3 ms·

If MSI keeps this feature, I would probably buy their boards. I don't get the love for trusted computing, it can have severe negative effects if you look beyond

If MSI keeps this feature, I would probably buy their boards. I don't get the love for trusted computing, it can have severe negative effects if you look beyond the direct effects of validating your system OS. It can lock down free and open computing and this is far greater than the threat by trojans that I didn't have in the last 20 years. Since Windows will force secure boot, this is a very welcome convenience feature.

prmoustache 4y ago
It is in no way different than all other motherboards laptops. They all allow you to disable secure-boot.
- raxxorraxor 4y ago
  As I understand it, it simulates secure boot being enabled. This is handy for the OS that try to enforce it. It is not too hard to see that some kind of software will also try to enforce it. Mechanisms like remote attestation are pretty hostile in my opinion. This is about control for me, not about sensible security.
  - g_p 4y ago
    If you really wanted to verify that secure boot was enabled, and that a user wasn't doing "funky things", you'd need to also check for a TPM attestation, as you allude to - this isn't really simulating a whole lot from a security perspective. You can fairly easily "spoof" secure boot being enabled on a non-secure-boot system, since effectively you are exposing a 1 instead of a 0 (and with secure boot off, can hook whatever you need to). Admittedly, having a button in the UEFI menu is more convenient for an end user though. If you have a TPM attestation of the device state, PCR 7 is sealed around the secure boot state, and that would be more interesting for someone trying to lock someone in. As you say, if your TPM is then being used to attest that the system is unmodified, then that is pretty user hostile. For a regular normal non-technical user though, having some "sane defaults" arguably makes sense - if we raise the bar on compromising a regular person's computer by a few notches (i.e. you can't just replace the bootloader with a keylogger and chain-load the regular bootloader), it can help with platform security. The problem is that, on top of that platform, end users run all kinds of (what we'd previously call) spyware/adware, which just sends their data off the system. When this "non-technical user protection" starts to get in the way of expert users, that's when it becomes more of a problem for being in control of your own system.
    - raxxorraxor 4y ago
      I also would want to spoof the remote attestations. Let us be honest here, the features to expect is that Netflix doesn't work on your non-approved "secure" device. Not many other benefits to the user are provided. The most locked down systems are the ones that expose the most data. Granted, that is because of the type of the device in many cases, but that is the current reality.
      - smileybarry 4y ago
        Some multiplayer games use Secure Boot and remote attestation as confirmation that the user can’t load cheats. Like any anti-cheating solution it’s not perfect, but it can lower the prevalence of cheats dramatically, and that’s one hell of a user benefit.
        Zuiii 4y ago
        > that’s one hell of a user benefit Not for every user. Besides, the protections this would offer would be easily and cheaply circumvented via a raspberry pi and usb peripheral emulation. The is no escaping the analog hole as you stated. I'm not willing to give up my control as an owner over my device for a reason as flimsy as this. Gamers who want to give up control for a slightly lower percentage of cheaters can get dedicated computing hardware (consoles) instead.
        smileybarry 4y ago
        > > that’s one hell of a user benefit > Not for every user. Not every feature has to benefit every single user. Otherwise let's just remove WSL because it's in use by <1% of Windows users. > I'm not willing to give up my control as an owner over my device for a reason as flimsy as this. Gamers who want to give up control for a slightly lower percentage of cheaters can get dedicated computing hardware (consoles) instead. Okay, then turn off Secure Boot. And just don't play these games. No one's saying all computers must have Secure Boot on and untoggleable. Secured Core is optional and it's very enterprise-focused, i.e.: businesses gating domain join to Secured Core PCs for extra perimeter control.
- 5e92cb50239222b 4y ago
  … for now. Boiling the frog slowly and all that.
rollcat 4y ago
> It can lock down free and open computing and this is far greater than the threat by trojans that I didn't have in the last 20 years. I see this claim made over and over, yet we are still to see an actual "act of aggression" (modulo incompetence of an individual vendor - slip ups happen[0]). Every single PC system I ever heard of, allows either enrolling your own keys, or just disabling secure boot; most accept the MS-signed bootloader shim found in common desktop distros; I think this is even mandated in MS' specification that it must be possible for the users to bypass this. If you haven't had a trojan in the last 20 years, you have been diligent and/or lucky. Scattershot malware (cryptolockers, miners) is incredibly common, one of our customers was hit several times (on systems we weren't managing). More sophisticated attacks are an everyday thing against high-value targets[1][2]. Exploiting computer (in)security is a multi-billion dollar business, platforms far more locked down than PC are being routinely targeted and exploited. Real people, fighting for IRL freedom - journalists, activists, opposition politicians - are in danger. Please stop spreading the FUD against secure boot, and please back your claims with facts. [0]: https://mjg59.dreamwidth.org/59931.html https://mjg59.dreamwidth.org/59931.html https://news.ycombinator.com/item?id=32023868 https://news.ycombinator.com/item?id=32023868 [1]: https://techcrunch.com/2023/01/14/circleci-hackers-stole-customer-source-code/ https://techcrunch.com/2023/01/14/circleci-hackers-stole-cus... [2]: https://xeiaso.net/blog/spearphishing https://xeiaso.net/blog/spearphishing
- goosedragons 4y ago
  Because there was pushback against it. Originally with Windows 8 certification MS didn't care if OEMs had an option to disable Secure Boot or not. After the initial outcry an option was added. They then tried again with Windows 10. And this only applies to x86 based machines, ARM models have secure boot stuck on since RT launched. https://arstechnica.com/information-technology/2015/03/windows-10-to-make-the-secure-boot-alt-os-lock-out-a-reality/ https://arstechnica.com/information-technology/2015/03/windo... Did secure boot stop those malware attacks? Somehow despite secure boot being enabled as default for like 10 years I still routinely hear about XYZ getting hit by ransomware so I'm guessing no. Software freedom can help IRL too.
  - 4y ago

prmoustache 4y ago

It is in no way different than all other motherboards laptops. They all allow you to disable secure-boot.

