Remote Attestation is coming back

https://gabrielsieben.tech/2022/07/29/remote-assertion-is-coming-back-how-much-freedom-will-it-take/

by gjsman-1000 • 4 years ago

320 206 4 years ago

rektide• 4 years ago

It's not just a war on general purpose computing, it's not just the mainframe ascendant: the mainframe seems intent on taking over & coopting every computer it can.

Google's anti-rooting regime (SafetyNet) has been painful to experience. I'm not sure what's next with the new Play Integrity API but it's hard to have hope users will see wins here or anywhere.

etaioinshrdlu• 4 years ago

It may make web scraping even more difficult, or anonymity online more broadly.

capdeck2• 4 years ago

It will make web scraping impossible. You will not be able to install any software that can do that because it won't be let in to app stores (i.e. it will never get the right keys and permissions, websites won't even respond to it as it won't have attestation).

If you somehow try to work around and use your "attested" machine and user id to do this (because websites will require it and your script can't have it, but may be it can run under your user account, for example) - monitoring systems will soon block your account for "suspicious activity" and it will be next to impossible to re-instate because Google and Microsoft don't provide any human support, unless you are some 1mm+ influencer on instagram and will manage to start a rukus on social media.

The outlook is quite bleak :-(

heavyset_go4• 4 years ago

This is exactly how 3rd party apps and clients will be locked out of the services they depend on. In a world where AR and "metaverse" platforms take off, this will ensure that they're accessed only from approved clients.

This is also how OS, app distributors and platforms will ensure that they get their 30%+ cut of all revenue generated using their products, as well.

Similarly, this is how OS providers will ensure that apps built for their platforms can't run on other operating systems. You already can't run SafetyNet-enabled Android apps on other platforms despite Android support existing on Android and Linux.

echelon• 4 years ago

We've gone from open Windows and Linux PCs where you could install anything to walled gardens everywhere.

We need to bring the giants down to a level playing field and stop this nonsense.

matheusmoreira11• 4 years ago

Completely agree. How could such a thing be achieved?

heavyset_go4• 4 years ago

Windows* and Linux, not Android and Linux.

theptip• 4 years ago

This is a fairly popular take around here, but is it compatible with the EU’s new DMA? It seems if anything legislation is moving in the opposite direction of strengthened walled gardens.

They just made it illegal to forbid sideloading for example. On its face it’s going to be illegal for Apple/Android to use attestation to lock down their devices further, indeed they are now legally required to open up in the EU.

Maybe they would go in one direction in the US and the opposite outside? Seems unlikely to me though…

heavyset_go4• 4 years ago

I don't know. What's happening now with Android apps is that sideloading works just fine, it's just that SafetyNet apps refuse to work on other platforms like Windows, Linux or even un-blessed Android distributions. I don't know how compatible that is with EU legislation, or if technicalities like that side step it or not.

Maybe they would go in one direction in the US and the opposite outside? Seems unlikely to me though…

Companies seem to have no problem conforming to particular legal regimes all over the world and not importing/exporting them elsewhere. I believe companies will try everything in their power to protect their cash cows in the US for as long as they possibly can.

hwestiii• 4 years ago

I'm only here to say that I think Pluton is a completely ridiculous name.

cesarb3• 4 years ago

It's a mythological reference: "In ancient Greek religion and mythology, Pluto (Greek: Πλούτων, Ploutōn) was the ruler of the Greek underworld." (https://en.wikipedia.org/wiki/Pluto_%28mythology%29). As someone else remarked in a related thread elsewhere, we already have his dog (https://en.wikipedia.org/wiki/Kerberos_%28mythology%29) as the name of a security protocol.

lordofgibbons• 4 years ago

I'm convinced Cloudflare is a giant anti-privacy man-in-the-middle attack on the entire web experience.

It would be a conspiracy theory to say they were created by a three letter government agency, but if I was running one of those three letter agencies, this is exactly the kind of company I'd setup and control. People just give them their TLS keys lol

If you use a VPN or just like browsing in privacy mode, it will make your life as difficult as possible by having you fill out multiple captchas. And even then, it will sometimes not let you through.

