4 ms·

This is about the TPM in windows 8. It's the same argument about treacherous computing that goes around, except the article seems to be suggesting people think

This is about the TPM in windows 8. It's the same argument about treacherous computing that goes around, except the article seems to be suggesting people think it's a extent problem now because the TPM is always on, not a hypothetical in the future/ Microsoft's long term plan. Further, there is a nebulous assertion linking this to the NSA. 1) The TPM still can't control your computer(yet). It can only measure it's state, allow you access to keys you created in some state, and attest to things about the state (which would allow other parties to mandate what state your system is in when interacting with it, but presumably those entities would be bond by German law and likely be German themselves) 2) If Microsoft wanted to backdoor your system, they don't need the TPM to do it. In fact, the TPM can be used to protect against a whole bunch of malware that various intelligence agencies might use: it can protect keys with passwords (with rate limiting/self destruct for guessing), make sure the system is in the same state(i.e. malware free) when you created you PGP key as it is when your using it to decrypt an e-mail, and it can isolate an application from the rest of your system.

reirob 13y ago
Your second point is exactly what the German government is afraid of according to the article. According to the article there seem to be security vulnerabilities on 3 levels in TPM 2.0, which might be used by intelligence agencies - the article states NSA and China who is actually producing most of the TPM chips.
- TazeTSchnitzel 13y ago
  Bundestrojaner.
abcd_f 13y ago
> If Microsoft wanted to backdoor your system ... ... they already have Windows Update. It cannot be null-routed (respective entries in /etc/hosts are simply ignored), it is virtually always on and it can be trivially used to deliver custom patches to specific boxes. What more can you ask for?
- TheAnimus 13y ago
  What if you disable it? Doesn't it respect that setting?
- acqq 13y ago
  You are right that MSFT has the "update". The bigger problem with Windows 8 computers is that similar things are in practice available to all the "third parties" who have hardware or kernel-driver components. And you have less control than before about them all. It's a broader problem than just Microsoft. The new "you as the user can't control the kernel stuff, even with the debugger" concept is really about the user (you) giving up the control. The excuse is that you as the user aren't supposed to be able to copy movies. In practice, you have no more control of your own computer whereas the companies have real-time control even of the content by directly controlling your computer. Some routers already did such stuff. It is really worrying -- having the part of the "great firewall of China/whateverothercountry" on your own computer which you paid with your own money.
- simonh 13y ago
  Who says the original windows binaries don't have backdoors in them? So far as I can see the only difference TPM makes is that it potentially opens vulnerabilities in non-MS operating systems you run. If you're running any version Windows, or in fact any software you don't compile yourself from source(1), you just have to trust on faith it's not back-doored up to the eyeballs from the get-go. This has always been true. (1) And in fact also have total confidence in the compiler itself: http://scienceblogs.com/goodmath/2007/04/15/strange-loops-dennis-ritchie-a/ http://scienceblogs.com/goodmath/2007/04/15/strange-loops-de...
acqq 13y ago
I have a Windows 8 notebook and for the first time in my life I have no control over my own general purpose computer: - I can't enter BIOS before entering OS. - Once I enter the BIOS from the OS I can't activate the hard disk password. - I can't install the Windows 8 OS clean. The MSFT has the deal with the computer producers that doesn't allow them to deliver the pure OS medium, you can only backup the already present installed files to some external HDD. - Because of the previous and the fact that the binaries are controlled on the hardware level (TPM), I have no control of what's running on my computer -- I can't know, to be precise. - It's even worse than that, there is some Intel built-in technology on the hardware/BIOS/drivers level which also has built-in "features" that allow communication with some external "command and control center" which I don't control. It supposedly allows, among other "features" disabling the notebook once it's stolen. But I don't control how it's done, and I don't know if it has additional backdoors. It proudly claims to facilitate "remote access." It's scary how it looks like all together. I haven't even figured out how I'd be able to install Linux on the computer. In some forums people claim that the OEM should allow that, but apparently a lot of people haven't managed to actually install it on different specific computers -- there are BIOS problems that can't be avoided, and the OEMs don't give you support or the updates. Mine is an Intel i5 processor-based modern Acer. It's fast, but I have no control. Definitely not FUD. Personally I like Apple approach more: thanks to their approach of the OSX or iOS (no third party pre-installed crap) at least I have to just trust Apple. Here I have to trust Microsoft, Intel and every company who has the drivers on my machine. Much more chance for some of them to do what they want, in the name of "cloud." Remember routers that are controlled from the producer of the router, even "protecting" you from browsing all the sites? Remember Android phones which upload all your passwords to the cloud of the mobile operator? That's where the "cloud" support of the driver writers goes now. It is scary. (Globally, we're talking about this: http://xkcd.com/743/ http://xkcd.com/743/ -- We've been giving up the control of "infrastructures" for a long time)
- btb 13y ago
  What brand notebook is that? Just so I can make a mental note to avoid purchasing that brand in the future :)
  - 13y ago

