27 ms·

The Dangers of Microsoft Pluton

733 points by gjsman-1000 4y ago

thriftwy 4y ago
I don't see how this Babel tower of acronyms will not fail in a spectacular fashion, such as producing malware which is run upon receipt, cannot be by any action removed from your PC and installs crypto miner and ransomware on it.
ajuc 4y ago
Hopefully EU bans this.
beprogrammed 4y ago
I'm all for it, just let me delete the Microsoft keys and start the trust chain with my own
aasasd 4y ago
Sounds like the anti-trust case (heh) can be started as soon as the first locked-in computer rolls off the line.
deleted 4y ago
[deleted]
tuetuopay 4y ago
The thing I fear the most with this is "proof that secure boot has never been disabled". This is just a way to brick your device from accessing services. What if you government's tax service requires such proof? Or bank? I cannot count how many machines I booted on Linux to rescue a hard drive, or image it, or wipe it, or just to install linux on them. All those devices, boom, paperweight for regular personal use. I hate it so much that Microsoft is alone in this. It's not because it's M$, it's because they're alone on it.
- tadfisher 4y ago
  This is already a problem with SafetyNet hardware attestation on Android. Because it's so easy to implement on the app side, everything from banking apps to games is verifying the device is running a blessed system image with a locked bootloader and no root access (read: no access to general-purpose computing). As a developer of a banking app, I do my best to avoid implementing this user-hostile crap, but not all developers are empowered to say "no" to this requirement and not all care. There is zero benefit to the user to block them from using your services, and I would argue the net benefit is negative to the service. Users aren't hacked via privilege escalation exploits, they are hacked by phishing, and they can be phished on a SafetyNet-compliant device just fine.
  - toastal 4y ago
    I really appreciate knowing some devs are out there defending us from the banking app madness. I'd encourage you, given your position, to write a blog post about why device ownership is important and your experiences on how others should consider operating.
  - tuetuopay 4y ago
    I never knew SafetyNet was a thing, and wow, what a bullcrap thing for the basic consumer. Thank you for being a smart banking app developer. There is so much bullshit in most of those apps that I consider them as "worst apps on my phone", but due to management incompetence rather than developer incompetence.
- cryptonector 4y ago
  You get two devices.
  - tuetuopay 4y ago
    And more e-waste? Thanks but no thanks, I already have enough paperweights.
mjg59 4y ago
This is not a good article. At a technical level it's confused about a whole bunch of things: * SMM has been part of x86 for decades. The Secured Core requirements around SMM actually reduce its power. * The claimed requirement to remove the third party UEFI CA certificate from 2022 Secured Core PCs is entirely unrelated to Pluton (it's required regardless of whether Pluton is enabled or not, and even whether the CPU has Pluton or not) * Most of the description of Pluton is actually a description of a TPM. You don't need DICE for remote attestation. TPMs are already a hardware keystore. * System firmware is already being updated via Windows Update. The discussion about Pluton and Windows Update is around Pluton getting firmware updates that way (the existing story around firmware updates for TPMs is largely not good) * Existing TPM-based remote attestation already includes the secure boot state The short version: everything that the article is worried about being enabled by Pluton is already possible, and has been for years. But there's a meaningful point here. Remote attestation can certainly be used to restrict access to resources in ways that are incompatible with general purpose computing, or which reduce user choice. Remote attestation can also be used to give end users confidence that their machine is in a good state without constraining what they do with it. As a technology, remote attestation can be used in both good and bad ways. We do need to keep track of whether anyone is threatening to use it in bad ways and react appropriately. (But tbh remote attestation as an attack on general purpose computing isn't the really scary thing about widespread remote attestation. Remote attestation ties back to the TPM's endorsement key, an immutable cryptographic key certified by the TPM vendor at manufacturing time. The straightforward implementation of allowing arbitrary remote sites to trigger remote attestation would tie all of these accesses back to a single piece of hardware, and would be a privacy nightmare.)
- gjsman-1000 4y ago
  You are incorrect yourself in several ways here. > The claimed requirement to remove the third party UEFI CA certificate from 2022 Secured Core PCs is entirely unrelated to Pluton (it's required regardless of whether Pluton is enabled or not, and even whether the CPU has Pluton or not) Pluton is de-facto a Secured Core PC implementation, and Secure Core PCs are also making this change. Thus it effects both Pluton and Secured Core, but the new requirement does not effect non-Pluton and non-Secure-Core systems. Because Secured-Core PCs are currently niche and will no longer exist once Pluton is broadly adopted, Pluton will be the first appearance of this change for the vast majority of users. If I'm selling a 12th Gen Intel system right now, I can keep the 3rd-party UEFI certificate enabled. If I am selling a 12th Gen Secure Core PC, then this year I must disable that certificate, but my non-Secured-Core PCs can again keep it open. When Pluton arrives, that door must be shut. You can verify this with Microsoft's Secured Core PC documentation: https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11 https://docs.microsoft.com/en-us/windows-hardware/design/dev... > Most of the description of Pluton is actually a description of a TPM. You don't need DICE for remote attestation. TPMs are already a hardware keystore. To an extent. The original TPM is very finicky as documented by the comments on this post and elsewhere - even changing a RAM stick could invalidate the TPM's assertion. For this reason, the TPM was very unideal for DRM due to it's all-or-nothing approach, which Microsoft Pluton does not make the mistake of repeating, allowing for much more granular security that makes it much more easily applied. The second reason why Pluton is much more dangerous is that the TPM could be easily virtualized or hacked over the bus rendering DRM use-cases quite broken, whereas Pluton supports neither weakness, making its DRM potential (again) much more potent. Finally, using DICE, unlike a TPM, the Pluton is explicitly designed to give a computer a permanent identity that can never be erased, which (again) TPM does not guarantee. Useful HN comment explaining: https://news.ycombinator.com/item?id=25193346 https://news.ycombinator.com/item?id=25193346 That's actually the big reason why the Remote Assertion is an important point here. The TPM version of it was almost unusable outside of very niche business applications and BitLocker, while with DICE, the Pluton is far more potent. (After all, if TPM worked fine on it's own, why does DICE even exist?) I think the last point to further back this view I will also add is these comments from a Microsoft employee on the subject. https://lobste.rs/s/fdguww/dangers_microsoft_pluton#c_tdlo1r https://lobste.rs/s/fdguww/dangers_microsoft_pluton#c_tdlo1r > System firmware is already being updated via Windows Update. The discussion about Pluton and Windows Update is around Pluton getting firmware updates that way (the existing story around firmware updates for TPMs is largely not good) Microsoft themselves states in Pluton's announcement that Pluton will hardware-integrate with Windows Update for various system firmware, through their "chip-to-cloud" security initiative. To quote them: "One of the other major security problems solved by Pluton is keeping the system firmware up to date across the entire PC ecosystem. Today customers receive updates to their security firmware from a variety of different sources than can be difficult to manage, resulting in widespread patching issues. Pluton provides a flexible, updateable platform for running firmware that implements end-to-end security functionality authored, maintained, and updated by Microsoft. Pluton for Windows computers will be integrated with the Windows Update process in the same way that the Azure Sphere Security Service connects to IoT devices." This is a little frustratingly vague and thus part of the reason why Pluton requires some speculation. Judging by the reference to "different sources that are difficult to manage", it appears you don't update Pluton, Pluton updates you. Pluton has an active role in your system's security, whereas TPM was only passive.
balls187 4y ago
> It may contain inaccuracies or speculation... This means to take anything written in that article with a grain of salt.
stakkur 4y ago
Every story about Microsoft--every time--ends with "...and then Microsoft fucked people over". After decades of watching the shitshow that is Microsoft, and the moral equivocating around defending them, I always return to this.
Ruq 4y ago
Security can be used to create both a safe, and a jail. Remember that. --- I think Microsoft feels threatened at this point about Linux becoming more popular on PCs; what with hardware like the Steam Deck. Can't have Linux dominate the PC platform if you forcefully bind all hardware to the Windows ecosystem. Imagine if back in the day Microsoft used their dominance to block out all competing software on PCs but their own. --- I can see a dystopian future where Government can enforce code/file signing with technologies like this (DRM), so that you can never again have an open computing platform; you could only ever use code or view files approved by the State, and if you try to write code or create content, it won't work period unless it is first approved by the State. (such as with an AI scanning tool to detect and block "wrong-think" or "dangerous functionality" (i.e. dissent or otherwise that threatens the powers that be))
- sandworm101 4y ago
  Don't worry. Linux will always run on server hardware. We will just learn how to build rack-mounted gaming PCs.
  - Ruq 4y ago
    This made me laugh. I also look forward to the potential of open technologies like what RISC-V appears to enable. It's not all bad for sure.
phendrenad2 4y ago
These paranoid delusions never get old. If Microsoft accidentally changes their license agreement to lorem ipsum, bloggers like this will surely be trying to decipher exactly how it steals their freedom. The fatal flaw in these posts is, as it always is, the blind assumption that Microsoft can just do whatever they want, unimpeded. If Microsoft declared, as an april 1st joke, that app PCs henceforth must be painted sky blue, these bloggers would take it seriously. They act as though Microsoft is the high priesthood of computers, and they can declare literally anything with the stroke of a pen. They act like Mac doesn't exist, cheap Linux computers don't exist, RISC-V (which doesn't even run Windows) doesn't exist. Non-Windows-compatible ARM devices don't exist. PC vendors are mindless drones that do whatever Microsoft tells them (even if it means losing billions of dollars to Apple) and they certainly aren't selling (Dell: https://news.ycombinator.com/item?id=4847720 https://news.ycombinator.com/item?id=4847720) linux (HP: https://news.ycombinator.com/item?id=31617198 https://news.ycombinator.com/item?id=31617198) laptops (Lenovo: https://news.ycombinator.com/item?id=28186204 https://news.ycombinator.com/item?id=28186204) right now (and don't even think about installing Linux on your Google Chromebook, it won't work! https://support.google.com/pixelbook/answer/9031351?hl=en https://support.google.com/pixelbook/answer/9031351?hl=en ). The usual rebuttal is "Well, yeah, things are fine NOW, but they're moving the chess pieces into place to do these things LATER". Yawn. I have heard this for 20+ years. See you in another 20...
fleventynine 4y ago
Hardware-based attestation of the running software is an important security feature, especially in a world where data leaks and identity theft are rampant. Let's say I'm a healthcare provider, and I'm about to send your medical data to a third party vendor. Wouldn't you prefer that your data only be able to be decrypted by a computer can prove to the world it booted a clean OS image with all the latest security patches installed? If the vendor wants to install some self-built OS that they trust on their computer and not update it for 5 years, that's their business, but I may not want to trust their computer to have access to my data. Remote attestation gives more control to the owners of data to dictate how that data is processed on third-party machines (or even their own machines that may have been compromised). This is useful for more than just DRM.
Charlie11 4y ago
[dead]
metadat 4y ago