If you're running a website, please stop using Cloudflare.

beebmam• 4 years ago

How are you "convinced" by something when you have zero evidence for the claim? It sounds like you wish it were true.

javajosh• 4 years ago

While I tend to agree with all of your post, I also have to admit that as a service provider it's nice to be protected from malefactors. If I had to point to the moral problem here its not Cloudflare's existence, but rather the lack of awareness that service providers have about the trade-offs they are making - very similar to the problem we have with "free" services like Google Analytics, or CDN hosting. In each case the programmer is trading away end-user privacy on an ongoing basis for transient developer convenience and a slightly cheaper-to-operate runtime with more failure modes. It's usually a bad trade, I think.

grishka6• 4 years ago

I hate Cloudflare with burning passion. Not only is it a US company that centralizes internet infrastructure around itself, it also terminates TLS for way too many websites and sees their cleartext traffic. It then actively meddles with said traffic and punishes you for something you have no control over (your IP address). It's a dystopian nightmare only second to online ads. But ads at least can be blocked — you have zero agency in case of Cloudflare.

Whenever I see the "one more step" crap, I just close that tab.

Cloudflare needs to stop existing, and it needs to do so yesterday.

alex7734• 4 years ago

It's a dystopian nightmare only second to online ads. But ads at least can be blocked — you have zero agency in case of Cloudflare.

About that, I imagine the millisecond that you can validate using remote attestation that a client has no adblockers, Cloudflare will add a remote attestation "gateway" (like the one they have now with the captcha) that will, overnight, give every Cloudflare customer (so half of the internet) the ability to block users that may have adblockers.

It's simply too juicy of a service for these people.

judge20206• 4 years ago

While Cloudflare is a big player, pretty much every service today has some form of third party MITM machine - things like Fastly, Akamai, Google Cloud Load Balancer and CloudFront all provide reverse proxy capabilities on the same level as Cloudflare.

Even if you run your own proxy and caching, you can’t trust your cloud provider not to DMA your keys unless you’re using trusted computing[0] (which ironically requires remote attestation if a company wants to verify it’s active on their CPU), and then chances are a dedicated three-letter-agency has exploits at the ready if they really need to extract information.

If a company isn’t running their own bare metal, nothing is safe.

0: https://aws.amazon.com/blogs/security/confidential-computing...

dijit• 4 years ago

While Cloudflare is a big player, pretty much every service today has some form of third party MITM machine - things like Fastly, Akamai, Google Cloud Load Balancer and CloudFront all provide reverse proxy capabilities on the same level as Cloudflare.

the normal way to do this is to run your static content through CDN's and allow your dynamic content to hit origin.

you're not saved from DDoS of course, but you'd be surprised at how much cookies for static content can cost you in CDN costs; usually people use a separate domain.

gruez• 4 years ago

If you use a VPN or just like browsing in privacy mode, it will make your life as difficult as possible by having you fill out multiple captchas. And even then, it will sometimes not let you through.

I use VPN and private browsing and the worst I've been subjected to is getting IP/ASN blocked, which to be fair can be implemented without cloudflare. I've had to fill out captchas but that's something that happens a few times a month at most, and it's never a captcha loop that you mentioned.

RedShift1• 4 years ago

Cloudflare does have the ability to front your website without providing your private key to them, it's called keyless SSL: https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-tec...

account426• 4 years ago

They are still terminating the encrypted connection and get to see all data in cleartext so this is irrelevant to the concerns stated in gp. The only thing this scheme buys you as the website owner is that you can prevent CF from accepting new SSL connections without revoking the certificate entirely.

canes123456• 4 years ago

We don’t use cloudfront but we use a competitor. Before we used it there would be millions of malicious attempted requests on our api. It doesn’t block everything and it makes things a pain for 1% of users but not using it would put tons of users data at risk.

fleventynine7• 4 years ago

Unpopular opinion:

Hardware-based attestation of the running software is an important security feature, especially in a world where data leaks and identity theft are rampant. Let's say I'm a healthcare provider, and I'm about to send sensitive medical data to a third party vendor. Wouldn't you prefer that this data only be able to be decrypted by a computer that can prove to the world it booted a clean OS image with all the latest security patches installed?

If the vendor wants to install some self-built OS that they trust on their computer and not update it for 5 years, that's their business, but I may not want to trust their computer to have access to my personal data.

