4 ms·

> it's very hard to make remote attestation work in a way that gives you any meaningful guarantees (eg, simply forward the challenge on to a machine that is run

> it's very hard to make remote attestation work in a way that gives you any meaningful guarantees (eg, simply forward the challenge on to a machine that is running the "approved" OS). I was imagining something like that would be possible (for people with enough tech knowledge), but it's good to have it confirmed, thank you. There would presumably be a cat-and-mouse game of the "approved" OS trying to detect if it was being co-opted into such a scheme. > They don't need to wait years for everyone to shift to new hardware that has Pluton in it. As you say, I'm more worried about Windows 11 than Pluton, but presumably the "importance" of Pluton is part of Microsoft's excuse for not supporting non-TPM hardware any more. Once Windows 10 is out of security support (for home users at least), it will be easier for Microsoft to claim that non-TPM Windows devices are de facto insecure.

judge2020 5y ago
> it will be easier for Microsoft to claim that non-TPM Windows devices are de facto insecure. Which only means that programs can choose to not service devices without TPM - things like Netflix/Streaming Services and online competitive games, although it might take 10 years with the amount of people that will be unable to upgrade to 11 or upgrade their computer to one with a tpm at all. With computers become more and more about browsing the web, and especially with the chip shortage, people aren't upgrading their hardware as often.
- dane-pgp 5y ago
  > Which only means that programs can choose to not service devices without TPM But those "programs" could include "an online check made by your ISP, mandated by your government". If your computer doesn't pass the check, it won't be allowed online. What good is a phone call if you're unable to speak? > it might take 10 years I think more like 5, although the government might start slowly, like only preventing non-TPM devices from accessing "sensitive" online services, e.g. banks or anything that requires a payment. The next step would be connecting the "online check" with a biometric ID, enforced by the device. Every time you unlock your device, it would request from the government a random ID that is included in every packet sent, and those IDs would be tied to your legal identity in a government database. Letting someone else use your device would be similar to letting someone else use your car, in that you are responsible for whatever is done while you are logged in, unless you report it stolen.
  - gruez 5y ago
    >I think more like 5, although the government might start slowly, like only preventing non-TPM devices from accessing "sensitive" online services, e.g. banks or anything that requires a payment. if that occurs, is that really of microsoft's doing, or of the government and all the other companies that are complicit? I can plausibly imagine a future where microsoft stays its course (ie. it doesn't lock down the x86 platform), but companies still force you to use locked down devices by forcing you to use mobile apps to do online banking. You already sort of see this with messaging apps, where a few (eg. signal) are mobile-only.
    - theevilsharpie 5y ago
      > You already sort of see this with messaging apps, where a few (eg. signal) are mobile-only. Signal has clients for Windows, Mac, and GNU/Linux.
      - gruez 5y ago
        > To use the Signal desktop app, Signal must first be installed on your phone.
        steelframe 5y ago
        I have CalyxOS installed on an old Pixel 2 for "mobile app required" stuff. Signal can verify your account via a voice call to a landline phone number, and I have a cheap VoIP number that worked fine for that. But the general point is taken. For example my HOA requires payment via Zelle, and my bank requires that I use their mobile app to make Zelle payments. I can still run their app on CalyxOS just fine via microG, but I feel like microG is something Google would find a way to shut down if it were to hit some critical mass of adoption.
  - judge2020 5y ago
    None of these have any requirement on some TPM specification. A government can already do as much invasive monitoring as they want, either by forcing citizens to install MITM root CAs[0] or generally requiring invasive identity checks when people sign in, or just limiting what privacy-invasive devices are even allowed to be sold at all. Banks can already go "lol no web frontend for you, go use our mobile app". And neither Visa/Mastercard nor their bank partners are going to allow such strict restrictions that'll surely reduce the amount of impulsive purchases people can make, and you forget that every online payment is already hard tied to your identity via your bank / credit accounts. > in that you are responsible for whatever is done while you are logged in, unless you report it stolen. This is only really true for insurance purposes - for stuff like red light cams, the tickets are invalid if you weren't the one driving (which is why some newer ones snap temporary pictures of people in the driver seat in case they end up running the light). 0: https://news.ycombinator.com/item?id=20472179 https://news.ycombinator.com/item?id=20472179

judge2020 5y ago

> it will be easier for Microsoft to claim that non-TPM Windows devices are de facto insecure. Which only means that programs can choose to not service devices without TPM - things like Netflix/Streaming Services and online competitive games, although it might take 10 years with the amount of people that will be unable to upgrade to 11 or upgrade their computer to one with a tpm at all. With computers become more and more about browsing the web, and especially with the chip shortage, people aren't upgrading their hardware as often.

dane-pgp 5y ago
> Which only means that programs can choose to not service devices without TPM But those "programs" could include "an online check made by your ISP, mandated by your government". If your computer doesn't pass the check, it won't be allowed online. What good is a phone call if you're unable to speak? > it might take 10 years I think more like 5, although the government might start slowly, like only preventing non-TPM devices from accessing "sensitive" online services, e.g. banks or anything that requires a payment. The next step would be connecting the "online check" with a biometric ID, enforced by the device. Every time you unlock your device, it would request from the government a random ID that is included in every packet sent, and those IDs would be tied to your legal identity in a government database. Letting someone else use your device would be similar to letting someone else use your car, in that you are responsible for whatever is done while you are logged in, unless you report it stolen.
- gruez 5y ago
  >I think more like 5, although the government might start slowly, like only preventing non-TPM devices from accessing "sensitive" online services, e.g. banks or anything that requires a payment. if that occurs, is that really of microsoft's doing, or of the government and all the other companies that are complicit? I can plausibly imagine a future where microsoft stays its course (ie. it doesn't lock down the x86 platform), but companies still force you to use locked down devices by forcing you to use mobile apps to do online banking. You already sort of see this with messaging apps, where a few (eg. signal) are mobile-only.
  - theevilsharpie 5y ago
    > You already sort of see this with messaging apps, where a few (eg. signal) are mobile-only. Signal has clients for Windows, Mac, and GNU/Linux.
    - gruez 5y ago
      > To use the Signal desktop app, Signal must first be installed on your phone.
      - steelframe 5y ago
        I have CalyxOS installed on an old Pixel 2 for "mobile app required" stuff. Signal can verify your account via a voice call to a landline phone number, and I have a cheap VoIP number that worked fine for that. But the general point is taken. For example my HOA requires payment via Zelle, and my bank requires that I use their mobile app to make Zelle payments. I can still run their app on CalyxOS just fine via microG, but I feel like microG is something Google would find a way to shut down if it were to hit some critical mass of adoption.
- judge2020 5y ago
  None of these have any requirement on some TPM specification. A government can already do as much invasive monitoring as they want, either by forcing citizens to install MITM root CAs[0] or generally requiring invasive identity checks when people sign in, or just limiting what privacy-invasive devices are even allowed to be sold at all. Banks can already go "lol no web frontend for you, go use our mobile app". And neither Visa/Mastercard nor their bank partners are going to allow such strict restrictions that'll surely reduce the amount of impulsive purchases people can make, and you forget that every online payment is already hard tied to your identity via your bank / credit accounts. > in that you are responsible for whatever is done while you are logged in, unless you report it stolen. This is only really true for insurance purposes - for stuff like red light cams, the tickets are invalid if you weren't the one driving (which is why some newer ones snap temporary pictures of people in the driver seat in case they end up running the light). 0: https://news.ycombinator.com/item?id=20472179 https://news.ycombinator.com/item?id=20472179