Ew. Why are all the chip manufacturers going along with this stupid plan? I want to buy a processor and then own it and have it work in my best interests, not consume electricity and generatie heat enforcing draconian 3rd party DRM policies.
- paxys 4y ago
  Because Apple
- gjsman-1000 4y ago
  It's tragic (especially if you care about general-purpose computing and the future of open platforms), and a sign that Microsoft's Palladium project was never really canceled. Boil the frog... Of course, Microsoft would say it's not about DRM (at least right now), it's for "security." Which... its secure as Microsoft's servers are, to be sure.
  - intelVISA 4y ago
    Next-Generation Secure Computing my ass.
- kimmeld 4y ago
  The market (software/system builders) say that locked down platforms like the iPhone are fabulously profitable. Sorry.
  - metadat 4y ago
    Lol, cargo-cult chip fabbing. What's next? I can't even fathom.. maybe this inability on my part is a blessing in disguise.
  - arlcode 4y ago
    And that's why the road to a better software ecosystem is not some hackers smart trick to defeat the system for the moment but very clear rules of what is allowed to be done in the name of security and what isn't A legislative piece of paper (or many pieces of paper) have the power to reign in corporations far far beyond any technical solution or workaround. And yes, that requires limiting (intellectual) property rights and regulating what certain contracts can enforce. Sometimes it's needed if you ask me In my experience this sentiment is rejected primarily by many technical people because it feels like adding the human factor to a pristine world of logic. In reality it's humans all the way down and there is no reason to believe that Microsoft/Apple is a better steward than an elected body of representatives acting according to the rule of law
rtpg 4y ago
I'm not hyped about most of the DRM stuff (and yeah, frog boiling is definitely a worry, though I don't know how we could ever end up with devices that can't boot alternative OSes just cuz of how servers are set up). But I am personally glad to see hardware-level key stores show up on all CPUs. Maybe this is already a thing and I'm being duped by Apple for thinking it's good, but it feels good to me.
- gjsman-1000 4y ago
  I'm not really worried myself that alternative Operating Systems will be locked out. However, I am concerned that the functionality of alternative Operating Systems will be locked out. If you see the (speculative but grounded) area near the end of the article - imagine if assertion becomes popular for things such as games or digital movies or the school WiFi. Your Linux PC will never be able to do that, and WINE (probably) won't be able to help. Won't stop you from hosting a server, but it will make it much harder to enjoy a Linux desktop. That's an issue.
  - vladvasiliu 4y ago
    > imagine if assertion becomes popular for things such as [...] digital movies You don't need that. Streaming is already crippled on Linux. Hell, Netflix won't even stream full quality on Chrome! > https://help.netflix.com/en/node/13444 https://help.netflix.com/en/node/13444 4K Ultra HD on a computer Netflix is available in Ultra HD on Windows and Mac computers with: Microsoft Edge for Windows Windows app for Windows 10 and Windows 11 Safari for MacOS 11.0 or later
    - arpa 4y ago
      ... and this is why piracy will always continue to be a viable alternative.
      - hammyhavoc 4y ago
        Until access to the internet or methods of circumventing DRM are crippled without submitting to these technologies. That's the road we're heading down. Can't hack the current-gen Xbox, apparently. I'm wondering if someone will take that as a "challenge accepted".
userbinator 4y ago
What is to prevent school WiFi from one day requiring a Pluton assertion that your Windows PC hasn’t been tampered with before you can join the network? Remote attestation is the true enemy of your freedom. The power of the authoritarian corporatocracy to force you to use only the (entire) systems they control. It's worth reading https://www.gnu.org/philosophy/right-to-read.en.html https://www.gnu.org/philosophy/right-to-read.en.html again just to see how prescient Stallman was.
- turns0ut 4y ago
  Engineers could leverage their economic might via collective action; don’t open your wfh laptop today. Updating the Upton Sinclair quote without the gender bias; it’s difficult getting a person to understand something when their investment portfolio valuation depends on them not understanding it. Who are they if they’re not what they are now? When you all stop posting on corporate forums and working their jobs, shopping their stores, I’ll take you all sincerely and seriously.
- r3trohack3r 4y ago
  This was the case at my university. In order to use the dorm network, you had to download a software package that validated your setup. It would then add your computer (I assume MAC) to an allow-list. In order to deal with it, I had to create a subnet with a router, use an old laptop to do the verification, and then the whole subnet was added to the allow-list.
- gfo 4y ago
  This is almost the entire thesis of Zero Trust Networking principles. Somehow, the user AND the device need to attest to validity during the authorization process. "Validity" for a device can mean many things (latest patches, is running anti-virus software, among other things). A general user probably doesn't need to attest to these things. I would argue that anyone trying to access a corporate or some other organization's network SHOULD be required to attest to these things given the cyber threat landscape. The caveat: those same entities should provide or heavily subsidize the platforms they require (work computers). It's their IP at risk. I'm not so naive to think they would actually do this with BYOD initiatives, unfortunately. For personal users on personal devices, I agree this might go too far (but some principles like MFA are best practices).
jhanschoo 4y ago
While I disagree with the author's opinion, it was very informative for me.
- gjsman-1000 4y ago
  Not mentioned in the article - but it begs the question, could this have something to do with Microsoft's insistence that everyone, even Pro users in the next update, use a Microsoft Account with Windows 11? If Pluton (or Pluton 2, someday) could be tied to a Microsoft Account, wouldn't that be something.
  - superchroma 4y ago
    It's I think a general desire for end to end traceability and therefore accountability, which both managers and developers tend to like, albeit for different reasons.
  - sillysaurusx 4y ago
    Is it okay to talk about language as a meta-topic? I try not to stray too far into that, since it’s usually boring for readers. But one thing I was surprised to learn is that “begs the question” is only correct when you’re describing a chain of circular logic. “Raises the question” is apparently the right term for the general case. I felt a little duped, since I’d been using “begs the question” for years without looking into its origins. But of course, that begs the question of whether language is defined by how people use it. :)
    - selfhoster11 4y ago
      I purposefully "misuse" the phrase "begging the question" to mean the same thing as the grandparent, because I want to do my part to change what this phrase means. Using "begging the question" to mean something as obscure and unintuitive (as in, it's basically an idiom that must be explained first) as "your question originates from circular logic" is a waste of prime dictionary space. This term should mean "there is a question that is so blindingly obvious regarding the situation at hand, that it simply begs to be asked" - so, more or less what everyone who didn't have the term explained to them, thinks it's supposed to mean.
Lucasoato 4y ago
> The road to hell is paved with good intentions. If there were only dystopic uses of this technology, its development wouldn't be able to go on internally. They are specifically taking this path so they always have plenty of good reasons to pursue their agenda.
pjmlp 4y ago
Regardless of all the FUD against Pluton, it has a great feature, it is yet another CPU with hardware memory tagging, as the last resort against C flaws and derived languages.
- selfhoster11 4y ago
  FUD is no longer FUD when it becomes a realistic danger. Given that remote attestation already had deleterious effects for user freedoms on smartphones and tablets (meaning, choose between banking apps and any deviation from the factory ROM), Pluton should be seen as a danger.
  - pjmlp 4y ago
    Smartphones and tablets are electronic gadgets. If you want a general purpose computer get a laptop. Most likely one sold by Linux OEMs, like Tuxedo and System76.
    - selfhoster11 4y ago
      That's an invalid argument for multiple reasons, not the least of which is that some people can afford just one device. That device is likely to be a smartphone because everything is slowly moving in the direction of requiring one. If I need to spend extra money to get an additional "freedom device" and can't afford it, I just won't have one and will miss out on the good stuff.
      - pjmlp 4y ago
        Welcome to the 8 and 16 bit home computer days when OSes were written in ROMs.
        selfhoster11 4y ago
        Those OSes were distributed on ROM by necessity, because that was the most cost effective option available. Any modern limitations that prevent running your own software are not just artificial, but actually require additional effort to implement bootloader locking/integrity checks.
peter_retief 4y ago
Microsoft are trying to enforce a monopoly on hardware, where is the https://www.sec.gov/ https://www.sec.gov/ on this?
- mordae 4y ago
  This. M$ is literally trying to wall off the PC.
  - peter_retief 4y ago
    That is "exactly" what they are trying to do, I find it sad that people are prepared to accept this as business as usual, considering the efforts made to make Linux available to everyone.
  - pjmlp 4y ago
    Just catching up where IBM failed.
UberFly 4y ago
I've always thought that at some point the only "stomachable" version of windows is going to be some hacked offering, by god-knows-who or from where, but it'll still end up being preferable to what MS is requiring.
- hammyhavoc 4y ago
  Isn't that the way it's been for several versions now with scripts to disable all the telemetry and shovelware?
  - autoexec 4y ago
    As far as I know there are no scripts that are capable of disabling all of the telemetry and nothing that can't be undone the instant the computer has an internet connection and connects to windows update.
    - RajT88 4y ago
      Yes, you'll likely have to keep re-doing it. As far as scripts for it, this thread has some sage advice: https://www.reddit.com/r/privacy/comments/n3v0s5/disable_windows_10_telemetry_2021/ https://www.reddit.com/r/privacy/comments/n3v0s5/disable_win... The tools to disable telemetry and bloat: https://github.com/irmatade/sharpapp https://github.com/irmatade/sharpapp https://www.oo-software.com/fr/shutup10 https://www.oo-software.com/fr/shutup10 https://github.com/Sycnex/Windows10Debloater https://github.com/Sycnex/Windows10Debloater MSFT doc on what all telemetry is gathered, and what is considered "required" telemetry (although they give you enough info to block it at the router): https://docs.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization https://docs.microsoft.com/en-us/windows/privacy/configure-w... I do like Win10 as an OS. On the whole I'd say the Satya era of MSFT is a mixed bag, but better on the whole than it was before.
paulcarroty 4y ago
I will definitely not buy CPU with built-in MS core. If Intel will add it too, guess it's time to get 12700 and use it for looong time.
- raxxorraxor 4y ago
  Problem is that the consoles market is very lucrative for CPU vendors because it is a guaranteed turnover of specific models. Intel, AMD and Qualcomm will implement them. You can disable it though. It would suck if it were enable by default, at least lenovo said they will disable it at first.
Gh0stRAT 4y ago
I'm completely missing how his example of a Word document that can only be opened by approved users on approved hardware within the corporation is supposed to be a bad thing. Honestly, that sounds pretty fantastic. I've been using 3rd party tools/extensions to do this sort of thing in corporate and government environments for years, but having the attestation go all the way down to the hardware level is a big value-add, especially with so much ransomware/spyware/extortion/espionage going on these days. Can someone please explain to me how the author might see this level of security as a bad thing?
- ctoth 4y ago
  So if I'm understanding this correctly, you'd prefer to live in the world where the Collateral Murder Wikileaks video of journalists being murdered in cold blood was never released because it was hardware locked to the original military system it was found on? Or maybe some large viral video which triggers a social uprising simply won't play. You are seriously so focused on pointless corporate secrets that you would actually consider giving the people in charge of the control over your information stream the ability to decide that something just shouldn't be shown? Because what? It might make discovery for a lawsuit more difficult? It'll make it easier to hide malfeasance? This seems particularly useful if you are trying to pretend that May 35th never happened, for instance. Terrifying, and rather icky.