Remote attestation gives more control to the owners of data to dictate how that data is processed on third-party machines (or even their own machines that may have been compromised). This is useful for more than just DRM.

gjsman-1000• 4 years ago

I actually don't disagree with you. As I mention in the article:

I cannot say how much freedom it will take. Arguably, some of the new features will be “good.” Massively reduced cheating in online multiplayer games is something many gamers could appreciate (unless they cheat). Being able to potentially play 4K Blu-ray Discs on your PC again would be convenient.

However, I'm more worried about the questions the increased deployment of technology will bring, such as will Linux users be doomed to a CAPTCHA onslaught being the untrusted devices, or worse. Important questions that, unless raised, risk us just "going with the flow" until it is way too late.

fleventynine7• 4 years ago

Unfortunately, it does seem likely that many services will require that your machine run a kernel/web browser signed by an entity they trust before they give you access to what they consider sensitive data. That will suck for those of us who want to build our own kernels/web browsers and use that software to interact with sensitive data from large corporations, but that's their choice to make (IMHO). And it's my choice not to use their service.

matheusmoreira11• 4 years ago

Massively reduced cheating in online multiplayer games is something many gamers could appreciate (unless they cheat).

I have a rooted Android phone and I had to spend effort spoofing attestation in order to even launch some of my games which don't even have multiplayer. Allow me to be the one to tell you that I do not appreciate it.

I don't even care enough to cheat at these games but if I wanted to cheat it would be merely an exercise of my computer freedom which nobody has any business denying.

kmeisthax2• 4 years ago

IMHO I don't see a CAPTCHA onslaught happening - if only because at that point the CAPTCHAs will be practically useless at stopping bots. They will just ban untrusted devices.

The current landscape of CAPTCHA technology is pretty bleak. It's pretty easy to use ML to learn and solve the early first-gen CAPTCHAs that just used crossed-out words. Google reCAPTCHA relies primarily on user data, obfuscation, and browser fingerprinting to filter out bots, but that only works because of (possibly misplaced) trust in Google. It falls back to an image recognition challenge (which hCaptcha uses exclusively) if you don't have a good data profile - which can also be solved by automated means.

I don't see desktop Linux being fully untrusted off the Internet, if only because Google won't let it happen. They banned Windows workstations internally over a decade ago and they are institutionally reliant upon Linux and macOS. What will almost certainly happen is that Linux will be relegated to forwarding attestation responses between Pluton, some annoying blob in Google Chrome, and any web service that does not want to be flooded with bots in our new hellscape of post-scarcity automation.

richardfey• 4 years ago

Another "doomsday scenario" is that a distinct market for FOSS hardware will arise, albeit much shittier hardware than what everyone else uses. Those users will become fringe and progressively isolated.

gerdesj• 4 years ago

"Hardware-based attestation of the running software is an important security feature"

I understand the mechanics in a "lies to children" way but who exactly is attesting what? Let's face it: MS isn't going to compensate me for a perceived flaw in ... why am I even finishing this sentence?

I recently bought some TPM 2.0 boards for my work VMware hosts so I could switch on secure boot and "attestation" for the OS. They are R630s which have a TPM 1.2 built in but a 2.0 jobbie costs about £16.

I've ticked a box or three on a sheet but I'm not too sure I have significantly enhanced the security of my VMware cluster.

nousermane2• 4 years ago

"Attestation" of a VM is such a fraught concept... Isn't whole idea of virtualization, to outright lie to the "guest" operating system?

Yes, dear Windows, you're running on a dual-core Xeon Gold 6326 with i440BX chipset. Don't ask how this is possible, just trust me...

fleventynine7• 4 years ago

Implemented properly, the idea is that you have a chain of certificates (rooted by the CPU vendor's public key) that can identify all the different bits of software that have executed on the machine, along with a ephemeral public key. The hardware guarantees that the associated private key can only be wielded by the software versions that the chain attested to. So when you initiate your TLS connection with this machine, you can validate the cert chain and understand exactly what software the machine is running, assuming that you trust the CPU vendor and all the versions of the software that were attested to.

SCHiM• 4 years ago

Even if we assume that the features will be basically unbreakable your world will still end up looking like the following.

Entities (ab)using remote attestation in order of 'screws over those below them':

Government > Cyber criminal groups > Large organizations > Normal people.

