4 ms·

The moment systems like TPM and secureboot were added it stopped being our hardware. We said as much back then, sabotage like described here show that analysis

by onli 4y ago

The moment systems like TPM and secureboot were added it stopped being our hardware. We said as much back then, sabotage like described here show that analysis was right. There is nothing that can be done as long as there is a processor duopoly that follows these ms requirements.

jeroenhd 4y ago
What's the problem with TPMs? Do you mean the Intel ME/AMD PSP or is there an anti hardware key movement out there that I don't know about?
- cesarb 4y ago
  AFAIK, the fears with TPM are mostly about remote attestation. That is, a remote system could certify that you are running Windows (and not something else like Linux) on the physical hardware (and not on a VM) before allowing access to some resource; and that "some resource" could in the future even include basic things like Internet access.
  - jeroenhd 4y ago
    That's a pretty terrible system, but I'm more afraid of the remote end of the system than the local one to be honest. We already have DRM and Intel providing features like SGX isn't the problem; the external parties choosing to restrict user freedom are. I don't think remote hardware attestation will be implemented anywhere but in enterprise environments where it makes sense to do so. Even on Android we see remote attestation being bypassed quite easily in most apps. Some banks and payment providers are harder to trick, but I don't think there's a version of the system that hasn't been bypassed yet.
    - Avamander 4y ago
      > Even on Android we see remote attestation being bypassed quite easily in most apps. Some banks and payment providers are harder to trick, but I don't think there's a version of the system that hasn't been bypassed yet. It's getting harder by the year. I think it has strangled a lot of the Android ROM and modding community really, how your apps can randomly stop working after an update or two or that you can't watch high-quality content.
      - jeroenhd 4y ago
        I think the Android ROM scene is starting to die out in general. Stuff not working outside official ROMs/on rooted devices has always been a problem, especially with DRM. People want the freedom to do what they want with their hardware and DRM people want people to do only what they allow with their hardware, the two parties will always be at odds. Huge parts of the ROM scene were on Google Plus (yes, people actually used that) rather than on XDA and similar, which didn't help. Google also tends to hire people who do impressive modifications for Android ROMs like the person who wrote magisk, making the custom ROM scene shrink some more. I remember the ROM scene being so much more active before the corruption and death of Cyanogenmod!
    - AshamedCaptain 4y ago
      > Even on Android we see remote attestation being bypassed quite easily in most apps. Some banks and payment providers are harder to trick, but I don't think there's a version of the system that hasn't been bypassed yet. You do not need to guarantee that it can't be bypassed. You just need to ensure that it is annoying for the average advanced user to bypass it and that's it -- the damage is done. And for example I have had to change banks already, and I consider myself a pretty advanced user...

by onli 4y ago

jeroenhd 4y ago

What's the problem with TPMs? Do you mean the Intel ME/AMD PSP or is there an anti hardware key movement out there that I don't know about?

cesarb 4y ago
AFAIK, the fears with TPM are mostly about remote attestation. That is, a remote system could certify that you are running Windows (and not something else like Linux) on the physical hardware (and not on a VM) before allowing access to some resource; and that "some resource" could in the future even include basic things like Internet access.
- jeroenhd 4y ago
  That's a pretty terrible system, but I'm more afraid of the remote end of the system than the local one to be honest. We already have DRM and Intel providing features like SGX isn't the problem; the external parties choosing to restrict user freedom are. I don't think remote hardware attestation will be implemented anywhere but in enterprise environments where it makes sense to do so. Even on Android we see remote attestation being bypassed quite easily in most apps. Some banks and payment providers are harder to trick, but I don't think there's a version of the system that hasn't been bypassed yet.
  - Avamander 4y ago
    > Even on Android we see remote attestation being bypassed quite easily in most apps. Some banks and payment providers are harder to trick, but I don't think there's a version of the system that hasn't been bypassed yet. It's getting harder by the year. I think it has strangled a lot of the Android ROM and modding community really, how your apps can randomly stop working after an update or two or that you can't watch high-quality content.
    - jeroenhd 4y ago
      I think the Android ROM scene is starting to die out in general. Stuff not working outside official ROMs/on rooted devices has always been a problem, especially with DRM. People want the freedom to do what they want with their hardware and DRM people want people to do only what they allow with their hardware, the two parties will always be at odds. Huge parts of the ROM scene were on Google Plus (yes, people actually used that) rather than on XDA and similar, which didn't help. Google also tends to hire people who do impressive modifications for Android ROMs like the person who wrote magisk, making the custom ROM scene shrink some more. I remember the ROM scene being so much more active before the corruption and death of Cyanogenmod!
  - AshamedCaptain 4y ago
    > Even on Android we see remote attestation being bypassed quite easily in most apps. Some banks and payment providers are harder to trick, but I don't think there's a version of the system that hasn't been bypassed yet. You do not need to guarantee that it can't be bypassed. You just need to ensure that it is annoying for the average advanced user to bypass it and that's it -- the damage is done. And for example I have had to change banks already, and I consider myself a pretty advanced user...