4 ms·

> it was designed to provide security against the owner no. no, no, no, no, no. holy crap, no. no. it was designed to prevent unauthorized access to hardwa

> it was designed to provide security against the owner no. no, no, no, no, no. holy crap, no. no. it was designed to prevent unauthorized access to hardware. corporations own computers, too. and you know what is on a lot of the computers they own? trade secrets. who wants those trade secrets? competitors, copycats, and so on. what is something that such motivated actors have a large amount of? money. money to hire thieves. money to buy expensive equipment. people to attempt to circumvent security measures. Pluton is designed to address situations like this. no one cares about John and Jane computer owner. Pluton will not be used against John or Jane unless John or Jane allow it, in some unforeseen situation I can't imagine. Pluton is a very good weapon for corporate IT admins trying to secure their devices. "BUT TPMs ALREADY DO THAT" not unless you require a PIN on boot, and PINs on boot are a pain in the ass. no one likes them, no one wants them. they often have huge complexity requirements and can be easily forgotten. PINs suck. they suck so much that some unfortunate companies decide against the PIN requirement and implement things like BitLocker using the TPM alone, and that is extremely insecure to anyone with physical access to a device because TPM traffic can be captured. "that seems like something that is very difficult and will never happen." it's very easy: https://news.ycombinator.com/item?id=29258879 https://news.ycombinator.com/item?id=29258879 Pluton was designed for the same thing that the Intel Management Engine and other related technologies were designed for: corporate IT administrators.

car_analogy 4y ago
In other cases where enterprises wanted something that consumers cared little about (ECC RAM comes to mind, or the artificial limit on number of concurrent connections in non-server Windows editions), manufacturers were happy to cripple their product for consumers, so they could charge a premium to less price-sensitive enterprises. But when it comes to Pluton, or the AMD and Intel management engines, they're making sure you can't buy a product without them at any price. > it was designed to prevent unauthorized access to hardware. Yes and it's all a big coincidence there's no owner override, so that only the manufacturer decides what is "authorized".
- naikrovek 4y ago
  I'm talking about PCs. the administrator gets to decide what is turned on and how it is used. the administrator has back doors in, that are more involved and more secure than the front door. the private keys don't go to the manufacturer, but are created by the owner, etc. there is always owner override in the case of the PC. consoles are locked down because we have demonstrated to console manufacturers again and again, for 40 years, that we will pirate games for the console if it is at all possible. we have left zero room for interpretation with this message. we WILL steal if there is any way to steal. so in the case of consoles, yes. manufacturer only.
  - nobodyandproud 4y ago
    Has Microsoft changed its TPM requirements for Windows 11? If not, then there is no override.
    - naikrovek 4y ago
      set the registry key and the requirement goes away. the tpm doesn't hide things from you, it hides things from attackers. if you don't want your disk encrypted, then decrypt it. you can do that. it's very easy.
      - car_analogy 4y ago
        And now you're straight up lying. The whole purpose of the TPM is to hide cryptographic keys from anyone with physical access, including the owner. There is no override an owner can perform (via, say, a password set on first boot, that may be used to dump all the keys from the TPM into RAM). It may not by itself force you to encrypt your disk, but it does enable all the abuses listed in https://en.wikipedia.org/wiki/Trusted_Computing#Criticism https://en.wikipedia.org/wiki/Trusted_Computing#Criticism, that I won't waste summarizing, as it's becoming increasingly obvious you're arguing in bad faith.
      - nobodyandproud 4y ago
        The requirement for TPM 2.0 goes away, but Windows 11 still requires TPM 1.2 even with said registry key. In short, there is no opting out barring an alternative OS.

car_analogy 4y ago

In other cases where enterprises wanted something that consumers cared little about (ECC RAM comes to mind, or the artificial limit on number of concurrent connections in non-server Windows editions), manufacturers were happy to cripple their product for consumers, so they could charge a premium to less price-sensitive enterprises. But when it comes to Pluton, or the AMD and Intel management engines, they're making sure you can't buy a product without them at any price. > it was designed to prevent unauthorized access to hardware. Yes and it's all a big coincidence there's no owner override, so that only the manufacturer decides what is "authorized".

naikrovek 4y ago
I'm talking about PCs. the administrator gets to decide what is turned on and how it is used. the administrator has back doors in, that are more involved and more secure than the front door. the private keys don't go to the manufacturer, but are created by the owner, etc. there is always owner override in the case of the PC. consoles are locked down because we have demonstrated to console manufacturers again and again, for 40 years, that we will pirate games for the console if it is at all possible. we have left zero room for interpretation with this message. we WILL steal if there is any way to steal. so in the case of consoles, yes. manufacturer only.
- nobodyandproud 4y ago
  Has Microsoft changed its TPM requirements for Windows 11? If not, then there is no override.
  - naikrovek 4y ago
    set the registry key and the requirement goes away. the tpm doesn't hide things from you, it hides things from attackers. if you don't want your disk encrypted, then decrypt it. you can do that. it's very easy.
    - car_analogy 4y ago
      And now you're straight up lying. The whole purpose of the TPM is to hide cryptographic keys from anyone with physical access, including the owner. There is no override an owner can perform (via, say, a password set on first boot, that may be used to dump all the keys from the TPM into RAM). It may not by itself force you to encrypt your disk, but it does enable all the abuses listed in https://en.wikipedia.org/wiki/Trusted_Computing#Criticism https://en.wikipedia.org/wiki/Trusted_Computing#Criticism, that I won't waste summarizing, as it's becoming increasingly obvious you're arguing in bad faith.
    - nobodyandproud 4y ago
      The requirement for TPM 2.0 goes away, but Windows 11 still requires TPM 1.2 even with said registry key. In short, there is no opting out barring an alternative OS.