Do you want to live in a world where a large corp can dictate which $VERSION of $APPROVED_SOFTWARE you should be running? I think fundamentally it's just not the direction we should be going. I don't actually doubt that proper remote attestation eventually would be possible, but before then it will be possible to bypass it in countless ways. Probably eventually you'd end up with only a single software stack, assumed to be flawlessly secure.

I think, luckily, this will severely limit the usability of the technology that can work in this way. Developing for this stack will be a pain, the machine will have all sorts of super annoying limitations: can't use that display the driver is not vetted, can't use that USB webcam it might have DMA, etc. That will hopefully harm the uptake of such technologies.

Like often in tech remote attestation in your case is a technical fix for a social problem. If the problem is sharing sensitive data with institutions you don't trust then you need to build that trust, or transform the institutions so that they can be trusted. Transparency, laws, oversight, that type of stuff.

Schroedingersat4• 4 years ago

Unless you're including faang/ms in government, large organizations belong at the top of the list.

Who needs espionage or lobbying when you have an undetectable root shell on every computer in the country?

userbinator7• 4 years ago

Wouldn't you prefer that this data only be able to be decrypted by a computer that can prove to the world it booted a clean OS image with all the latest security patches installed?

No.

Contrarily unpopular opinion: You cannot own data except what resides on your own property. Once you give someone a copy, it is theirs to do with as they wish. They may tell you what they will and will not do, but it is entirely on you to trust them.

...and that's the peril of things like remote attestation and other "zero trust" crap. They replace the nuanced meaning of trust that holds society together (and has literally done so since the beginning of life) with absolutes enforced by an unrelenting machine controlled by some faceless bureaucracy which is also partly under the command of the government. There should already be enough dystopian sci-fi to convince everyone why that is a really bad idea.

fleventynine7• 4 years ago

Right, but if they aren't going to follow best security practices and prove it (via a signed a hardware attestation of the running software that includes the transport key they want me to use to send them the data), then I'm not going to send them the data. That's my choice.

game-of-throws• 4 years ago

Strongly agree.

We've already seen shades of this in banking. After chips were added to credit cards, people started having their chargebacks denied because "our records show the card was physically present" (even if the charge originated in another country)

How long until companies try to deny responsibility for data leaks because "our records show Windows was fully up-to-date and secure"

hedora• 4 years ago

Strongly agree, but even if you are wrong on all those points, I still don't want to be forced to run the same exact monoculture software as everone else.

Good luck getting your x86-64 windows kernel + chrome JavaScript exploit chain to run on my big endian arm 64 running Linux and Firefox.

(Also, the existence of competition like that regularly forces all the alternatives to improve.)

matheusmoreira11• 4 years ago

You cannot own data except what resides on your own property. Once you give someone a copy, it is theirs to do with as they wish.

Completely agree. These outdated notions of information ownership are destroying free computing as we know it. Everything "hacker" stands for is completely antithetical to such notions.

dap2• 4 years ago

It's not necessarily "you" vs. "someone else". You could be one person with two computers and want one computer to be able to attest to the other computer something about its software. (Imagine it's not two computers, but a thousand computers that are exposed to both physical and network attacks.)

nousermane2• 4 years ago

Let's say I'm a healthcare provider, and I'm about to send sensitive medical data to a third party vendor.

Let's say I'd like mandatory disclosure on shenanigans like that, so I can avoid this healthcare provider.

revolvingocelot• 4 years ago

Right?! It's telling that that's the use case: "what if we want to securely exchange The New Oil for some sweet cash, without the chance of some other asshole honing in on our racket or the little people hearing about it?"

blkfnwbklfw3• 4 years ago

You already do have mandatory disclosure on shenanigans like that in the US. It's the boilerplate HIPAA agreement you sign when you first see a provider.

Good luck finding a provider that doesn't ship your sensitive medical data out to an EMR company though.

Rebelgecko2• 4 years ago

Can you even do paper prescriptions any more? I've only had digital ones my entire adult life.

Quick edit to answer my own question: In my home state paper prescriptions are only legal in a few situations (if it's for an animal, glasses, justifiable emergencies). However in some parts of the country they're still possible. Even if I had a choice, I prefer the convenience of sending the data digitally- once you actual fill the paper prescription CVS or whoever is still gonna be able to glean sensitive medical info, so you're just delaying the inevitable.

csomar• 4 years ago

Wouldn't you prefer that this data only be able to be decrypted by a computer that can prove to the world it booted a clean OS image with all the latest security patches installed?

