4 ms·

>This isn't about your own private machine. This is about corporation-owned machines in an enterprise network and as we see with nearly biweekly news articles a

>This isn't about your own private machine. This is about corporation-owned machines in an enterprise network and as we see with nearly biweekly news articles about large-scale ransomware attacks, private data leaks and compromised employee machines, I would argue that the currently employed solutions clearly don't work. The fundamental issue is that you can't have one without the other, and that's bothering me. It's not like only corporate grade laptops come with TPMs now (like they did in the past). Safetynet on my phone is the same thing and it's very much "about my own private machine". Seeing the reactions and the lack thereof about these developments makes me think this will end terribly.

pilif 4y ago
> you can't have one without the other, AFAIK, secure boot can be disabled, both in the BIOS and in the Kernel. In some machines that's not be the case due to contracts with Microsoft, but those already can't run Linux in the first place, so you probably won't buy them for the purpose of running Linux. The suggestions in the original post do not change anything about this.
- no_time 4y ago
  I am mainly worried about remote attestation encroaching on territory which was traditionally under the user's control. And once this tech reaches critical mass, sure you can disable it however that also means turning your machine into a glorified paperweight that can't access anything arbitrary websites and software.
  - kevincox 4y ago
    You see this on Android, my banking app requires that it is running an OS approved by a big vendor. Their website, especially the mobile version, is getting more and more tedious to use. I want to be able to access all services with whatever client I please. Not be required to run approved software and hardware that puts them in control.
    - growse 4y ago
      It sounds like you're demanding to use someone's service on your own terms. I'm not sure why it's obvious that the service provider is under any obligation to entertain your desires. So.... vote with your feet and choose a bank that shares your values more closely?
      - kevincox 4y ago
        You have a point that the problem isn't the technology but the policy. However the fact is that most banks are moving in this direction so it leaves a consumer little choice.
      - no_time 4y ago
        >I'm not sure why it's obvious that the service provider is under any obligation to entertain your desires. They are not obliged by law in any way. However leading up to this point, whatever happens on my side of the network socket has been my discretion. Disrupting this dynamic just bothers me.
      - TeMPOraL 4y ago
        > So.... vote with your feet and choose a bank that shares your values more closely? That never worked and will not work now. You can't choose something that's not being offered. EDIT: Also, > It sounds like you're demanding to use someone's service on your own terms. Well, sort of; a service agreement is a relationship, and TPM/remote attestation is a huge overreach by the corporate party. It's only fair to want to push back on what's becoming an abusive relationship.
        growse 4y ago
        > That never worked and will not work now. You can't choose something that's not being offered. Why do you think you're entitled to something that's not being offered? I think there's a general point here about how retail banking is not really an ideal free market, because the barrier to entry is too high. If no bank is providing a set of services that fit the compromises you want to make, then either your problem is with the government (who arguably over-regulate the space) or not enough people share your values to warrant creating a banking business around it. > Well, sort of; a service agreement is a relationship, and TPM/remote attestation is a huge overreach by the corporate party. It's only fair to want to push back on what's becoming an abusive relationship. On the flip side, the bank has to manage a complicated series of risks, and their investors might not want to pay the mitigation costs of the risks created by allowing anyone to use their service however they like. Hence the ToS.
- endgame 4y ago
  > AFAIK, secure boot can be disabled, both in the BIOS and in the Kernel. For now.
  - lproven 4y ago
    Yup. E.g. on the MS Surface RT ARM devices it couldn't be, for instance. I wrote about this nearly a decade ago: https://www.theregister.com/2013/11/14/microsoft_surface_rt_stockpile/ https://www.theregister.com/2013/11/14/microsoft_surface_rt_... AFAIK, rather than make the firmware unlockable, MS sent vast amounts of inventory to landfill.
- jzb 4y ago
  The thing is a lot of machines get a second life running Linux. So these controls will end up making that hardware less useful in the longer run.
deleted 4y ago
[deleted]

pilif 4y ago

> you can't have one without the other, AFAIK, secure boot can be disabled, both in the BIOS and in the Kernel. In some machines that's not be the case due to contracts with Microsoft, but those already can't run Linux in the first place, so you probably won't buy them for the purpose of running Linux. The suggestions in the original post do not change anything about this.

no_time 4y ago
I am mainly worried about remote attestation encroaching on territory which was traditionally under the user's control. And once this tech reaches critical mass, sure you can disable it however that also means turning your machine into a glorified paperweight that can't access anything arbitrary websites and software.
- kevincox 4y ago
  You see this on Android, my banking app requires that it is running an OS approved by a big vendor. Their website, especially the mobile version, is getting more and more tedious to use. I want to be able to access all services with whatever client I please. Not be required to run approved software and hardware that puts them in control.
  - growse 4y ago
    It sounds like you're demanding to use someone's service on your own terms. I'm not sure why it's obvious that the service provider is under any obligation to entertain your desires. So.... vote with your feet and choose a bank that shares your values more closely?
    - kevincox 4y ago
      You have a point that the problem isn't the technology but the policy. However the fact is that most banks are moving in this direction so it leaves a consumer little choice.
    - no_time 4y ago
      >I'm not sure why it's obvious that the service provider is under any obligation to entertain your desires. They are not obliged by law in any way. However leading up to this point, whatever happens on my side of the network socket has been my discretion. Disrupting this dynamic just bothers me.
    - TeMPOraL 4y ago
      > So.... vote with your feet and choose a bank that shares your values more closely? That never worked and will not work now. You can't choose something that's not being offered. EDIT: Also, > It sounds like you're demanding to use someone's service on your own terms. Well, sort of; a service agreement is a relationship, and TPM/remote attestation is a huge overreach by the corporate party. It's only fair to want to push back on what's becoming an abusive relationship.
      - growse 4y ago
        > That never worked and will not work now. You can't choose something that's not being offered. Why do you think you're entitled to something that's not being offered? I think there's a general point here about how retail banking is not really an ideal free market, because the barrier to entry is too high. If no bank is providing a set of services that fit the compromises you want to make, then either your problem is with the government (who arguably over-regulate the space) or not enough people share your values to warrant creating a banking business around it. > Well, sort of; a service agreement is a relationship, and TPM/remote attestation is a huge overreach by the corporate party. It's only fair to want to push back on what's becoming an abusive relationship. On the flip side, the bank has to manage a complicated series of risks, and their investors might not want to pay the mitigation costs of the risks created by allowing anyone to use their service however they like. Hence the ToS.
endgame 4y ago
> AFAIK, secure boot can be disabled, both in the BIOS and in the Kernel. For now.
- lproven 4y ago
  Yup. E.g. on the MS Surface RT ARM devices it couldn't be, for instance. I wrote about this nearly a decade ago: https://www.theregister.com/2013/11/14/microsoft_surface_rt_stockpile/ https://www.theregister.com/2013/11/14/microsoft_surface_rt_... AFAIK, rather than make the firmware unlockable, MS sent vast amounts of inventory to landfill.
jzb 4y ago
The thing is a lot of machines get a second life running Linux. So these controls will end up making that hardware less useful in the longer run.

deleted 4y ago

[deleted]