3 ms·
To be fair, this person openly admits they don't understand the security proposition here. Pluton is certainly daunting and brings concerns to mind, but I'm goi
by reanimus 4y ago
To be fair, this person openly admits they don't understand the security proposition here. Pluton is certainly daunting and brings concerns to mind, but I'm going to take this person's thoughts with a grain of salt considering they extend that same suspicion to the TPM -- a piece of hardware that arguably provides great security value to the user. That it's difficult to explain to the lay person (which I disagree with, personally) doesn't mean that it's bad, and while they acknowledge this, I think the answer is to try to dig in and understand better, not throw around suspicion out of some sense of intuition.
When you dig into this, Pluton is generally going to be shipped in one of three configurations:
1. Pluton presents itself as a TPM
2. Pluton doesn't emulate a TPM, can run other code (usually platform resiliency features, so think enterprise systems)
3. Pluton is disabled
Essentially, this is a standardization of the "firmware TPM" tech you can find in modern Intel/AMD processors, and they even mention that part of the driving reason behind this is that the current TPM status quo often incorporates a discrete TPM chip, which is vulnerable to attacks that intercept communication on the bus used by the TPM (thus allowing someone to steal encryption keys). This essentially moves to having a firmware TPM as a standard, as well as providing a more standardized API/update mechanism.
I have qualms with Microsoft spearheading the effort alone, but at face value, I don't think this is something bad. I think that hardening hardware against all forms of attack -- even physical -- is good. Just because it's not something you have to worry about (re: evil maid) doesn't mean someone else doesn't!
(For reference, this article covers a lot of what I'm referring to: https://noise.getoto.net/2022/01/09/pluton-is-not-currently-a-threat-to-software-freedom/ https://noise.getoto.net/2022/01/09/pluton-is-not-currently-...)