4 ms·

TPMs with attestation do exactly that. Are you opposed to that as well?

by endisneigh 3y ago

lxgr 3y ago
Seems like a strange way to make a point to start out with SSL and then shift the argument to TPM/attestation...
JohnFen 3y ago
Yes, I have been opposed to TPM since the start.
- endisneigh 3y ago
  What's your solution then to the problem TPMs solve?
  - JohnFen 3y ago
    That depends on which problem you're talking about. But this is not the issue at hand.
  - mindslight 3y ago
    What do you get from blasting this thread with a bunch of naive one liners that you could answer yourself if you studied the topic on your own for a little bit? The answer to this one is that the fundamental problem that current TPMs aim to "solve" is that of allowing corporate control and inspection of end users' computers. To continue having a free society where individuals have some autonomy over the devices they purportedly own, this needs to be soundly rejected.
    - pptr 3y ago
      Good idea, we just throw out all the security mechanisms to avoid "corporate control" and even worse anti virus software "inspecting end users' computers". I'm sure people will be very happy about all the mal- and ransomware they receive. Imagine the utopia we would live in.
      - mindslight 3y ago
        You're using scare quotes, but I do specifically mean corporate control. Current TPMs were designed around giving centralized parties (eg corporations) privileged keys. TPMs could certainly be designed to not have any baked in privileged keys, instead putting the owner at the trust root. The current crop just wasn't. Also that you're talking about anti virus shows that you're not really in touch with the gamut of computing. From my perspective, anti virus was something that was relevant two decades ago.
  - rcxdude 3y ago
    which problem? Some 'problems' TPMs solve should not be solved. Others are perfectly reasonable but a generally a lot less common.
rezonant 3y ago
That's exactly what WEI is supposed to do... And yes, websites should not be able to use the TPM for attesting the user's environment.
- endisneigh 3y ago
  why not? how do you want to solve the problem of provenance? if you feel it's not a problem to begin with, then the sites in question can simply choose not to enable it. if they enable and believe it is a problem, then clearly there's a dissonance between the places you choose to visit and their goals, no?
  - deleted 3y ago
    [deleted]
  - lxgr 3y ago
    WEI does not solve any "problem of provenance"; it's DRM for the web. It asserts things about the browser environment to the website operator, not the other way around. Are you sure you actually understand these two technologies (WEI and TLS) sufficiently to make these claims?
    - deleted 3y ago
      [deleted]
  - rezonant 3y ago
    > sites in question can simply choose not to enable it. My problem isn't that I as a developer don't have an option to not implement attestation checks on my own web properties. I already know that (and definitely won't be implementing them). My problem is that a huge number of websites will, ostensibly as an easier way to prevent malicious automation, spam etc, but in doing so will throw the baby out with the bathwater: That users will no longer have OS and browser choice because the web shackles them to approved, signed, and sealed hardware/software combinations primarily controlled by big tech.
  - rvba 3y ago
howinteresting 3y ago
Yes, TPMs have no business being part of the open web. They enable CIOs to make bad decisions like preventing a bank's website from being loaded in non-TPM browsers.
guilhas 3y ago
I support myself using a TPM to attest if my system has not been tampered But I oppose others, Google/Microsoft/Facebook/..., attesting if my system is according their specifications
mardifoufs 3y ago
Why are you proposing some sort of reverse slippery slope? So because "we" don't oppose a TPM, we shouldn't oppose any form of attestation? If anything you are just proving the point of the most paranoid. I don't even have a strong opinion on this but it's so weird to see this argument over and over. It's just calling for even an even more extreme reaction to any effort that goes in this direction, just in case it's used to justify a push for even worse stuff down the line.
Zak 3y ago
I am. I've had apps try to use Google Safetynet to prevent me from running them on my phone (which is not running the manufacturer-provided Android build), and I am certainly opposed to that. I wouldn't mind being able to use the TPM to tell me whether the hardware and software are what I expected them to be, but that's different.