reirob 13y ago

Your second point is exactly what the German government is afraid of according to the article. According to the article there seem to be security vulnerabilities on 3 levels in TPM 2.0, which might be used by intelligence agencies - the article states NSA and China who is actually producing most of the TPM chips.

TazeTSchnitzel 13y ago
Bundestrojaner.

abcd_f 13y ago

> If Microsoft wanted to backdoor your system ... ... they already have Windows Update. It cannot be null-routed (respective entries in /etc/hosts are simply ignored), it is virtually always on and it can be trivially used to deliver custom patches to specific boxes. What more can you ask for?

TheAnimus 13y ago
What if you disable it? Doesn't it respect that setting?
acqq 13y ago
You are right that MSFT has the "update". The bigger problem with Windows 8 computers is that similar things are in practice available to all the "third parties" who have hardware or kernel-driver components. And you have less control than before about them all. It's a broader problem than just Microsoft. The new "you as the user can't control the kernel stuff, even with the debugger" concept is really about the user (you) giving up the control. The excuse is that you as the user aren't supposed to be able to copy movies. In practice, you have no more control of your own computer whereas the companies have real-time control even of the content by directly controlling your computer. Some routers already did such stuff. It is really worrying -- having the part of the "great firewall of China/whateverothercountry" on your own computer which you paid with your own money.
simonh 13y ago
Who says the original windows binaries don't have backdoors in them? So far as I can see the only difference TPM makes is that it potentially opens vulnerabilities in non-MS operating systems you run. If you're running any version Windows, or in fact any software you don't compile yourself from source(1), you just have to trust on faith it's not back-doored up to the eyeballs from the get-go. This has always been true. (1) And in fact also have total confidence in the compiler itself: http://scienceblogs.com/goodmath/2007/04/15/strange-loops-dennis-ritchie-a/ http://scienceblogs.com/goodmath/2007/04/15/strange-loops-de...

acqq 13y ago

I have a Windows 8 notebook and for the first time in my life I have no control over my own general purpose computer: - I can't enter BIOS before entering OS. - Once I enter the BIOS from the OS I can't activate the hard disk password. - I can't install the Windows 8 OS clean. The MSFT has the deal with the computer producers that doesn't allow them to deliver the pure OS medium, you can only backup the already present installed files to some external HDD. - Because of the previous and the fact that the binaries are controlled on the hardware level (TPM), I have no control of what's running on my computer -- I can't know, to be precise. - It's even worse than that, there is some Intel built-in technology on the hardware/BIOS/drivers level which also has built-in "features" that allow communication with some external "command and control center" which I don't control. It supposedly allows, among other "features" disabling the notebook once it's stolen. But I don't control how it's done, and I don't know if it has additional backdoors. It proudly claims to facilitate "remote access." It's scary how it looks like all together. I haven't even figured out how I'd be able to install Linux on the computer. In some forums people claim that the OEM should allow that, but apparently a lot of people haven't managed to actually install it on different specific computers -- there are BIOS problems that can't be avoided, and the OEMs don't give you support or the updates. Mine is an Intel i5 processor-based modern Acer. It's fast, but I have no control. Definitely not FUD. Personally I like Apple approach more: thanks to their approach of the OSX or iOS (no third party pre-installed crap) at least I have to just trust Apple. Here I have to trust Microsoft, Intel and every company who has the drivers on my machine. Much more chance for some of them to do what they want, in the name of "cloud." Remember routers that are controlled from the producer of the router, even "protecting" you from browsing all the sites? Remember Android phones which upload all your passwords to the cloud of the mobile operator? That's where the "cloud" support of the driver writers goes now. It is scary. (Globally, we're talking about this: http://xkcd.com/743/ http://xkcd.com/743/ -- We've been giving up the control of "infrastructures" for a long time)

btb 13y ago
What brand notebook is that? Just so I can make a mental note to avoid purchasing that brand in the future :)
- 13y ago