- ftyhbhyjnjk 4y ago
  What you can install on YOUR pc will be at the sole mercy of microsoft/or maybe someone else.... That's the cusp of it. Not that it can be used for good, but that it sets the way for heavy misuse by large corporations. Wait a few years. Smaller companies won't even be allowed to order high end cpu's. You'll be at 100% mercy of these corporations. If after 2 years they decide to brick your pc, they'll just do it. You think government will help you out here? Lol...
  - eertvertvbw 4y ago
    still waiting on the secure boot lockdown everyone has insisted is coming for the better part of two decades...
TeeMassive 4y ago
Reminds of of Palladium: https://www.zdnet.com/article/microsofts-palladium-what-the-heck-is-it/ https://www.zdnet.com/article/microsofts-palladium-what-the-... https://en.wikipedia.org/wiki/Next-Generation_Secure_Computing_Base https://en.wikipedia.org/wiki/Next-Generation_Secure_Computi...
trh0awayman 4y ago
Can RISC-V save us here? Or is it time to start hoarding CPUs?
- ftyhbhyjnjk 4y ago
  It's time to start rejecting such corporations. Nothing else would work.
- zogomoox 4y ago
  I would assume chinese made RISC-V have their own special sauce.
  - hammyhavoc 4y ago
    That's a big assumption.
    - goodpoint 4y ago
      ...if the schematics and tapeouts are entirely public. Otherwise you can be assured that there will be backdoors.
      - freemint 4y ago
        You can post hoc modify circuits so they look like doing logic A but they actually do logic B by adding new p or n junctions.
        goodpoint 4y ago
        In theory, yes. In practice it is not realistic to implement a plausible-deniable hardware backdoor targeting all CPUs being manufactured while keeping the schematics and tapeout open. While the same CPUs are even fabbed in different locations around the world. While also going undetected for years and while none of the engineers involved blows the whistle. In short no, you can get away with a targeted attack but nothing so massive.
danielovichdk 4y ago
In a landscape where security and privacy is imminent Pluton will sold as a saviour. And I am pretty sure it's a darn good idea and well thought off and executed. I cannot see why this is a bad idea besides the usual cargo cults claiming corporate distrust. Heck we trusted Intel for decades and no one asked what Apple put in their silicon, because its Apple and Steve was so trustworthy.
- BiteCode_dev 4y ago
  After PRISM and xkeyscore, you don't get to doubt it's going to be abused for the worse. Not anymore.
raymondgh 4y ago
Very impressive analysis and understandable breakdown. And the author is only 20. Or maybe that’s a normal age for this kind of work and I’m just getting old.
__void 4y ago
nowadays 98% of things implying "security" are actually unwanted products, protections for "the other side" or trivial distortions of reality where, conveyed by "security" itself, the user himself becomes the product - no, I don't need protections for the side channel, I never asked for them - no, I don't need a unique identifier, who is the demented person who asked you for it - no, I am not going to glitch the power supply, and even if I did it means I am interested in doing it and wish it worked instead I was prevented from doing it - no, I don't care at all about having a hw store for certificates, which are ephemeral and dropped from above anyway so what am I supposed to trust? - and so on "not secure by design" nowadays comes close to being a coveted feature
- darzu 4y ago
  It’s worth distinguishing between security against software attacks and security against physical “attacks”. I absolutely don’t want my internet connected pet cam to be accessed remotely (outside the set of companies i’ve decided to trust, namely the manufacturer.) Protection against hardware tempering is less good and probably mostly anti-consumer. The most legitimate cases I’ve heard: - Protection from (some) supply chain attacks - Leasing models. Where you acquire the item for less than it’s hardware cost and pay over time. But honestly I’m not convinced of either. Disclosure: I worked on Azure Sphere, the first place Pluton was developed outside Xbox. Edit: I’ve read the whole article now. These scenarios are really bad and really realistic. Pluton is bad.
- bambax 4y ago
  Could not agree more. Security only means control. I don't want security. I don't even want safety. I have never cared about either, and I'm now too old to die young, so I'm not afraid. > "not secure by design" nowadays comes close to being a coveted feature That's a huge market opportunity. I would buy "insecure" products over secure ones every time.
  - bencollier49 4y ago
    Ah, but it won't work on the internet once ISPs are forced to use remote attestation to prove you're using a government approved device.
hgazx 4y ago
Regardless, I think that the pc platform deserves a good anti cheat solution. Separating the groups of those who have a good anti cheat system enabled (such as this) and those who don’t is a good compromise for everybody. I think more reasonable companies such as Valve will go that way.
- shmerl 4y ago
  Good anti-cheat solution is server side AI. Anything client side is malware.
  - hgazx 4y ago
    I know that this is a popular take here, which is why I proposed that there should be a mechanism to opt out. But that would mean that you would have to play against those who opted out as well.
    - tpxl 4y ago
      I would like to have an anti-cheat mechanism (that works), not a god damned security-nightmare rootkit that scans and uploads my private files to god knows where.
  - hammyhavoc 4y ago
    Louder for the Cheeto-dust-covered people in the back.
- Sakos 4y ago
  Anything that prevents me from modding or cheating in my single player games is anathema to me. And companies like Activision, Ubisoft and Rockstar would love a hardware-based system that takes control away from gamers.
  - whywhywhywhy 4y ago
    Who needs to cheat in a Ubisoft game? Just point to the marker, walk, then hit R1 a few times, rinse repeat for 30 hours.
Bolkan 4y ago
What this needs is a (write only) way of physically updating the keys inside pluton. Doing that will practically do a factory reset of the entire device. Then we can have our cake and eat it too.
jeroenhd 4y ago
"Companies will be able to control their network" doesn't sound like a problem to me, more like a solution. "DRM will be unusable outside Windows" is already the case. "Documents can only be opened by authorised users" sounds like a dream come true. "You can't boot Linux by default" is annoying, but hardly a deal breaker. Statistically, almost nobody runs Linux on their devices. Valve could make a change in the Linux landscape if they actually get SteamOS off the ground (third time's the charm, right?) but so far SteamOS 3 is only meant to be used by their own hardware. It's been decades since I last heard about powerful Windows rootkits because you can't just swap out the bootloader anymore. You could try it and risk a non booting victim system, but you're not extracting data or injecting ads into the kernel that way. Malware hasn't gone away (partially because Microsoft doesn't want to break old, signed, vulnerable device drivers that are used to bypass signature requirements and gain kernel access) but it's harder to gain good persistence now. I get it, I want to run Linux on these devices as well. All of this stuff should be easy enough to disable if you're the owner of the device. However, your freedom to use your device however you want doesn't imply that others have to put up with your choices. If I choose to only accept Microsoft Panopticon Validated Devices onto my network, that's my business, no matter how foolish it might be. Distributing my software as a .exe isn't some kind of violation of your constitutional right to run OpenBSD, it's a business choice. Personally, I'd love to see a similar system provide a hardware root of trust for Linux as well. Qubes being able to verify every single step of the boot process and securely loading the system's (several) security keys would be a great security benefit. Hell, I'd even like to see the option to only run signed software on my machine to ensure the executables haven't been tampered with, either signed by the distro maintainers or by myself during the install process, but Linux doesn't have such features or configuration accessible. As long as it's possible to disable this stuff or to configure it for your own, personal key set, I'm all for this stuff. I want the freedom to secure my (Linux or Windows) system in hardware, as long as you have the freedom to turn it all off if you disagree. I don't buy Microsoft hardware specifically because I can't disable or configure that crap, despite their excellent pen support and fancy designs, and I think others should do the same. That's my personal choice, though.
RandomBK 4y ago
Obligatory link to the talk from MS where they covered the origins of Pluton on the Xbox: https://www.youtube.com/watch?v=U7VwtOrwceo https://www.youtube.com/watch?v=U7VwtOrwceo The video does a good job of the original threat model for this technology and how it works on Xbox.
bodge5000 4y ago
Just to be clear, is this a case where you can't dual boot windows and another OS, or you can't boot another OS at all (in either case, the other OS being non Microsoft authorised)? Or something else entirely? Would it be possible to disable this at all, even that means you can't boot Windows?
- zaptheimpaler 4y ago
  You cannot boot the other OS at all if secure boot is enabled and Microsoft drops support for the 3rd party UEFI CA list. The machine will refuse to boot any kernel that has not been signed by the CAs already included in the machine. This is typically only Microsoft and sometimes the OEM like Lenovo or Dell.
  - bodge5000 4y ago
    Could this be disabled by the user? Presumably doing so would mean you cannot boot Windows, but if thats a trade off Microsoft is forcing me to make, I'll accept it. If you can't, it goes without saying that that is unacceptable
    - jhanschoo 4y ago
      Yes, you can disable secure boot.
      - cesarb 4y ago
        > you can disable secure boot. That's not always the case: https://www.softwarefreedom.org/blog/2012/jan/12/microsoft-confirms-UEFI-fears-locks-down-ARM/ https://www.softwarefreedom.org/blog/2012/jan/12/microsoft-c... "Disabling Secure [Boot] MUST NOT be possible on ARM systems."
    - zaptheimpaler 4y ago
      You can disable it for now. But there is no guarantee that you will always be able to. Personally I think its very likely MS will eventually push to strongarm OEMs into locking secure boot to be enabled. All it will take is another round of "security improvements" and the public eats it up. The market would then fragment into laptops that can only run Windows and maybe more expensive laptops that allow you to disable secure boot. If the number of people who actually care enough to vote with spending a few extra hundred $ remains as low as it always has, over a decade it will drive open laptops to become wildly overpriced and eventually cease to exist.
acd 4y ago
I would like a free as in freedom Libre Linux PC with open non bloated boot loader. Open hardware and open specs. What I do not want in my next PC is more DRM and adtech spying on us.
jonathantf2 4y ago
All sounds good for enterprise IT admins - who are the target for these features.
29athrowaway 4y ago
Can you trust your computer? by Richard Stallman https://www.gnu.org/philosophy/can-you-trust.en.html https://www.gnu.org/philosophy/can-you-trust.en.html
zczc 4y ago
Interesting naming. "Microsoft Hell God". Pluto (Greek: Πλούτων Plouton, "giver of wealth", Pluton in French and German) the most common name for the classical ruler of the underworld. Plouton was one of several euphemistic names for Hades, described in the Iliad as the god most hateful to mortals. https://en.wikipedia.org/wiki/Pluto_(mythology) https://en.wikipedia.org/wiki/Pluto_(mythology)
- deleted 4y ago
  [deleted]
- idealmedtech 4y ago
  Pluton is also a geological term, referring to magma domes that have solidified and since eroded to yield granite structures like Half Dome.
- _joel 4y ago
  Hey, did I tell you I use Doric Arch? No MS here!
- mah4k4l 4y ago
  The spouse of Kali Linux? After all they seem to be on the same page politically despite their seeming differences.
- raxxorraxor 4y ago
  Well, they already use Kerberos, his dog.
  - superchroma 4y ago
    But they also have winsock trumpet. They need to pick a lane, I can't deal with the oscillation between goofy and evil.
    - unilynx 4y ago
      Trumpet was an acquisition, so not orginally theirs
29athrowaway 4y ago