raxxorraxor 4y ago
As I understand it, it simulates secure boot being enabled. This is handy for the OS that try to enforce it. It is not too hard to see that some kind of software will also try to enforce it. Mechanisms like remote attestation are pretty hostile in my opinion. This is about control for me, not about sensible security.
- g_p 4y ago
  If you really wanted to verify that secure boot was enabled, and that a user wasn't doing "funky things", you'd need to also check for a TPM attestation, as you allude to - this isn't really simulating a whole lot from a security perspective. You can fairly easily "spoof" secure boot being enabled on a non-secure-boot system, since effectively you are exposing a 1 instead of a 0 (and with secure boot off, can hook whatever you need to). Admittedly, having a button in the UEFI menu is more convenient for an end user though. If you have a TPM attestation of the device state, PCR 7 is sealed around the secure boot state, and that would be more interesting for someone trying to lock someone in. As you say, if your TPM is then being used to attest that the system is unmodified, then that is pretty user hostile. For a regular normal non-technical user though, having some "sane defaults" arguably makes sense - if we raise the bar on compromising a regular person's computer by a few notches (i.e. you can't just replace the bootloader with a keylogger and chain-load the regular bootloader), it can help with platform security. The problem is that, on top of that platform, end users run all kinds of (what we'd previously call) spyware/adware, which just sends their data off the system. When this "non-technical user protection" starts to get in the way of expert users, that's when it becomes more of a problem for being in control of your own system.
  - raxxorraxor 4y ago
    I also would want to spoof the remote attestations. Let us be honest here, the features to expect is that Netflix doesn't work on your non-approved "secure" device. Not many other benefits to the user are provided. The most locked down systems are the ones that expose the most data. Granted, that is because of the type of the device in many cases, but that is the current reality.
    - smileybarry 4y ago
      Some multiplayer games use Secure Boot and remote attestation as confirmation that the user can’t load cheats. Like any anti-cheating solution it’s not perfect, but it can lower the prevalence of cheats dramatically, and that’s one hell of a user benefit.
      - Zuiii 4y ago
        > that’s one hell of a user benefit Not for every user. Besides, the protections this would offer would be easily and cheaply circumvented via a raspberry pi and usb peripheral emulation. The is no escaping the analog hole as you stated. I'm not willing to give up my control as an owner over my device for a reason as flimsy as this. Gamers who want to give up control for a slightly lower percentage of cheaters can get dedicated computing hardware (consoles) instead.
        smileybarry 4y ago
        > > that’s one hell of a user benefit > Not for every user. Not every feature has to benefit every single user. Otherwise let's just remove WSL because it's in use by <1% of Windows users. > I'm not willing to give up my control as an owner over my device for a reason as flimsy as this. Gamers who want to give up control for a slightly lower percentage of cheaters can get dedicated computing hardware (consoles) instead. Okay, then turn off Secure Boot. And just don't play these games. No one's saying all computers must have Secure Boot on and untoggleable. Secured Core is optional and it's very enterprise-focused, i.e.: businesses gating domain join to Secured Core PCs for extra perimeter control.
5e92cb50239222b 4y ago
… for now. Boiling the frog slowly and all that.

rollcat 4y ago

> It can lock down free and open computing and this is far greater than the threat by trojans that I didn't have in the last 20 years. I see this claim made over and over, yet we are still to see an actual "act of aggression" (modulo incompetence of an individual vendor - slip ups happen[0]). Every single PC system I ever heard of, allows either enrolling your own keys, or just disabling secure boot; most accept the MS-signed bootloader shim found in common desktop distros; I think this is even mandated in MS' specification that it must be possible for the users to bypass this. If you haven't had a trojan in the last 20 years, you have been diligent and/or lucky. Scattershot malware (cryptolockers, miners) is incredibly common, one of our customers was hit several times (on systems we weren't managing). More sophisticated attacks are an everyday thing against high-value targets[1][2]. Exploiting computer (in)security is a multi-billion dollar business, platforms far more locked down than PC are being routinely targeted and exploited. Real people, fighting for IRL freedom - journalists, activists, opposition politicians - are in danger. Please stop spreading the FUD against secure boot, and please back your claims with facts. [0]: https://mjg59.dreamwidth.org/59931.html https://mjg59.dreamwidth.org/59931.html https://news.ycombinator.com/item?id=32023868 https://news.ycombinator.com/item?id=32023868 [1]: https://techcrunch.com/2023/01/14/circleci-hackers-stole-customer-source-code/ https://techcrunch.com/2023/01/14/circleci-hackers-stole-cus... [2]: https://xeiaso.net/blog/spearphishing https://xeiaso.net/blog/spearphishing

goosedragons 4y ago
Because there was pushback against it. Originally with Windows 8 certification MS didn't care if OEMs had an option to disable Secure Boot or not. After the initial outcry an option was added. They then tried again with Windows 10. And this only applies to x86 based machines, ARM models have secure boot stuck on since RT launched. https://arstechnica.com/information-technology/2015/03/windows-10-to-make-the-secure-boot-alt-os-lock-out-a-reality/ https://arstechnica.com/information-technology/2015/03/windo... Did secure boot stop those malware attacks? Somehow despite secure boot being enabled as default for like 10 years I still routinely hear about XYZ getting hit by ransomware so I'm guessing no. Software freedom can help IRL too.
- 4y ago