5 ms·

> There is also a real potential for abusing TPMs or cryptographic co-processors to enforce remote attestation. People here REALLY need to start understanding

> There is also a real potential for abusing TPMs or cryptographic co-processors to enforce remote attestation. People here REALLY need to start understanding this issue. Remote Attestation is the kind of tech that if abused will end free computing over night.

weikju 1y ago
s/if/when/
heavyset_go 1y ago
Remote attestation is already here with Play Protect/Integrity on Android, and Microsoft's Pluton co-processor enables the same thing
- nerdsniper 1y ago
  See also: - Private Access Token [0] - Web Environment Integrity [1] among other proposals. 0: https://news.ycombinator.com/item?id=31751203 https://news.ycombinator.com/item?id=31751203 1: https://news.ycombinator.com/item?id=36785516 https://news.ycombinator.com/item?id=36785516
dataflow 1y ago
> People here REALLY need to start understanding this issue. The idea that understanding is the problem feels like a fallacy. People need to upgrade hardware, and when all chips contain such functionality, consumers won't have a choice of alternatives. What you want is legislation (or a dominant competitor lacking such features, which doesn't exist).
- account42 1y ago
  Legislation doesn't help unless its the right legislation. After all, legislation is what is forbidding you from producing a competing x86 processor with the changes you want.
wkat4242 1y ago
And it's already happening in the form of Google play integrity API. Many apps already require it. It's just a matter of time before they push similar tech to the desktop. And on mobile it hurts more because many banks now require a mobile app for 2FA. Personally I think any form of attestation is evil.
- butlike 1y ago
  I agree. Now: "Papers, please."
breakingcups 1y ago
Microsoft had a lot of practice with this with the recent Xbox hardware & software.
breakingcups 1y ago
There's a reason Microsoft is aggressively deprecating "older" CPU's that work perfectly fine. Heck, I have one laptop with Windows 11 that worked great, but won't update from 22h2 to 24h2 because CPU support was dropped between versions, leaving me with only the glib suggestion from the Windows Update UI to "Buy a new device". Ironically, installing Windows 10 and activating ESU would lead to longer hardware life. Of course, I didn't. Instead, I installed Linux on that laptop too. My partner had no issues switching.
- WorldMaker 1y ago
  TPM wasn't the only reason older CPUs were dropped. The biggest reasons where the line in the sand Microsoft chose would not be supported in Windows 11 was Spectre/Meltdown [0] mitigation. Windows 10 added a bunch of intentional slowdowns to mitigate that disaster and people incorrectly blamed Windows 10 for being slow and not the CPUs and their CVEs. Windows 11 seems to have wanted a clean slate without needing to have any of those slowdown mitigations in the codebase and eliminate some classes of "Windows 11 is slow on my machine" complaints. I'm not sure Microsoft took the best approach. I might have opted into a "Windows 11 Slow CPU" SKU if it was marketed right. That might have been a little kinder than "all these CPUs with this awful series of bugs are trash, even though we have had a successful workaround". [0] https://en.wikipedia.org/wiki/Spectre_(security_vulnerability) https://en.wikipedia.org/wiki/Spectre_(security_vulnerabilit...
  - p_ing 1y ago
    Yes, Microsoft is blocking CPUs which lack the ability for Virtualization Based Security. Given OS security is important to Microsoft (surprise, I know), enforcing VBS is a priority.
    - everdev 1y ago
      Security for Microsoft...
  - rightbyte 1y ago
    My understanding is that Spectre etc. only is a problem if the user choses to run hostile code on their computer.
benterix 1y ago
> over night. No, I think they bend over backwards not to do it overnight because of the outcry but try to make all required changes and enforcements gradually over the years so in the end you will have no choice but there will not be any sudden change that would spark protests.

weikju 1y ago

s/if/when/

heavyset_go 1y ago

Remote attestation is already here with Play Protect/Integrity on Android, and Microsoft's Pluton co-processor enables the same thing

nerdsniper 1y ago
See also: - Private Access Token [0] - Web Environment Integrity [1] among other proposals. 0: https://news.ycombinator.com/item?id=31751203 https://news.ycombinator.com/item?id=31751203 1: https://news.ycombinator.com/item?id=36785516 https://news.ycombinator.com/item?id=36785516

dataflow 1y ago

> People here REALLY need to start understanding this issue. The idea that understanding is the problem feels like a fallacy. People need to upgrade hardware, and when all chips contain such functionality, consumers won't have a choice of alternatives. What you want is legislation (or a dominant competitor lacking such features, which doesn't exist).

account42 1y ago
Legislation doesn't help unless its the right legislation. After all, legislation is what is forbidding you from producing a competing x86 processor with the changes you want.

wkat4242 1y ago

And it's already happening in the form of Google play integrity API. Many apps already require it. It's just a matter of time before they push similar tech to the desktop. And on mobile it hurts more because many banks now require a mobile app for 2FA. Personally I think any form of attestation is evil.

butlike 1y ago
I agree. Now: "Papers, please."

breakingcups 1y ago

Microsoft had a lot of practice with this with the recent Xbox hardware & software.

breakingcups 1y ago

There's a reason Microsoft is aggressively deprecating "older" CPU's that work perfectly fine. Heck, I have one laptop with Windows 11 that worked great, but won't update from 22h2 to 24h2 because CPU support was dropped between versions, leaving me with only the glib suggestion from the Windows Update UI to "Buy a new device". Ironically, installing Windows 10 and activating ESU would lead to longer hardware life. Of course, I didn't. Instead, I installed Linux on that laptop too. My partner had no issues switching.

WorldMaker 1y ago
TPM wasn't the only reason older CPUs were dropped. The biggest reasons where the line in the sand Microsoft chose would not be supported in Windows 11 was Spectre/Meltdown [0] mitigation. Windows 10 added a bunch of intentional slowdowns to mitigate that disaster and people incorrectly blamed Windows 10 for being slow and not the CPUs and their CVEs. Windows 11 seems to have wanted a clean slate without needing to have any of those slowdown mitigations in the codebase and eliminate some classes of "Windows 11 is slow on my machine" complaints. I'm not sure Microsoft took the best approach. I might have opted into a "Windows 11 Slow CPU" SKU if it was marketed right. That might have been a little kinder than "all these CPUs with this awful series of bugs are trash, even though we have had a successful workaround". [0] https://en.wikipedia.org/wiki/Spectre_(security_vulnerability) https://en.wikipedia.org/wiki/Spectre_(security_vulnerabilit...
- p_ing 1y ago
  Yes, Microsoft is blocking CPUs which lack the ability for Virtualization Based Security. Given OS security is important to Microsoft (surprise, I know), enforcing VBS is a priority.
  - everdev 1y ago
    Security for Microsoft...
- rightbyte 1y ago
  My understanding is that Spectre etc. only is a problem if the user choses to run hostile code on their computer.

benterix 1y ago

> over night. No, I think they bend over backwards not to do it overnight because of the outcry but try to make all required changes and enforcements gradually over the years so in the end you will have no choice but there will not be any sudden change that would spark protests.