This is basically a form of collusion and monopoly between Microsoft and CPU manufacturers. Microsoft has already tried to monopolize the PC consumer market before. And back then the risks were tiny compared to what is at stake now. https://www.justice.gov/atr/us-v-microsoft-courts-findings-fact https://www.justice.gov/atr/us-v-microsoft-courts-findings-f...
_8j50 4y ago
HVCI is truly revolutionary, you can no longer just dump lsass and get credentials if it is enabled among other use cases. But to me, this all looks like MS building a house of cards again. If I am writing a rootkit or other malware why can I not use this to make sure only the compromised devices secure processor can read the contents of memory or does defender get a pass?! A defender/analyst won't also be able to dump ram with volatility or a custom driver to analyze the malware/implant? No microsoft solution would prevent a user from downloading and running an executable entirely so malicious code would run, but can it now hide from security solutions? What part of HVCI am I missing? As far as the rest of it, it will break legitimate use cases for users so I don't expect it to be a default anytime soon. I hate the remote attestation stuff but my hope is it will either fizzle out or regulations will be put in place for enabling user control of the secure computing private key for personally owned devices because code you can't introspect or keys you can't manage should not exist on a device you own (not license).
- Harvesterify 4y ago
  For now (and I haven't seen an annoucement of a coming change about it), only trustlets signed by Microsoft can be executed in the VSM (Virtual Secure Mode), so you won't be able to write a malware or a rootkit that leverages it to hide the execution flow.
  - _8j50 4y ago
    Thanks for clarifying. With drivers they get around that by using vulnerable drivers, but this isn't regular kernel mode code execution, and MS will probably revoke certs for future vulnerable trustlets? (Or not, since that can cause outages). Sounds like a whole new area of research.
lizardactivist 4y ago
The NSA and other three-letter US agencies will be all inside this chip, or have side-channels to the firmware update mechanism, obviously. A secure operating system means nothing if the hardware itself cannot be secured, and the case for a new, trusted, transparent manufacturer of Intel-compatible CPUs and hardware in general grows stronger.
- deleted 4y ago
  [deleted]
- hoffs 4y ago
  Obviously
- Avamander 4y ago
  It's not out of the question. Though I get the feeling we're missing the forest in the trees. Smartphones with proprietary basebands have been here for more than a decade or so. It's not only Intel-compatible we need, it would really take legislation to turn all these things more transparent or controllable.
Beltiras 4y ago
What this article warns as the Apocalypse some suits that make computer use decisions for large organizations will see as features they want implemented.
- dane-pgp 4y ago
  "For all the nations have drunk of the wine of the wrath of her fornication, the kings of the earth have committed fornication with her, and the merchants of the earth have become rich through the abundance of her luxury."
  - Beltiras 4y ago
    It's a very rare Bible quote to get a thumbs up from me. Well done.
xfer 4y ago
This is the problem, when normal people stop buying PCs, only gamers and enterprise customers remain. So they will sell what their customers want.
- toastal 4y ago
  And now the gamers want mostly online competitive games and their makers want the strongest DRM and kernel-level inspection all in the name of anti-cheat. We shouldn't be surprised if online games are one of the first spaces to require Pluton-enabled systems or no boot game.
- keyringlight 4y ago
  I'd say that stage has already come, there's huge amounts of people where their main or only computing device is a phone or tablet. I've dealt with recruitment in a non-technical field and their phone is the online nexus point for them for any emails, documents, or website interactions. Even for gaming I'd argue PC is going into enthusiast territory and the GPU pricing situation hasn't helped that, consoles and phone gaming is strong and streaming has developed a niche.
goodpoint 4y ago
"""Microsoft believes they need to exercise more control over PC Security than previously""" This has little to to with security. It's about having more control over the user.
- rtev 4y ago
  When I clicked the link, I expected to see media security DRM functionality or something along those lines. However, from what I can tell, this is all critical security stuff; the security community has been begging for features like these for ages. Kind of feels like Microsoft can’t win here. Everything is free and unprotected and their OS is a security joke, or they harden and get accused of DRM and monopolizing.
sgammon 4y ago
i think this is simply Microsoft noticing Nike's embrace of Taking a Stance for the Bottom Line. microsoft is smart enough to realize that NSA tinfoil types already do not trust them, and likely will never trust them (which, if you are that worried about security, why are you on windows anyway? NSAKEY?) the predominant share of windows machines are sold to businesses and enterprises who DO want to lock down at a hardware level. it's way too easy to steal a windows machine and wipe it clean. you can't do that with DEP-enrolled macs because of the TPM they already have, which is a strange misalignment when Windows' core market (enterprise) really cares about this kind of security. apple has every reason to care about DRM more than microsoft, but the TPM advent on mac was mostly a welcomed one as I recall. perhaps that is because apple has taken a strong and public stance towards user privacy. but they have to: it is consumers who are buying their devices, and consumers rightly want a device that works for them. microsoft is not in that position, or at least, is not with windows, from an economic standpoint. similarly, they are mostly selling to enterprises and business and governments for this product line, and those customers rightly want a device that is verifiably secure. if you're worried about security for your personal use, buy a mac, because they've made their bottom line and your privacy intertwined. or, buy a linux box and purity check it down to the circuits. you have already decided against convenience in your trade-off equation by your a priori decision to care about this in the first place.
Lapsa 4y ago
and all that crap will get eventually pwned anyways
- no_time 4y ago
  Pluton first debuted in the Xbox One. It's possibly the first home console that went it's entire lifespan without being hacked. That should tell you everything about the threat we are facing.
  - modshatereality 4y ago
    That may be true, though the problem with releasing such a high profile exploit is that it's patched quickly. So IMO anyone with access to hardware / talent required to crack the xbox is probably sitting on that knowledge and extracting as much value as possible from it, instead of taking it public.
oaiey 4y ago
This is exactly what big corporations ask for. In the pharmaceutical industry stakes are very high and directed attacks are common. It is just the next step securing your IT. However, for private users these are dark capabilities.
FutureReminder 4y ago
Reminder from the future: Don't throw away your current hardware when you "upgrade". You, or others, may need it or parts of it in the future.
GekkePrutser 4y ago
This is definitely a big risk to commodity hardware being used for Linux :( Especially when attestation can be used by websites etc. We'll need to have another computer at the side for accessing them.
anotheraccount9 4y ago
Practically speaking, outside Intel and AMD, what CPUs are left to use?
- anticensor 4y ago
  RISC-V.
  - zzo38computer 4y ago
    However, RISC-V is not x86. So, if you want to use the x86 instruction set, then will you need emulation? The modern x86 are too complicated anyways (in many ways; Pluton is just one of them but not only one, also the instructions is too complicated), but I think the old 8088 is reasonably not too complicated.
JustSomeNobody 4y ago
Is this the part where they extinguish Linux (except for where they've embraced it with WSL)?
- RajT88 4y ago
  No. MSFT has bet the business on Cloud and while the virtualization stack they use is Hyper-V, they have a TON of products running Linux under the hood in the cloud. A big chunk (I don't know the real number, but it's closer to 50% than 10%) of customer vm's on Azure are running Linux. All this to say, MSFT is highly invested in the Linux ecosystem. They would be shooting themselves in the foot to try and kill it off at this point.
  - jacooper 4y ago
    I think author meant Linux desktop Andy client facing Linux is, like the SteamOS.
    - RajT88 4y ago
      I don't think Microsoft feels threatened by desktop Linux. If it catches on, it will be because manufacturers start shipping it, not because it's easier to install. Manufacturers sell Linux workstations designed for power users and developers. UEFI/TPM, and now Pluton won't be a stumbling block for that as it hasn't been so far. Dell is the biggest seller of pre-installed Linux desktop machines, and they are all billed as Workstations for power users or developers. Their home machines only have as an option Windows or ChromeOS. (Count that as Linux if you like, but I wouldn't...) Why? Being more price competitive by bundling a free or cheap OS is not worth it in scaling up their support for a new OS. That's your stumbling block to better Linux desktop adoption, in my opinion. Causing issues with remote attestation are probably more a side effect of just not caring about other OS's, rather than some sinister plot to sink Linux on the desktop.
dagaci 4y ago
I remember when Microsoft introduced driver signing, i remember articles in Slashdot and TheRegister going wild about how Microsoft was about block side-loading third party software, and only allow software which they specifically authorized to run on Windows or that they would charge large % fees to allow 3rd party software to be installed. When those these restrictive practices were introduced with iOS and to a much lesser extent various Android distributions (not just phone, but other types of appliances), i was genuinely surprised about how quiet the same type of people are, who I thought protested out of principal. Its the same pattern, like poltics, where people are just basically trying to sell or advocate for you to buy into or sell another product.
- bejelentkezni 4y ago
  Yep. People have been banging the drum on TPMs and similar security chips being the end of personal computing for about 18 years now. Still waiting.
  - worldofmatthew 4y ago
    Atom Bay Trail tablets were often locked to running Windows only.......
  - Schroedingersat 4y ago
    "This water is only 90 degrees, you're fucking crazy, the pot's notgoing to boil."
nojito 4y ago
The larger rationale for this is likely due to them losing very important share to macOS because of things like the secure enclave.
crudbug 4y ago
Is Pluton IP open? All hardware vendors embracing this is not the right path for security / computing. Why can't hardware vendors embrace standards-based open platforms like Global Platform [1]. [Edit] Google is also pushing Android Ready SE Alliance [2]. [1] https://globalplatform.org/ https://globalplatform.org/ [2] https://security.googleblog.com/2021/03/announcing-android-ready-se-alliance.html https://security.googleblog.com/2021/03/announcing-android-r...
icemanx 4y ago
That's it, no more Windows Laptops for me
- l30n4da5 4y ago
  might as well drop apple laptops, as well, since Pluton is pretty much Secure Enclave for PC.
  - l30n4da5 4y ago
    ohwait, that means no more computers at all. well shit, time to switch careers.
PaulHoule 4y ago
We've been hearing this story for a real long time...
RicoElectrico 4y ago
The slowly rising "consolization" of PC, as my friend put it, is unnerving to watch.
choeger 4y ago
I think the fear mongering is spot-on and there's no way back. The only positive way forward would be a non-profit org taking over the role of key manager. No for-profit org and no government should be in the position to control computing. So instead of blocking the technology that inevitably will come (or is already there), let's focus on legislation that prevents corporate entities from controlling computation.
- CoffeeCollector 4y ago
  Privacy and user empowerment stopped around 2007 and most technological advances suit the capital and political classes for their benefit, hegemony and ability to control us. It’s time to stop buying new hardware and to be content using older hardware to halt the erosion of our privacy and maintain what little independence we have.
tlb 4y ago
Authoritarian tech has two problems: the obvious one, and the fact that good hackers don’t want to work on such things, so it’s all built by consultants and stooges and is probably 10x clunkier than the clunkiest Bluetooth - X.25 gateway.
cosmiccatnap 4y ago
It's not open...well...at least not to you. Anyone who calls something secure without publishing the spec is just selling you a bridge.

