4 ms·

Weird rant. TPMs are great. The modern computing landscape needs a safe place to put secrets. It's what made the iPhone (Secure Enclave is effectively a TPM) ye

by jorvi 5mo ago

Weird rant. TPMs are great. The modern computing landscape needs a safe place to put secrets. It's what made the iPhone (Secure Enclave is effectively a TPM) years ahead of Android in terms of security. The problem isn't the TPM, but attestation. As soon as the TPM is required to not be under your control to get access to Y, bad things happen. Hell, in actuality, the problem isn't even attestation, its policy. The EU Parliament (the one the people vote for, the Commission are cronies) might eventually force corporations into something more citizen-friendly. Neither Apple, Google or Microsoft is going to drop a market that big.

pretzel5297 5mo ago
Agreed. Trying to limit progress because it may be misused is attacking the wrong part of the problem and will not work.
jojobas 5mo ago
TPMs add security against a narrow case of evil maid attacks. They might be useful for corporate computing (for cargo cult compliance purposes more than actual security) but they trojan horse more of "not owning the device you bought" with it to people that don't and shouldn't care about evil maid attacks at all.
- fsflover 5mo ago
  TPMs can also be based on free software and our own keys. It works well with Heads and Librem Key.
- jeroenhd 5mo ago
  Adding brute force resistance to consumer hardware is pretty useful. Now your password can be John1985 without fear of getting brute forced within seconds. "I don't use a TPM in my computer so it shouldn't exist" has always sounded like a weird argument against the tech in my opinion. Many Android phones have their secret storage implemented as a virtual machine rather than a TPM. The lack of a TPM doesn't suddenly give me any more freedom, although it does come with security downsides.
nananana9 5mo ago
Requiring "tokens" stored in "trusted modules" and 7-factor-auth for everything is not progress, it's theater. The biggest achievement of the security orthodoxy was locking me out of my email, by requiring me to read a code sent to my email to log into my email. I -- literally -- do not care about a single "account" in any "service" I use aside from my email and bank account. Most people would add a few social media accounts to that list. You don't need a "place to put secrets". Your iPhone app does not do anything important enough to require a "trusted chain" of cryptographic bullshit, just use a password and Google/Apple login.
- JambalayaJimbo 5mo ago
  What about Apple Wallet? The reality is that there is software dependent on the user being unable to modify it. This safeguards the server against fraudulent users.
  - customguy 5mo ago
    Never trust user input. The users already can't modify the server. And what actual applications did you have in mind that warrant throwing everybody under the bus? (by that I mean some applications (allegedly) need it, so it gets forced on everyone)
    - JambalayaJimbo 5mo ago
      My banking app already trusts Face ID right now!
      - customguy 5mo ago
        And how is that necessary? It's a convenience feature, nothing more. You might as well trust your bank with your biometric data directly, and leave me and others out of it either way. Even IF there was a real need for a mobile device with which general computing is not possible, that would not justify killing it everywhere just so people who do need it can "just use their phone". That the laziest of us don't mind and the worst of us want something is not a respectable argument for anything, ever.
lisabytes 5mo ago
>The modern computing landscape needs a safe place to put secrets. Does it? Why waste time on developing exploits when you can just call up grandma and get her give you the money by her "own" volition - using her secure device - by pretending to be the bank/IRS/her grand daughter using AI voice/etc.
loup-vaillant 5mo ago
> TPMs are great. TPMs are a fucking mess. TPM 2 at least, I’ve worked with it for a few months. I love me some hardware security module, but I want to control it. And if it must be a standard, please please to something like the TKey, so it can be both much simpler than current ad-hoc standards and future proof. https://loup-vaillant.fr/articles/hsm-done-right https://loup-vaillant.fr/articles/hsm-done-right
jeroenhd 5mo ago
Attestation isn't even the problem. I'd love to be able to verify that my server's kernel hasn't been tampered with. The problem lies in companies like Apple/Google/Microsoft rejecting attestation that they do not control. People confusing big tech's policy choices with tech features have made "I want my laptop's auth token to only be usable on my laptop" a controversial opinion.

by jorvi 5mo ago

pretzel5297 5mo ago

Agreed. Trying to limit progress because it may be misused is attacking the wrong part of the problem and will not work.

jojobas 5mo ago

TPMs add security against a narrow case of evil maid attacks. They might be useful for corporate computing (for cargo cult compliance purposes more than actual security) but they trojan horse more of "not owning the device you bought" with it to people that don't and shouldn't care about evil maid attacks at all.

fsflover 5mo ago
TPMs can also be based on free software and our own keys. It works well with Heads and Librem Key.
jeroenhd 5mo ago
Adding brute force resistance to consumer hardware is pretty useful. Now your password can be John1985 without fear of getting brute forced within seconds. "I don't use a TPM in my computer so it shouldn't exist" has always sounded like a weird argument against the tech in my opinion. Many Android phones have their secret storage implemented as a virtual machine rather than a TPM. The lack of a TPM doesn't suddenly give me any more freedom, although it does come with security downsides.

nananana9 5mo ago

Requiring "tokens" stored in "trusted modules" and 7-factor-auth for everything is not progress, it's theater. The biggest achievement of the security orthodoxy was locking me out of my email, by requiring me to read a code sent to my email to log into my email. I -- literally -- do not care about a single "account" in any "service" I use aside from my email and bank account. Most people would add a few social media accounts to that list. You don't need a "place to put secrets". Your iPhone app does not do anything important enough to require a "trusted chain" of cryptographic bullshit, just use a password and Google/Apple login.

JambalayaJimbo 5mo ago
What about Apple Wallet? The reality is that there is software dependent on the user being unable to modify it. This safeguards the server against fraudulent users.
- customguy 5mo ago
  Never trust user input. The users already can't modify the server. And what actual applications did you have in mind that warrant throwing everybody under the bus? (by that I mean some applications (allegedly) need it, so it gets forced on everyone)
  - JambalayaJimbo 5mo ago
    My banking app already trusts Face ID right now!
    - customguy 5mo ago
      And how is that necessary? It's a convenience feature, nothing more. You might as well trust your bank with your biometric data directly, and leave me and others out of it either way. Even IF there was a real need for a mobile device with which general computing is not possible, that would not justify killing it everywhere just so people who do need it can "just use their phone". That the laziest of us don't mind and the worst of us want something is not a respectable argument for anything, ever.

lisabytes 5mo ago

>The modern computing landscape needs a safe place to put secrets. Does it? Why waste time on developing exploits when you can just call up grandma and get her give you the money by her "own" volition - using her secure device - by pretending to be the bank/IRS/her grand daughter using AI voice/etc.

loup-vaillant 5mo ago

> TPMs are great. TPMs are a fucking mess. TPM 2 at least, I’ve worked with it for a few months. I love me some hardware security module, but I want to control it. And if it must be a standard, please please to something like the TKey, so it can be both much simpler than current ad-hoc standards and future proof. https://loup-vaillant.fr/articles/hsm-done-right https://loup-vaillant.fr/articles/hsm-done-right

jeroenhd 5mo ago

Attestation isn't even the problem. I'd love to be able to verify that my server's kernel hasn't been tampered with. The problem lies in companies like Apple/Google/Microsoft rejecting attestation that they do not control. People confusing big tech's policy choices with tech features have made "I want my laptop's auth token to only be usable on my laptop" a controversial opinion.