4 ms·

I wonder how this is similar/different to the Qualcomm take on it? Semis curate seems to not be a fan: https://semiaccurate.com/2021/12/01/qualcomm-8cx-gen-3-to

I wonder how this is similar/different to the Qualcomm take on it? Semis curate seems to not be a fan: https://semiaccurate.com/2021/12/01/qualcomm-8cx-gen-3-too-dangerous-to-deploy/ https://semiaccurate.com/2021/12/01/qualcomm-8cx-gen-3-too-d...

no_time 5y ago
No wonder they are not a fan. We are rapidly accelerating towards a worst case dystopia where a handful of companies backed by state power control what you hear,say and execute on your machine. I predict atleast one major world power will mandate this technology in consumer electronics to be able to connect to the internet by 2030 in its current rate of adoption.
mastax 5y ago
They say it is remotely accessible but present no evidence. They present device-unique keys as impossible with no evidence despite that being exactly how TPMs have worked for decades. They didn't even mention what is the biggest concern: firmware. This thing is basically a secure microcontroller, and MS has implied that it can run different software to achieve different use cases (at launch it emulates a TPM). The important question is: does it only load firmware signed by Microsoft. If not, I don't have a big issue with it.
- judge2020 5y ago
  Not much of a security processor if you can throw whatever firmware you want on it and trick the host OS into thinking it hasn't been tampered with.
  - AnthonyMouse 5y ago
    Tricking the host OS into thinking whatever the user wants it to think is a feature of a security processor. How to design secure hardware: The system board contains two copies of the firmware, for which the source code is published. The first copy is fully read-only and cannot be modified after manufacture. The second copy is in flash memory. A switch or jumper on the system board determines which copy is used at boot. Now you can trust your software/firmware (if you could trust it from the factory), because the read-only copy can be used to boot the system in order flash the read-write copy to a trusted (possibly newer or third party) firmware version. This also means that a bad firmware update can't brick your hardware, because you can recover it by using the read-only copy. There is no requirement for the hardware to prove anything to the OS. If the hardware is compromised, this is not actually possible anyway, because it could lie. What you need is for the hardware to be able to prove something to the user, i.e. that the firmware update or operating system they just installed was actually installed and not ignored or modified by some already-compromised read-write firmware.
    - mindslight 5y ago
      nit: in order for something to be read-only it's got to be a mask ROM or otherwise burnt-in (rather than merely undocumented flash), which implies being small. So the read only part really just needs to be a well-documented bootloader rather than a whole BIOS partition. Also whenever you hear "security" you need to think "who's security?". Like when you go to the airport they're all on about "security" but it's not your security - you yourself are being made less secure by having to disassemble your person at the checkpoint for their security. Similarly a "security processor", as defined by Big Tech [0], has the goal of making them more secure at the expense of your own security. They can't have you running whatever pesky user-empowering software you want and all that. You might end up believing some of those radical ideas from the 90's! [0] which includes Big Hardware, which we're unfortunately reliant upon due to economies of scale.
      - AnthonyMouse 5y ago
        > in order for something to be read-only it's got to be a mask ROM or otherwise burnt-in (rather than merely undocumented flash), which implies being small. Not necessarily. Suppose you use ordinary flash but the write lines are physically not connected to it so there is no way to write to it from software. In theory someone could desolder it and replace the contents, but if the attacker is desoldering your hardware, you've already lost. > Also whenever you hear "security" you need to think "who's security?". They try to sell people the "security processor" as a feature. It's important to make everyone aware of what it really is.
        mindslight 5y ago
        > The first copy ... cannot be modified after manufacture A second flash chip with a write disable line would also work, but that's not what you described. For one difference, it allows for evil maid attacks with an external flasher. > But they try to sell people the "security processor" as a feature. It's important to make everyone aware of what it really is. I agree, but it's not productive to just unilaterally define "security processor" the other way and talk past the problem. Either qualify it ("user representing security processor"), or otherwise make it clear that "security" doesn't always imply something good for the user (in fact in consumer marketing material it's more often harmful than good).

no_time 5y ago

No wonder they are not a fan. We are rapidly accelerating towards a worst case dystopia where a handful of companies backed by state power control what you hear,say and execute on your machine. I predict atleast one major world power will mandate this technology in consumer electronics to be able to connect to the internet by 2030 in its current rate of adoption.

mastax 5y ago

They say it is remotely accessible but present no evidence. They present device-unique keys as impossible with no evidence despite that being exactly how TPMs have worked for decades. They didn't even mention what is the biggest concern: firmware. This thing is basically a secure microcontroller, and MS has implied that it can run different software to achieve different use cases (at launch it emulates a TPM). The important question is: does it only load firmware signed by Microsoft. If not, I don't have a big issue with it.

judge2020 5y ago
Not much of a security processor if you can throw whatever firmware you want on it and trick the host OS into thinking it hasn't been tampered with.
- AnthonyMouse 5y ago
  Tricking the host OS into thinking whatever the user wants it to think is a feature of a security processor. How to design secure hardware: The system board contains two copies of the firmware, for which the source code is published. The first copy is fully read-only and cannot be modified after manufacture. The second copy is in flash memory. A switch or jumper on the system board determines which copy is used at boot. Now you can trust your software/firmware (if you could trust it from the factory), because the read-only copy can be used to boot the system in order flash the read-write copy to a trusted (possibly newer or third party) firmware version. This also means that a bad firmware update can't brick your hardware, because you can recover it by using the read-only copy. There is no requirement for the hardware to prove anything to the OS. If the hardware is compromised, this is not actually possible anyway, because it could lie. What you need is for the hardware to be able to prove something to the user, i.e. that the firmware update or operating system they just installed was actually installed and not ignored or modified by some already-compromised read-write firmware.
  - mindslight 5y ago
    nit: in order for something to be read-only it's got to be a mask ROM or otherwise burnt-in (rather than merely undocumented flash), which implies being small. So the read only part really just needs to be a well-documented bootloader rather than a whole BIOS partition. Also whenever you hear "security" you need to think "who's security?". Like when you go to the airport they're all on about "security" but it's not your security - you yourself are being made less secure by having to disassemble your person at the checkpoint for their security. Similarly a "security processor", as defined by Big Tech [0], has the goal of making them more secure at the expense of your own security. They can't have you running whatever pesky user-empowering software you want and all that. You might end up believing some of those radical ideas from the 90's! [0] which includes Big Hardware, which we're unfortunately reliant upon due to economies of scale.
    - AnthonyMouse 5y ago
      > in order for something to be read-only it's got to be a mask ROM or otherwise burnt-in (rather than merely undocumented flash), which implies being small. Not necessarily. Suppose you use ordinary flash but the write lines are physically not connected to it so there is no way to write to it from software. In theory someone could desolder it and replace the contents, but if the attacker is desoldering your hardware, you've already lost. > Also whenever you hear "security" you need to think "who's security?". They try to sell people the "security processor" as a feature. It's important to make everyone aware of what it really is.
      - mindslight 5y ago
        > The first copy ... cannot be modified after manufacture A second flash chip with a write disable line would also work, but that's not what you described. For one difference, it allows for evil maid attacks with an external flasher. > But they try to sell people the "security processor" as a feature. It's important to make everyone aware of what it really is. I agree, but it's not productive to just unilaterally define "security processor" the other way and talk past the problem. Either qualify it ("user representing security processor"), or otherwise make it clear that "security" doesn't always imply something good for the user (in fact in consumer marketing material it's more often harmful than good).