3 ms·

I fully get the DRM hate. Now I don’t really follow the Windows world but I thought the goal of the newer TPM stuff was to be able to provide a trusted boot ch

by MBCook 2y ago

I fully get the DRM hate. Now I don’t really follow the Windows world but I thought the goal of the newer TPM stuff was to be able to provide a trusted boot chain the way Apple does. I’m under the impression that some of the earlier versions allowed the TPM module to be a separate piece of hardware from the CPU and thus exposed an hardware attack path where someone could snoop or man in the middle. If you have a full trusted chain you can certainly use that to ensure that the DRM isn’t being tampered with. But I kind of doubt that’s the main reason behind all of it. There are enough good reasons they may want better security on the hardware outside of that it seems justifiable that they might push it. I’m not arguing it’s good or bad, I just don’t think it’s 100% about DRM and the rest is a smoke screen.

yakaccount4 2y ago
Deploying some sort of TPM remote attestation for DRM requires every component from every vendor to play nice, so I don't think you'll ever see that rolled out for Windows. I would guess that the actual push for TPM is to have 'better' BitLocker, and Passkey support. In practice the default BitLocker+TPM configuration isn't that great (no user entropy/pin, dTPM is basically worthless). I have no actual understanding for how TPM is involved for Windows Hello/WebAuthn/Passkey or whatever, but at a glance it would seem Biometrics without a TEE seems like a very weak link.
- MBCook 2y ago
  I figured it’s more about ensuring the kernel and boot loading and OS are 100% unmodified by attackers/malware. If that helps with bitlocker or passkeys or whatever that’s great. But I assume at its base it’s a pure integrity play. I would think that would also let you know the public key stuff used to communicate with hardware authentication like a fingerprint reader is secure too, but I don’t know how that stuff works well enough to know if that’s true.
  - davidczech 2y ago
    TPM can measure the Secure Boot state for later reporting (attestation) but when it comes to DRM, that’s not a terribly interesting bit of information, knowing the firmware and kernel are valid, when the configuration of the OS and installed applications is really the important part. As far as I know there’s no real scalable way for that to work in the Windows ecosystem.
    - MBCook 2y ago
      That makes sense to me. It just doesn’t seem that useful for DRM, seems like kind of a reach. Especially in modern systems where the graphics card could do all of it and so the host PC never has access to the decrypted data or keys in the first place.
NotPractical 2y ago
> to provide a trusted boot chain the way Apple does Your flaw is assuming that Apple's only doing that for your security and has no ulterior motives. But iOS apps are disabled and Netflix reduces to a lower resolution when you disable System Integrity Protection on a Mac (among other things?). The trusted boot chain is clearly a DRM enforcement tool in addition to being a security feature. https://github.com/cormiertyshawn895/RecordingIndicatorUtility?tab=readme-ov-file#troubleshooting-tips https://github.com/cormiertyshawn895/RecordingIndicatorUtili...

by MBCook 2y ago

yakaccount4 2y ago

Deploying some sort of TPM remote attestation for DRM requires every component from every vendor to play nice, so I don't think you'll ever see that rolled out for Windows. I would guess that the actual push for TPM is to have 'better' BitLocker, and Passkey support. In practice the default BitLocker+TPM configuration isn't that great (no user entropy/pin, dTPM is basically worthless). I have no actual understanding for how TPM is involved for Windows Hello/WebAuthn/Passkey or whatever, but at a glance it would seem Biometrics without a TEE seems like a very weak link.

MBCook 2y ago
I figured it’s more about ensuring the kernel and boot loading and OS are 100% unmodified by attackers/malware. If that helps with bitlocker or passkeys or whatever that’s great. But I assume at its base it’s a pure integrity play. I would think that would also let you know the public key stuff used to communicate with hardware authentication like a fingerprint reader is secure too, but I don’t know how that stuff works well enough to know if that’s true.
- davidczech 2y ago
  TPM can measure the Secure Boot state for later reporting (attestation) but when it comes to DRM, that’s not a terribly interesting bit of information, knowing the firmware and kernel are valid, when the configuration of the OS and installed applications is really the important part. As far as I know there’s no real scalable way for that to work in the Windows ecosystem.
  - MBCook 2y ago
    That makes sense to me. It just doesn’t seem that useful for DRM, seems like kind of a reach. Especially in modern systems where the graphics card could do all of it and so the host PC never has access to the decrypted data or keys in the first place.

NotPractical 2y ago

> to provide a trusted boot chain the way Apple does Your flaw is assuming that Apple's only doing that for your security and has no ulterior motives. But iOS apps are disabled and Netflix reduces to a lower resolution when you disable System Integrity Protection on a Mac (among other things?). The trusted boot chain is clearly a DRM enforcement tool in addition to being a security feature. https://github.com/cormiertyshawn895/RecordingIndicatorUtility?tab=readme-ov-file#troubleshooting-tips https://github.com/cormiertyshawn895/RecordingIndicatorUtili...