733 points by gjsman-1000 4y ago

I don't see how this Babel tower of acronyms will not fail in a spectacular fashion, such as producing malware which is run upon receipt, cannot be by any action removed from your PC and installs crypto miner and ransomware on it.

ajuc 4y ago

Hopefully EU bans this.

beprogrammed 4y ago

I'm all for it, just let me delete the Microsoft keys and start the trust chain with my own

aasasd 4y ago

Sounds like the anti-trust case (heh) can be started as soon as the first locked-in computer rolls off the line.

deleted 4y ago

[deleted]

tuetuopay 4y ago

The thing I fear the most with this is "proof that secure boot has never been disabled". This is just a way to brick your device from accessing services. What if you government's tax service requires such proof? Or bank? I cannot count how many machines I booted on Linux to rescue a hard drive, or image it, or wipe it, or just to install linux on them. All those devices, boom, paperweight for regular personal use. I hate it so much that Microsoft is alone in this. It's not because it's M$, it's because they're alone on it.

tadfisher 4y ago
This is already a problem with SafetyNet hardware attestation on Android. Because it's so easy to implement on the app side, everything from banking apps to games is verifying the device is running a blessed system image with a locked bootloader and no root access (read: no access to general-purpose computing). As a developer of a banking app, I do my best to avoid implementing this user-hostile crap, but not all developers are empowered to say "no" to this requirement and not all care. There is zero benefit to the user to block them from using your services, and I would argue the net benefit is negative to the service. Users aren't hacked via privilege escalation exploits, they are hacked by phishing, and they can be phished on a SafetyNet-compliant device just fine.
- toastal 4y ago
  I really appreciate knowing some devs are out there defending us from the banking app madness. I'd encourage you, given your position, to write a blog post about why device ownership is important and your experiences on how others should consider operating.
- tuetuopay 4y ago
  I never knew SafetyNet was a thing, and wow, what a bullcrap thing for the basic consumer. Thank you for being a smart banking app developer. There is so much bullshit in most of those apps that I consider them as "worst apps on my phone", but due to management incompetence rather than developer incompetence.
cryptonector 4y ago
You get two devices.
- tuetuopay 4y ago
  And more e-waste? Thanks but no thanks, I already have enough paperweights.

mjg59 4y ago

This is not a good article. At a technical level it's confused about a whole bunch of things: * SMM has been part of x86 for decades. The Secured Core requirements around SMM actually reduce its power. * The claimed requirement to remove the third party UEFI CA certificate from 2022 Secured Core PCs is entirely unrelated to Pluton (it's required regardless of whether Pluton is enabled or not, and even whether the CPU has Pluton or not) * Most of the description of Pluton is actually a description of a TPM. You don't need DICE for remote attestation. TPMs are already a hardware keystore. * System firmware is already being updated via Windows Update. The discussion about Pluton and Windows Update is around Pluton getting firmware updates that way (the existing story around firmware updates for TPMs is largely not good) * Existing TPM-based remote attestation already includes the secure boot state The short version: everything that the article is worried about being enabled by Pluton is already possible, and has been for years. But there's a meaningful point here. Remote attestation can certainly be used to restrict access to resources in ways that are incompatible with general purpose computing, or which reduce user choice. Remote attestation can also be used to give end users confidence that their machine is in a good state without constraining what they do with it. As a technology, remote attestation can be used in both good and bad ways. We do need to keep track of whether anyone is threatening to use it in bad ways and react appropriately. (But tbh remote attestation as an attack on general purpose computing isn't the really scary thing about widespread remote attestation. Remote attestation ties back to the TPM's endorsement key, an immutable cryptographic key certified by the TPM vendor at manufacturing time. The straightforward implementation of allowing arbitrary remote sites to trigger remote attestation would tie all of these accesses back to a single piece of hardware, and would be a privacy nightmare.)

gjsman-1000 4y ago
You are incorrect yourself in several ways here. > The claimed requirement to remove the third party UEFI CA certificate from 2022 Secured Core PCs is entirely unrelated to Pluton (it's required regardless of whether Pluton is enabled or not, and even whether the CPU has Pluton or not) Pluton is de-facto a Secured Core PC implementation, and Secure Core PCs are also making this change. Thus it effects both Pluton and Secured Core, but the new requirement does not effect non-Pluton and non-Secure-Core systems. Because Secured-Core PCs are currently niche and will no longer exist once Pluton is broadly adopted, Pluton will be the first appearance of this change for the vast majority of users. If I'm selling a 12th Gen Intel system right now, I can keep the 3rd-party UEFI certificate enabled. If I am selling a 12th Gen Secure Core PC, then this year I must disable that certificate, but my non-Secured-Core PCs can again keep it open. When Pluton arrives, that door must be shut. You can verify this with Microsoft's Secured Core PC documentation: https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11 https://docs.microsoft.com/en-us/windows-hardware/design/dev... > Most of the description of Pluton is actually a description of a TPM. You don't need DICE for remote attestation. TPMs are already a hardware keystore. To an extent. The original TPM is very finicky as documented by the comments on this post and elsewhere - even changing a RAM stick could invalidate the TPM's assertion. For this reason, the TPM was very unideal for DRM due to it's all-or-nothing approach, which Microsoft Pluton does not make the mistake of repeating, allowing for much more granular security that makes it much more easily applied. The second reason why Pluton is much more dangerous is that the TPM could be easily virtualized or hacked over the bus rendering DRM use-cases quite broken, whereas Pluton supports neither weakness, making its DRM potential (again) much more potent. Finally, using DICE, unlike a TPM, the Pluton is explicitly designed to give a computer a permanent identity that can never be erased, which (again) TPM does not guarantee. Useful HN comment explaining: https://news.ycombinator.com/item?id=25193346 https://news.ycombinator.com/item?id=25193346 That's actually the big reason why the Remote Assertion is an important point here. The TPM version of it was almost unusable outside of very niche business applications and BitLocker, while with DICE, the Pluton is far more potent. (After all, if TPM worked fine on it's own, why does DICE even exist?) I think the last point to further back this view I will also add is these comments from a Microsoft employee on the subject. https://lobste.rs/s/fdguww/dangers_microsoft_pluton#c_tdlo1r https://lobste.rs/s/fdguww/dangers_microsoft_pluton#c_tdlo1r > System firmware is already being updated via Windows Update. The discussion about Pluton and Windows Update is around Pluton getting firmware updates that way (the existing story around firmware updates for TPMs is largely not good) Microsoft themselves states in Pluton's announcement that Pluton will hardware-integrate with Windows Update for various system firmware, through their "chip-to-cloud" security initiative. To quote them: "One of the other major security problems solved by Pluton is keeping the system firmware up to date across the entire PC ecosystem. Today customers receive updates to their security firmware from a variety of different sources than can be difficult to manage, resulting in widespread patching issues. Pluton provides a flexible, updateable platform for running firmware that implements end-to-end security functionality authored, maintained, and updated by Microsoft. Pluton for Windows computers will be integrated with the Windows Update process in the same way that the Azure Sphere Security Service connects to IoT devices." This is a little frustratingly vague and thus part of the reason why Pluton requires some speculation. Judging by the reference to "different sources that are difficult to manage", it appears you don't update Pluton, Pluton updates you. Pluton has an active role in your system's security, whereas TPM was only passive.

balls187 4y ago

> It may contain inaccuracies or speculation... This means to take anything written in that article with a grain of salt.

stakkur 4y ago

Every story about Microsoft--every time--ends with "...and then Microsoft fucked people over". After decades of watching the shitshow that is Microsoft, and the moral equivocating around defending them, I always return to this.

Ruq 4y ago

Security can be used to create both a safe, and a jail. Remember that. --- I think Microsoft feels threatened at this point about Linux becoming more popular on PCs; what with hardware like the Steam Deck. Can't have Linux dominate the PC platform if you forcefully bind all hardware to the Windows ecosystem. Imagine if back in the day Microsoft used their dominance to block out all competing software on PCs but their own. --- I can see a dystopian future where Government can enforce code/file signing with technologies like this (DRM), so that you can never again have an open computing platform; you could only ever use code or view files approved by the State, and if you try to write code or create content, it won't work period unless it is first approved by the State. (such as with an AI scanning tool to detect and block "wrong-think" or "dangerous functionality" (i.e. dissent or otherwise that threatens the powers that be))

sandworm101 4y ago
Don't worry. Linux will always run on server hardware. We will just learn how to build rack-mounted gaming PCs.
- Ruq 4y ago
  This made me laugh. I also look forward to the potential of open technologies like what RISC-V appears to enable. It's not all bad for sure.

phendrenad2 4y ago

These paranoid delusions never get old. If Microsoft accidentally changes their license agreement to lorem ipsum, bloggers like this will surely be trying to decipher exactly how it steals their freedom. The fatal flaw in these posts is, as it always is, the blind assumption that Microsoft can just do whatever they want, unimpeded. If Microsoft declared, as an april 1st joke, that app PCs henceforth must be painted sky blue, these bloggers would take it seriously. They act as though Microsoft is the high priesthood of computers, and they can declare literally anything with the stroke of a pen. They act like Mac doesn't exist, cheap Linux computers don't exist, RISC-V (which doesn't even run Windows) doesn't exist. Non-Windows-compatible ARM devices don't exist. PC vendors are mindless drones that do whatever Microsoft tells them (even if it means losing billions of dollars to Apple) and they certainly aren't selling (Dell: https://news.ycombinator.com/item?id=4847720 https://news.ycombinator.com/item?id=4847720) linux (HP: https://news.ycombinator.com/item?id=31617198 https://news.ycombinator.com/item?id=31617198) laptops (Lenovo: https://news.ycombinator.com/item?id=28186204 https://news.ycombinator.com/item?id=28186204) right now (and don't even think about installing Linux on your Google Chromebook, it won't work! https://support.google.com/pixelbook/answer/9031351?hl=en https://support.google.com/pixelbook/answer/9031351?hl=en ). The usual rebuttal is "Well, yeah, things are fine NOW, but they're moving the chess pieces into place to do these things LATER". Yawn. I have heard this for 20+ years. See you in another 20...

fleventynine 4y ago

Hardware-based attestation of the running software is an important security feature, especially in a world where data leaks and identity theft are rampant. Let's say I'm a healthcare provider, and I'm about to send your medical data to a third party vendor. Wouldn't you prefer that your data only be able to be decrypted by a computer can prove to the world it booted a clean OS image with all the latest security patches installed? If the vendor wants to install some self-built OS that they trust on their computer and not update it for 5 years, that's their business, but I may not want to trust their computer to have access to my data. Remote attestation gives more control to the owners of data to dictate how that data is processed on third-party machines (or even their own machines that may have been compromised). This is useful for more than just DRM.