TPMs with attestation do exactly that. Are you opposed to that as well?

lxgr 3y ago

Seems like a strange way to make a point to start out with SSL and then shift the argument to TPM/attestation...

JohnFen 3y ago

Yes, I have been opposed to TPM since the start.

endisneigh 3y ago
What's your solution then to the problem TPMs solve?
- JohnFen 3y ago
  That depends on which problem you're talking about. But this is not the issue at hand.
- mindslight 3y ago
  What do you get from blasting this thread with a bunch of naive one liners that you could answer yourself if you studied the topic on your own for a little bit? The answer to this one is that the fundamental problem that current TPMs aim to "solve" is that of allowing corporate control and inspection of end users' computers. To continue having a free society where individuals have some autonomy over the devices they purportedly own, this needs to be soundly rejected.
  - pptr 3y ago
    Good idea, we just throw out all the security mechanisms to avoid "corporate control" and even worse anti virus software "inspecting end users' computers". I'm sure people will be very happy about all the mal- and ransomware they receive. Imagine the utopia we would live in.
    - mindslight 3y ago
      You're using scare quotes, but I do specifically mean corporate control. Current TPMs were designed around giving centralized parties (eg corporations) privileged keys. TPMs could certainly be designed to not have any baked in privileged keys, instead putting the owner at the trust root. The current crop just wasn't. Also that you're talking about anti virus shows that you're not really in touch with the gamut of computing. From my perspective, anti virus was something that was relevant two decades ago.
- rcxdude 3y ago
  which problem? Some 'problems' TPMs solve should not be solved. Others are perfectly reasonable but a generally a lot less common.

rezonant 3y ago

That's exactly what WEI is supposed to do... And yes, websites should not be able to use the TPM for attesting the user's environment.

endisneigh 3y ago
why not? how do you want to solve the problem of provenance? if you feel it's not a problem to begin with, then the sites in question can simply choose not to enable it. if they enable and believe it is a problem, then clearly there's a dissonance between the places you choose to visit and their goals, no?
- deleted 3y ago
  [deleted]
- lxgr 3y ago
  WEI does not solve any "problem of provenance"; it's DRM for the web. It asserts things about the browser environment to the website operator, not the other way around. Are you sure you actually understand these two technologies (WEI and TLS) sufficiently to make these claims?
  - deleted 3y ago
    [deleted]
- rezonant 3y ago
  > sites in question can simply choose not to enable it. My problem isn't that I as a developer don't have an option to not implement attestation checks on my own web properties. I already know that (and definitely won't be implementing them). My problem is that a huge number of websites will, ostensibly as an easier way to prevent malicious automation, spam etc, but in doing so will throw the baby out with the bathwater: That users will no longer have OS and browser choice because the web shackles them to approved, signed, and sealed hardware/software combinations primarily controlled by big tech.
- rvba 3y ago

howinteresting 3y ago

Yes, TPMs have no business being part of the open web. They enable CIOs to make bad decisions like preventing a bank's website from being loaded in non-TPM browsers.

guilhas 3y ago

I support myself using a TPM to attest if my system has not been tampered But I oppose others, Google/Microsoft/Facebook/..., attesting if my system is according their specifications

mardifoufs 3y ago

Why are you proposing some sort of reverse slippery slope? So because "we" don't oppose a TPM, we shouldn't oppose any form of attestation? If anything you are just proving the point of the most paranoid. I don't even have a strong opinion on this but it's so weird to see this argument over and over. It's just calling for even an even more extreme reaction to any effort that goes in this direction, just in case it's used to justify a push for even worse stuff down the line.

Zak 3y ago

I am. I've had apps try to use Google Safetynet to prevent me from running them on my phone (which is not running the manufacturer-provided Android build), and I am certainly opposed to that. I wouldn't mind being able to use the TPM to tell me whether the hardware and software are what I expected them to be, but that's different.