUIRING TPM support with verified boot.
The war against general-purpose computing is in the final stages, and the garden-keepers have already won for almost everything that matters. Yes, you can still source open hardware and they will not fight against technical elites - a minority - but for the vast majority of users, it's over because they LIKE the closed apps holding data hostage.
- grishka 5y agoSo this might be a dumb question, but what's there to prevent someone emulating a TPM? What's there to prevent someone nop'ing out the code that implements the TPM functionality in Windows? Where does the root of trust (or, rather, distrust) come from?
- marcosdumay 5y agoThe TPM chip has a builtin key that you, as the device owner is not allowed to read. That key is certified by the manufacturer. If any manufacturer starts selling chips where you can read the key, it will be disallowed by Microsoft.
- grishka 5y agoSo okay, you again assume that software is immutable. But Windows has to store these trusted keys somewhere. What if I emulate the TPM with a key I generated myself, and patch Windows to trust that key?
- marcosdumay 5y agoThen you will discover that Secure Boot will stop your computer from starting until you reinstall something signed by Microsoft.
- grishka 5y agoCan't you just turn that off in the BIOS settings?
- ddalex 5y agoNot if BIOS doesn't allow that to be turned off.
- grishka 5y agoUh, that's a thing?! How do people install Linux then? How does that work with PCI cards that contain executable code in their ROMs, does that code have to be signed by overlords now?
- marcosdumay 5y ago> How do people install Linux then? Basically, when MS started requiring Secure Boot on Windows computers, there were a few anti-trust actions against then that looked at this action. So they back-pedaled and required that people should be able to disable Secure Boot on x86 and amd64 computers. They also created a 3rd party certification program, that those distros one buys could pay for and get signed. But make no mistake, MS completely control the specs of any PC available to you, and will not miss a chance to remove the support for 3rd party OSes.
- grishka 5y agoI just feel like if everything available gets locked down, people would simply resort to running more open OSes in emulators or virtual machines. Set to autostart in full-screen, so the only part of modern Windows they ever see would be the boot sequence. Like you could install DOSBox on an iPad and basically use it like a full-fledged early 90s computer, especially if you have a keyboard.
- tenebrisalietum 5y agoYou'll boot Windows but can't mount the system volume if it's protected by a Bitlocker key derived from the TPM key.
- grishka 5y agoEven if you do a clean install yourself? Well then, gotta patch the installer. There's always a way!
- dane-pgp 5y agoSo control over all the computers in a country comes down to just a few keys held by "approved" manufacturers; or rather a single key, held by the government, which signs the list of approved manufacturer keys. Then all they need to do is require that ISPs only allow packets to be sent by computers that have passed a Measured/Trusted Boot check, and suddenly all online activity is restricted to "approved" computers, running code from "approved" app stores. "One Ring to rule them all, One Ring to find them, One Ring to bring them all and in the darkness bind them."
- marcosdumay 5y ago> So control over all the computers in a country comes down to just a few keys Notice that I didn't mention "country" anywhere. There's no country restriction. > or rather a single key, held by the government, which signs the list of approved manufacturer keys Hum, no. The single key is held by Microsoft. And yeah, that's basically what the Trusted Computing Consortium was designing at the early 00. But people pushed back enough that they stopped publishing public documents and delayed the implementation. We are just getting there.
- dane-pgp 5y ago> There's no country restriction. The technology may not care about countries, but countries care about technology. If (or rather when) a government passes a law limiting internet access to approved operating systems and hardware, the ISPs in that country will logically have to listen for signed updates to the whitelist. In practice the list might be very short, containing just intermediate keys representing Microsoft, Apple, Google, a few commercially-backed Linux distros, and the CPUs that support them (with the necessary TPMs). The intermediate keyholders would have the responsibility to revoke approval of versions / model numbers that have known vulnerabilities which allow arbitrary user-controlled code to run.
- userbinator 5y agoWhat's there to prevent someone nop'ing out the code that implements the TPM functionality in Windows? Nothing absolute, mainly a long series of annoying hurdles - including the constant barrage of updates.