Charlie11 4y ago

[dead]

metadat 4y ago

Ew. Why are all the chip manufacturers going along with this stupid plan? I want to buy a processor and then own it and have it work in my best interests, not consume electricity and generatie heat enforcing draconian 3rd party DRM policies.

paxys 4y ago
Because Apple
gjsman-1000 4y ago
It's tragic (especially if you care about general-purpose computing and the future of open platforms), and a sign that Microsoft's Palladium project was never really canceled. Boil the frog... Of course, Microsoft would say it's not about DRM (at least right now), it's for "security." Which... its secure as Microsoft's servers are, to be sure.
- intelVISA 4y ago
  Next-Generation Secure Computing my ass.
kimmeld 4y ago
The market (software/system builders) say that locked down platforms like the iPhone are fabulously profitable. Sorry.
- metadat 4y ago
  Lol, cargo-cult chip fabbing. What's next? I can't even fathom.. maybe this inability on my part is a blessing in disguise.
- arlcode 4y ago
  And that's why the road to a better software ecosystem is not some hackers smart trick to defeat the system for the moment but very clear rules of what is allowed to be done in the name of security and what isn't A legislative piece of paper (or many pieces of paper) have the power to reign in corporations far far beyond any technical solution or workaround. And yes, that requires limiting (intellectual) property rights and regulating what certain contracts can enforce. Sometimes it's needed if you ask me In my experience this sentiment is rejected primarily by many technical people because it feels like adding the human factor to a pristine world of logic. In reality it's humans all the way down and there is no reason to believe that Microsoft/Apple is a better steward than an elected body of representatives acting according to the rule of law

rtpg 4y ago

I'm not hyped about most of the DRM stuff (and yeah, frog boiling is definitely a worry, though I don't know how we could ever end up with devices that can't boot alternative OSes just cuz of how servers are set up). But I am personally glad to see hardware-level key stores show up on all CPUs. Maybe this is already a thing and I'm being duped by Apple for thinking it's good, but it feels good to me.

gjsman-1000 4y ago
I'm not really worried myself that alternative Operating Systems will be locked out. However, I am concerned that the functionality of alternative Operating Systems will be locked out. If you see the (speculative but grounded) area near the end of the article - imagine if assertion becomes popular for things such as games or digital movies or the school WiFi. Your Linux PC will never be able to do that, and WINE (probably) won't be able to help. Won't stop you from hosting a server, but it will make it much harder to enjoy a Linux desktop. That's an issue.
- vladvasiliu 4y ago
  > imagine if assertion becomes popular for things such as [...] digital movies You don't need that. Streaming is already crippled on Linux. Hell, Netflix won't even stream full quality on Chrome! > https://help.netflix.com/en/node/13444 https://help.netflix.com/en/node/13444 4K Ultra HD on a computer Netflix is available in Ultra HD on Windows and Mac computers with: Microsoft Edge for Windows Windows app for Windows 10 and Windows 11 Safari for MacOS 11.0 or later
  - arpa 4y ago
    ... and this is why piracy will always continue to be a viable alternative.
    - hammyhavoc 4y ago
      Until access to the internet or methods of circumventing DRM are crippled without submitting to these technologies. That's the road we're heading down. Can't hack the current-gen Xbox, apparently. I'm wondering if someone will take that as a "challenge accepted".

userbinator 4y ago

What is to prevent school WiFi from one day requiring a Pluton assertion that your Windows PC hasn’t been tampered with before you can join the network? Remote attestation is the true enemy of your freedom. The power of the authoritarian corporatocracy to force you to use only the (entire) systems they control. It's worth reading https://www.gnu.org/philosophy/right-to-read.en.html https://www.gnu.org/philosophy/right-to-read.en.html again just to see how prescient Stallman was.

turns0ut 4y ago
Engineers could leverage their economic might via collective action; don’t open your wfh laptop today. Updating the Upton Sinclair quote without the gender bias; it’s difficult getting a person to understand something when their investment portfolio valuation depends on them not understanding it. Who are they if they’re not what they are now? When you all stop posting on corporate forums and working their jobs, shopping their stores, I’ll take you all sincerely and seriously.
r3trohack3r 4y ago
This was the case at my university. In order to use the dorm network, you had to download a software package that validated your setup. It would then add your computer (I assume MAC) to an allow-list. In order to deal with it, I had to create a subnet with a router, use an old laptop to do the verification, and then the whole subnet was added to the allow-list.
gfo 4y ago
This is almost the entire thesis of Zero Trust Networking principles. Somehow, the user AND the device need to attest to validity during the authorization process. "Validity" for a device can mean many things (latest patches, is running anti-virus software, among other things). A general user probably doesn't need to attest to these things. I would argue that anyone trying to access a corporate or some other organization's network SHOULD be required to attest to these things given the cyber threat landscape. The caveat: those same entities should provide or heavily subsidize the platforms they require (work computers). It's their IP at risk. I'm not so naive to think they would actually do this with BYOD initiatives, unfortunately. For personal users on personal devices, I agree this might go too far (but some principles like MFA are best practices).

jhanschoo 4y ago

While I disagree with the author's opinion, it was very informative for me.

gjsman-1000 4y ago
Not mentioned in the article - but it begs the question, could this have something to do with Microsoft's insistence that everyone, even Pro users in the next update, use a Microsoft Account with Windows 11? If Pluton (or Pluton 2, someday) could be tied to a Microsoft Account, wouldn't that be something.
- superchroma 4y ago
  It's I think a general desire for end to end traceability and therefore accountability, which both managers and developers tend to like, albeit for different reasons.
- sillysaurusx 4y ago
  Is it okay to talk about language as a meta-topic? I try not to stray too far into that, since it’s usually boring for readers. But one thing I was surprised to learn is that “begs the question” is only correct when you’re describing a chain of circular logic. “Raises the question” is apparently the right term for the general case. I felt a little duped, since I’d been using “begs the question” for years without looking into its origins. But of course, that begs the question of whether language is defined by how people use it. :)
  - selfhoster11 4y ago
    I purposefully "misuse" the phrase "begging the question" to mean the same thing as the grandparent, because I want to do my part to change what this phrase means. Using "begging the question" to mean something as obscure and unintuitive (as in, it's basically an idiom that must be explained first) as "your question originates from circular logic" is a waste of prime dictionary space. This term should mean "there is a question that is so blindingly obvious regarding the situation at hand, that it simply begs to be asked" - so, more or less what everyone who didn't have the term explained to them, thinks it's supposed to mean.

Lucasoato 4y ago

> The road to hell is paved with good intentions. If there were only dystopic uses of this technology, its development wouldn't be able to go on internally. They are specifically taking this path so they always have plenty of good reasons to pursue their agenda.

pjmlp 4y ago

Regardless of all the FUD against Pluton, it has a great feature, it is yet another CPU with hardware memory tagging, as the last resort against C flaws and derived languages.

selfhoster11 4y ago
FUD is no longer FUD when it becomes a realistic danger. Given that remote attestation already had deleterious effects for user freedoms on smartphones and tablets (meaning, choose between banking apps and any deviation from the factory ROM), Pluton should be seen as a danger.
- pjmlp 4y ago
  Smartphones and tablets are electronic gadgets. If you want a general purpose computer get a laptop. Most likely one sold by Linux OEMs, like Tuxedo and System76.
  - selfhoster11 4y ago
    That's an invalid argument for multiple reasons, not the least of which is that some people can afford just one device. That device is likely to be a smartphone because everything is slowly moving in the direction of requiring one. If I need to spend extra money to get an additional "freedom device" and can't afford it, I just won't have one and will miss out on the good stuff.
    - pjmlp 4y ago
      Welcome to the 8 and 16 bit home computer days when OSes were written in ROMs.
      - selfhoster11 4y ago
        Those OSes were distributed on ROM by necessity, because that was the most cost effective option available. Any modern limitations that prevent running your own software are not just artificial, but actually require additional effort to implement bootloader locking/integrity checks.

peter_retief 4y ago

Microsoft are trying to enforce a monopoly on hardware, where is the https://www.sec.gov/ https://www.sec.gov/ on this?

mordae 4y ago
This. M$ is literally trying to wall off the PC.
- peter_retief 4y ago
  That is "exactly" what they are trying to do, I find it sad that people are prepared to accept this as business as usual, considering the efforts made to make Linux available to everyone.
- pjmlp 4y ago
  Just catching up where IBM failed.

UberFly 4y ago

I've always thought that at some point the only "stomachable" version of windows is going to be some hacked offering, by god-knows-who or from where, but it'll still end up being preferable to what MS is requiring.

hammyhavoc 4y ago
Isn't that the way it's been for several versions now with scripts to disable all the telemetry and shovelware?
- autoexec 4y ago
  As far as I know there are no scripts that are capable of disabling all of the telemetry and nothing that can't be undone the instant the computer has an internet connection and connects to windows update.
  - RajT88 4y ago
    Yes, you'll likely have to keep re-doing it. As far as scripts for it, this thread has some sage advice: https://www.reddit.com/r/privacy/comments/n3v0s5/disable_windows_10_telemetry_2021/ https://www.reddit.com/r/privacy/comments/n3v0s5/disable_win... The tools to disable telemetry and bloat: https://github.com/irmatade/sharpapp https://github.com/irmatade/sharpapp https://www.oo-software.com/fr/shutup10 https://www.oo-software.com/fr/shutup10 https://github.com/Sycnex/Windows10Debloater https://github.com/Sycnex/Windows10Debloater MSFT doc on what all telemetry is gathered, and what is considered "required" telemetry (although they give you enough info to block it at the router): https://docs.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization https://docs.microsoft.com/en-us/windows/privacy/configure-w... I do like Win10 as an OS. On the whole I'd say the Satya era of MSFT is a mixed bag, but better on the whole than it was before.

paulcarroty 4y ago

I will definitely not buy CPU with built-in MS core. If Intel will add it too, guess it's time to get 12700 and use it for looong time.

raxxorraxor 4y ago
Problem is that the consoles market is very lucrative for CPU vendors because it is a guaranteed turnover of specific models. Intel, AMD and Qualcomm will implement them. You can disable it though. It would suck if it were enable by default, at least lenovo said they will disable it at first.

Gh0stRAT 4y ago

I'm completely missing how his example of a Word document that can only be opened by approved users on approved hardware within the corporation is supposed to be a bad thing. Honestly, that sounds pretty fantastic. I've been using 3rd party tools/extensions to do this sort of thing in corporate and government environments for years, but having the attestation go all the way down to the hardware level is a big value-add, especially with so much ransomware/spyware/extortion/espionage going on these days. Can someone please explain to me how the author might see this level of security as a bad thing?

ctoth 4y ago
So if I'm understanding this correctly, you'd prefer to live in the world where the Collateral Murder Wikileaks video of journalists being murdered in cold blood was never released because it was hardware locked to the original military system it was found on? Or maybe some large viral video which triggers a social uprising simply won't play. You are seriously so focused on pointless corporate secrets that you would actually consider giving the people in charge of the control over your information stream the ability to decide that something just shouldn't be shown? Because what? It might make discovery for a lawsuit more difficult? It'll make it easier to hide malfeasance? This seems particularly useful if you are trying to pretend that May 35th never happened, for instance. Terrifying, and rather icky.
ftyhbhyjnjk 4y ago
What you can install on YOUR pc will be at the sole mercy of microsoft/or maybe someone else.... That's the cusp of it. Not that it can be used for good, but that it sets the way for heavy misuse by large corporations. Wait a few years. Smaller companies won't even be allowed to order high end cpu's. You'll be at 100% mercy of these corporations. If after 2 years they decide to brick your pc, they'll just do it. You think government will help you out here? Lol...
- eertvertvbw 4y ago
  still waiting on the secure boot lockdown everyone has insisted is coming for the better part of two decades...

TeeMassive 4y ago

Reminds of of Palladium: https://www.zdnet.com/article/microsofts-palladium-what-the-heck-is-it/ https://www.zdnet.com/article/microsofts-palladium-what-the-... https://en.wikipedia.org/wiki/Next-Generation_Secure_Computing_Base https://en.wikipedia.org/wiki/Next-Generation_Secure_Computi...

trh0awayman 4y ago

Can RISC-V save us here? Or is it time to start hoarding CPUs?

ftyhbhyjnjk 4y ago
It's time to start rejecting such corporations. Nothing else would work.
zogomoox 4y ago
I would assume chinese made RISC-V have their own special sauce.
- hammyhavoc 4y ago
  That's a big assumption.
  - goodpoint 4y ago
    ...if the schematics and tapeouts are entirely public. Otherwise you can be assured that there will be backdoors.
    - freemint 4y ago
      You can post hoc modify circuits so they look like doing logic A but they actually do logic B by adding new p or n junctions.
      - goodpoint 4y ago
        In theory, yes. In practice it is not realistic to implement a plausible-deniable hardware backdoor targeting all CPUs being manufactured while keeping the schematics and tapeout open. While the same CPUs are even fabbed in different locations around the world. While also going undetected for years and while none of the engineers involved blows the whistle. In short no, you can get away with a targeted attack but nothing so massive.

danielovichdk 4y ago

In a landscape where security and privacy is imminent Pluton will sold as a saviour. And I am pretty sure it's a darn good idea and well thought off and executed. I cannot see why this is a bad idea besides the usual cargo cults claiming corporate distrust. Heck we trusted Intel for decades and no one asked what Apple put in their silicon, because its Apple and Steve was so trustworthy.

BiteCode_dev 4y ago
After PRISM and xkeyscore, you don't get to doubt it's going to be abused for the worse. Not anymore.

raymondgh 4y ago

Very impressive analysis and understandable breakdown. And the author is only 20. Or maybe that’s a normal age for this kind of work and I’m just getting old.

__void 4y ago

nowadays 98% of things implying "security" are actually unwanted products, protections for "the other side" or trivial distortions of reality where, conveyed by "security" itself, the user himself becomes the product - no, I don't need protections for the side channel, I never asked for them - no, I don't need a unique identifier, who is the demented person who asked you for it - no, I am not going to glitch the power supply, and even if I did it means I am interested in doing it and wish it worked instead I was prevented from doing it - no, I don't care at all about having a hw store for certificates, which are ephemeral and dropped from above anyway so what am I supposed to trust? - and so on "not secure by design" nowadays comes close to being a coveted feature

darzu 4y ago
It’s worth distinguishing between security against software attacks and security against physical “attacks”. I absolutely don’t want my internet connected pet cam to be accessed remotely (outside the set of companies i’ve decided to trust, namely the manufacturer.) Protection against hardware tempering is less good and probably mostly anti-consumer. The most legitimate cases I’ve heard: - Protection from (some) supply chain attacks - Leasing models. Where you acquire the item for less than it’s hardware cost and pay over time. But honestly I’m not convinced of either. Disclosure: I worked on Azure Sphere, the first place Pluton was developed outside Xbox. Edit: I’ve read the whole article now. These scenarios are really bad and really realistic. Pluton is bad.
bambax 4y ago
Could not agree more. Security only means control. I don't want security. I don't even want safety. I have never cared about either, and I'm now too old to die young, so I'm not afraid. > "not secure by design" nowadays comes close to being a coveted feature That's a huge market opportunity. I would buy "insecure" products over secure ones every time.
- bencollier49 4y ago
  Ah, but it won't work on the internet once ISPs are forced to use remote attestation to prove you're using a government approved device.

hgazx 4y ago

Regardless, I think that the pc platform deserves a good anti cheat solution. Separating the groups of those who have a good anti cheat system enabled (such as this) and those who don’t is a good compromise for everybody. I think more reasonable companies such as Valve will go that way.

shmerl 4y ago
Good anti-cheat solution is server side AI. Anything client side is malware.
- hgazx 4y ago
  I know that this is a popular take here, which is why I proposed that there should be a mechanism to opt out. But that would mean that you would have to play against those who opted out as well.
  - tpxl 4y ago
    I would like to have an anti-cheat mechanism (that works), not a god damned security-nightmare rootkit that scans and uploads my private files to god knows where.
- hammyhavoc 4y ago
  Louder for the Cheeto-dust-covered people in the back.
Sakos 4y ago
Anything that prevents me from modding or cheating in my single player games is anathema to me. And companies like Activision, Ubisoft and Rockstar would love a hardware-based system that takes control away from gamers.
- whywhywhywhy 4y ago
  Who needs to cheat in a Ubisoft game? Just point to the marker, walk, then hit R1 a few times, rinse repeat for 30 hours.

Bolkan 4y ago

What this needs is a (write only) way of physically updating the keys inside pluton. Doing that will practically do a factory reset of the entire device. Then we can have our cake and eat it too.

jeroenhd 4y ago

"Companies will be able to control their network" doesn't sound like a problem to me, more like a solution. "DRM will be unusable outside Windows" is already the case. "Documents can only be opened by authorised users" sounds like a dream come true. "You can't boot Linux by default" is annoying, but hardly a deal breaker. Statistically, almost nobody runs Linux on their devices. Valve could make a change in the Linux landscape if they actually get SteamOS off the ground (third time's the charm, right?) but so far SteamOS 3 is only meant to be used by their own hardware. It's been decades since I last heard about powerful Windows rootkits because you can't just swap out the bootloader anymore. You could try it and risk a non booting victim system, but you're not extracting data or injecting ads into the kernel that way. Malware hasn't gone away (partially because Microsoft doesn't want to break old, signed, vulnerable device drivers that are used to bypass signature requirements and gain kernel access) but it's harder to gain good persistence now. I get it, I want to run Linux on these devices as well. All of this stuff should be easy enough to disable if you're the owner of the device. However, your freedom to use your device however you want doesn't imply that others have to put up with your choices. If I choose to only accept Microsoft Panopticon Validated Devices onto my network, that's my business, no matter how foolish it might be. Distributing my software as a .exe isn't some kind of violation of your constitutional right to run OpenBSD, it's a business choice. Personally, I'd love to see a similar system provide a hardware root of trust for Linux as well. Qubes being able to verify every single step of the boot process and securely loading the system's (several) security keys would be a great security benefit. Hell, I'd even like to see the option to only run signed software on my machine to ensure the executables haven't been tampered with, either signed by the distro maintainers or by myself during the install process, but Linux doesn't have such features or configuration accessible. As long as it's possible to disable this stuff or to configure it for your own, personal key set, I'm all for this stuff. I want the freedom to secure my (Linux or Windows) system in hardware, as long as you have the freedom to turn it all off if you disagree. I don't buy Microsoft hardware specifically because I can't disable or configure that crap, despite their excellent pen support and fancy designs, and I think others should do the same. That's my personal choice, though.

RandomBK 4y ago

Obligatory link to the talk from MS where they covered the origins of Pluton on the Xbox: https://www.youtube.com/watch?v=U7VwtOrwceo https://www.youtube.com/watch?v=U7VwtOrwceo The video does a good job of the original threat model for this technology and how it works on Xbox.

bodge5000 4y ago

Just to be clear, is this a case where you can't dual boot windows and another OS, or you can't boot another OS at all (in either case, the other OS being non Microsoft authorised)? Or something else entirely? Would it be possible to disable this at all, even that means you can't boot Windows?

zaptheimpaler 4y ago
You cannot boot the other OS at all if secure boot is enabled and Microsoft drops support for the 3rd party UEFI CA list. The machine will refuse to boot any kernel that has not been signed by the CAs already included in the machine. This is typically only Microsoft and sometimes the OEM like Lenovo or Dell.
- bodge5000 4y ago
  Could this be disabled by the user? Presumably doing so would mean you cannot boot Windows, but if thats a trade off Microsoft is forcing me to make, I'll accept it. If you can't, it goes without saying that that is unacceptable
  - jhanschoo 4y ago
    Yes, you can disable secure boot.
    - cesarb 4y ago
      > you can disable secure boot. That's not always the case: https://www.softwarefreedom.org/blog/2012/jan/12/microsoft-confirms-UEFI-fears-locks-down-ARM/ https://www.softwarefreedom.org/blog/2012/jan/12/microsoft-c... "Disabling Secure [Boot] MUST NOT be possible on ARM systems."
  - zaptheimpaler 4y ago
    You can disable it for now. But there is no guarantee that you will always be able to. Personally I think its very likely MS will eventually push to strongarm OEMs into locking secure boot to be enabled. All it will take is another round of "security improvements" and the public eats it up. The market would then fragment into laptops that can only run Windows and maybe more expensive laptops that allow you to disable secure boot. If the number of people who actually care enough to vote with spending a few extra hundred $ remains as low as it always has, over a decade it will drive open laptops to become wildly overpriced and eventually cease to exist.

acd 4y ago

I would like a free as in freedom Libre Linux PC with open non bloated boot loader. Open hardware and open specs. What I do not want in my next PC is more DRM and adtech spying on us.

jonathantf2 4y ago

All sounds good for enterprise IT admins - who are the target for these features.

29athrowaway 4y ago

Can you trust your computer? by Richard Stallman https://www.gnu.org/philosophy/can-you-trust.en.html https://www.gnu.org/philosophy/can-you-trust.en.html

zczc 4y ago

Interesting naming. "Microsoft Hell God". Pluto (Greek: Πλούτων Plouton, "giver of wealth", Pluton in French and German) the most common name for the classical ruler of the underworld. Plouton was one of several euphemistic names for Hades, described in the Iliad as the god most hateful to mortals. https://en.wikipedia.org/wiki/Pluto_(mythology) https://en.wikipedia.org/wiki/Pluto_(mythology)

deleted 4y ago
[deleted]
idealmedtech 4y ago
Pluton is also a geological term, referring to magma domes that have solidified and since eroded to yield granite structures like Half Dome.
_joel 4y ago
Hey, did I tell you I use Doric Arch? No MS here!
mah4k4l 4y ago
The spouse of Kali Linux? After all they seem to be on the same page politically despite their seeming differences.
raxxorraxor 4y ago
Well, they already use Kerberos, his dog.
- superchroma 4y ago
  But they also have winsock trumpet. They need to pick a lane, I can't deal with the oscillation between goofy and evil.
  - unilynx 4y ago
    Trumpet was an acquisition, so not orginally theirs

29athrowaway 4y ago

This is basically a form of collusion and monopoly between Microsoft and CPU manufacturers. Microsoft has already tried to monopolize the PC consumer market before. And back then the risks were tiny compared to what is at stake now. https://www.justice.gov/atr/us-v-microsoft-courts-findings-fact https://www.justice.gov/atr/us-v-microsoft-courts-findings-f...

_8j50 4y ago

HVCI is truly revolutionary, you can no longer just dump lsass and get credentials if it is enabled among other use cases. But to me, this all looks like MS building a house of cards again. If I am writing a rootkit or other malware why can I not use this to make sure only the compromised devices secure processor can read the contents of memory or does defender get a pass?! A defender/analyst won't also be able to dump ram with volatility or a custom driver to analyze the malware/implant? No microsoft solution would prevent a user from downloading and running an executable entirely so malicious code would run, but can it now hide from security solutions? What part of HVCI am I missing? As far as the rest of it, it will break legitimate use cases for users so I don't expect it to be a default anytime soon. I hate the remote attestation stuff but my hope is it will either fizzle out or regulations will be put in place for enabling user control of the secure computing private key for personally owned devices because code you can't introspect or keys you can't manage should not exist on a device you own (not license).

Harvesterify 4y ago
For now (and I haven't seen an annoucement of a coming change about it), only trustlets signed by Microsoft can be executed in the VSM (Virtual Secure Mode), so you won't be able to write a malware or a rootkit that leverages it to hide the execution flow.
- _8j50 4y ago
  Thanks for clarifying. With drivers they get around that by using vulnerable drivers, but this isn't regular kernel mode code execution, and MS will probably revoke certs for future vulnerable trustlets? (Or not, since that can cause outages). Sounds like a whole new area of research.

lizardactivist 4y ago

The NSA and other three-letter US agencies will be all inside this chip, or have side-channels to the firmware update mechanism, obviously. A secure operating system means nothing if the hardware itself cannot be secured, and the case for a new, trusted, transparent manufacturer of Intel-compatible CPUs and hardware in general grows stronger.

deleted 4y ago
[deleted]
hoffs 4y ago
Obviously
Avamander 4y ago
It's not out of the question. Though I get the feeling we're missing the forest in the trees. Smartphones with proprietary basebands have been here for more than a decade or so. It's not only Intel-compatible we need, it would really take legislation to turn all these things more transparent or controllable.

Beltiras 4y ago

What this article warns as the Apocalypse some suits that make computer use decisions for large organizations will see as features they want implemented.

dane-pgp 4y ago
"For all the nations have drunk of the wine of the wrath of her fornication, the kings of the earth have committed fornication with her, and the merchants of the earth have become rich through the abundance of her luxury."
- Beltiras 4y ago
  It's a very rare Bible quote to get a thumbs up from me. Well done.

xfer 4y ago

This is the problem, when normal people stop buying PCs, only gamers and enterprise customers remain. So they will sell what their customers want.

toastal 4y ago
And now the gamers want mostly online competitive games and their makers want the strongest DRM and kernel-level inspection all in the name of anti-cheat. We shouldn't be surprised if online games are one of the first spaces to require Pluton-enabled systems or no boot game.
keyringlight 4y ago
I'd say that stage has already come, there's huge amounts of people where their main or only computing device is a phone or tablet. I've dealt with recruitment in a non-technical field and their phone is the online nexus point for them for any emails, documents, or website interactions. Even for gaming I'd argue PC is going into enthusiast territory and the GPU pricing situation hasn't helped that, consoles and phone gaming is strong and streaming has developed a niche.

goodpoint 4y ago

"""Microsoft believes they need to exercise more control over PC Security than previously""" This has little to to with security. It's about having more control over the user.

rtev 4y ago
When I clicked the link, I expected to see media security DRM functionality or something along those lines. However, from what I can tell, this is all critical security stuff; the security community has been begging for features like these for ages. Kind of feels like Microsoft can’t win here. Everything is free and unprotected and their OS is a security joke, or they harden and get accused of DRM and monopolizing.

sgammon 4y ago

i think this is simply Microsoft noticing Nike's embrace of Taking a Stance for the Bottom Line. microsoft is smart enough to realize that NSA tinfoil types already do not trust them, and likely will never trust them (which, if you are that worried about security, why are you on windows anyway? NSAKEY?) the predominant share of windows machines are sold to businesses and enterprises who DO want to lock down at a hardware level. it's way too easy to steal a windows machine and wipe it clean. you can't do that with DEP-enrolled macs because of the TPM they already have, which is a strange misalignment when Windows' core market (enterprise) really cares about this kind of security. apple has every reason to care about DRM more than microsoft, but the TPM advent on mac was mostly a welcomed one as I recall. perhaps that is because apple has taken a strong and public stance towards user privacy. but they have to: it is consumers who are buying their devices, and consumers rightly want a device that works for them. microsoft is not in that position, or at least, is not with windows, from an economic standpoint. similarly, they are mostly selling to enterprises and business and governments for this product line, and those customers rightly want a device that is verifiably secure. if you're worried about security for your personal use, buy a mac, because they've made their bottom line and your privacy intertwined. or, buy a linux box and purity check it down to the circuits. you have already decided against convenience in your trade-off equation by your a priori decision to care about this in the first place.

Lapsa 4y ago

and all that crap will get eventually pwned anyways

no_time 4y ago
Pluton first debuted in the Xbox One. It's possibly the first home console that went it's entire lifespan without being hacked. That should tell you everything about the threat we are facing.
- modshatereality 4y ago
  That may be true, though the problem with releasing such a high profile exploit is that it's patched quickly. So IMO anyone with access to hardware / talent required to crack the xbox is probably sitting on that knowledge and extracting as much value as possible from it, instead of taking it public.

oaiey 4y ago

This is exactly what big corporations ask for. In the pharmaceutical industry stakes are very high and directed attacks are common. It is just the next step securing your IT. However, for private users these are dark capabilities.

FutureReminder 4y ago

Reminder from the future: Don't throw away your current hardware when you "upgrade". You, or others, may need it or parts of it in the future.

GekkePrutser 4y ago

This is definitely a big risk to commodity hardware being used for Linux :( Especially when attestation can be used by websites etc. We'll need to have another computer at the side for accessing them.

anotheraccount9 4y ago

Practically speaking, outside Intel and AMD, what CPUs are left to use?

anticensor 4y ago
RISC-V.
- zzo38computer 4y ago
  However, RISC-V is not x86. So, if you want to use the x86 instruction set, then will you need emulation? The modern x86 are too complicated anyways (in many ways; Pluton is just one of them but not only one, also the instructions is too complicated), but I think the old 8088 is reasonably not too complicated.

JustSomeNobody 4y ago

Is this the part where they extinguish Linux (except for where they've embraced it with WSL)?

RajT88 4y ago
No. MSFT has bet the business on Cloud and while the virtualization stack they use is Hyper-V, they have a TON of products running Linux under the hood in the cloud. A big chunk (I don't know the real number, but it's closer to 50% than 10%) of customer vm's on Azure are running Linux. All this to say, MSFT is highly invested in the Linux ecosystem. They would be shooting themselves in the foot to try and kill it off at this point.
- jacooper 4y ago
  I think author meant Linux desktop Andy client facing Linux is, like the SteamOS.
  - RajT88 4y ago
    I don't think Microsoft feels threatened by desktop Linux. If it catches on, it will be because manufacturers start shipping it, not because it's easier to install. Manufacturers sell Linux workstations designed for power users and developers. UEFI/TPM, and now Pluton won't be a stumbling block for that as it hasn't been so far. Dell is the biggest seller of pre-installed Linux desktop machines, and they are all billed as Workstations for power users or developers. Their home machines only have as an option Windows or ChromeOS. (Count that as Linux if you like, but I wouldn't...) Why? Being more price competitive by bundling a free or cheap OS is not worth it in scaling up their support for a new OS. That's your stumbling block to better Linux desktop adoption, in my opinion. Causing issues with remote attestation are probably more a side effect of just not caring about other OS's, rather than some sinister plot to sink Linux on the desktop.

dagaci 4y ago

I remember when Microsoft introduced driver signing, i remember articles in Slashdot and TheRegister going wild about how Microsoft was about block side-loading third party software, and only allow software which they specifically authorized to run on Windows or that they would charge large % fees to allow 3rd party software to be installed. When those these restrictive practices were introduced with iOS and to a much lesser extent various Android distributions (not just phone, but other types of appliances), i was genuinely surprised about how quiet the same type of people are, who I thought protested out of principal. Its the same pattern, like poltics, where people are just basically trying to sell or advocate for you to buy into or sell another product.

bejelentkezni 4y ago
Yep. People have been banging the drum on TPMs and similar security chips being the end of personal computing for about 18 years now. Still waiting.
- worldofmatthew 4y ago
  Atom Bay Trail tablets were often locked to running Windows only.......
- Schroedingersat 4y ago
  "This water is only 90 degrees, you're fucking crazy, the pot's notgoing to boil."

nojito 4y ago

The larger rationale for this is likely due to them losing very important share to macOS because of things like the secure enclave.

crudbug 4y ago

Is Pluton IP open? All hardware vendors embracing this is not the right path for security / computing. Why can't hardware vendors embrace standards-based open platforms like Global Platform [1]. [Edit] Google is also pushing Android Ready SE Alliance [2]. [1] https://globalplatform.org/ https://globalplatform.org/ [2] https://security.googleblog.com/2021/03/announcing-android-ready-se-alliance.html https://security.googleblog.com/2021/03/announcing-android-r...

icemanx 4y ago

That's it, no more Windows Laptops for me

l30n4da5 4y ago
might as well drop apple laptops, as well, since Pluton is pretty much Secure Enclave for PC.
- l30n4da5 4y ago
  ohwait, that means no more computers at all. well shit, time to switch careers.

PaulHoule 4y ago

We've been hearing this story for a real long time...

RicoElectrico 4y ago

The slowly rising "consolization" of PC, as my friend put it, is unnerving to watch.

choeger 4y ago

I think the fear mongering is spot-on and there's no way back. The only positive way forward would be a non-profit org taking over the role of key manager. No for-profit org and no government should be in the position to control computing. So instead of blocking the technology that inevitably will come (or is already there), let's focus on legislation that prevents corporate entities from controlling computation.

CoffeeCollector 4y ago
Privacy and user empowerment stopped around 2007 and most technological advances suit the capital and political classes for their benefit, hegemony and ability to control us. It’s time to stop buying new hardware and to be content using older hardware to halt the erosion of our privacy and maintain what little independence we have.

tlb 4y ago

Authoritarian tech has two problems: the obvious one, and the fact that good hackers don’t want to work on such things, so it’s all built by consultants and stooges and is probably 10x clunkier than the clunkiest Bluetooth - X.25 gateway.

cosmiccatnap 4y ago

It's not open...well...at least not to you. Anyone who calls something secure without publishing the spec is just selling you a bridge.