Yeah, because transferring that data into another machine is an impossible task.

That's the stupidest argument I heard today...

fleventynine7• 4 years ago

Admittedly it is a simplified scenario for the sake of argument. You'd need to have a full attestation of everything that controls access to the data (including ACLs) to get much of a guarantee.

But in a future world it's not hard to imagine the vendor software running in some sort of SGX-like environment that is very difficult to manually extract the data from.

pdonis• 4 years ago

Let's say I'm a healthcare provider, and I'm about to send sensitive medical data to a third party vendor. Wouldn't you prefer that this data only be able to be decrypted by a computer that can prove to the world it booted a clean OS image with all the latest security patches installed?

No, because this still doesn't mean my data is secure. A human can still go into the third party vendor's system and see my data, and if that human wants to steal it, they can. No amount of remote attestation will prevent that.

Remote attestation gives more control to the owners of data to dictate how that data is processed on third-party machines

Oh, really? So every time my health care provider wants to send my data to a third party, a remote attestation confirmation box will pop up on my phone so I can say yes or no, or ask more questions about the third party vendor's computers?

Ultimately the problem here is trust, and trust is a social problem, and as the saying goes, you can't use technology to solve a social problem. But you sure can pretend to be using technology to "solve" a problem in order to get people to give up more and more control over their devices.

grishka6• 4 years ago

Wouldn't you prefer that this data only be able to be decrypted by a computer that can prove to the world it booted a clean OS image with all the latest security patches installed?

I trust myself more than I trust anyone or anything else. It's as simple as that. I don't even slightly trust Microsoft, Google, or Apple.

Your logic is built on an invalid premise that these companies can, in fact, be trusted.

Remote attestation gives more control to the owners of data to dictate how that data is processed on third-party machines (or even their own machines that may have been compromised).

This is exactly what I want to avoid. It's my device. It should only ever serve me, not anyone else, including its manufacturer and/or OS developer. It should not execute a single instruction that isn't in service of helping me achieve something.

Also, the concept of ownership can simply not be applied to something that does not obey the physical conservation law, i.e. can be copied perfectly and indefinitely.

fleventynine7• 4 years ago

If I want to buy a device that can generate a proof I can share with others to increase their trust in me, you shouldn't be able to stop me. Implemented properly, these machines can still boot whatever custom software you want; you don't have to share the proof of what booted with anyone.

thrown_22• 4 years ago

Hardware-based attestation of the running software is an important security feature, especially in a world where data leaks and identity theft are rampant. Let's say I'm a healthcare provider, and I'm about to send sensitive medical data to a third party vendor. Wouldn't you prefer that this data only be able to be decrypted by a computer that can prove to the world it booted a clean OS image with all the latest security patches installed?

I'd prefer it to not be run a computer which has already been compromised with a UEFI rootkit which is what trusted computing has gotten us so far.

dap2• 4 years ago

These primitives can be used to tell you when you're talking to a machine that has not been compromised with a UEFI rootkit.

matheusmoreira11• 4 years ago

All cryptography is important. Hardware attestation is no exception. The problem is who's using it, who owns the keys, who's exploiting who.

It's totally fine if it's used to empower and protect us, normal people. If we can use this with our own keys to cryptographically prove that our own systems haven't been tampered with, it's not evil, it's amazing technology that empowers us.

What we really don't need is billion dollar corporations using cryptography to enforce their rule over their little extra-legal digital fiefdoms where they own users and sell access to them to other corporations or create artificial scarcity out of infinite bits. Such things should be straight up illegal. I don't care how much money it costs them, they shouldn't be able to do it.

The problem is we have chip makers like Intel and AMD catering to the billion dollar corporation's use case instead of ours. They come up with technology like IME and SGX. They sell us chips that are essentially factory-pwned by mega-corps. My own computer will not obey me if it's not in some copyright owner's interest to do so and I can't override their control due to their own cryptographic roadblocks. Putting up these roadblocks to user freedom should be illegal.

userbinator7• 4 years ago

The problem is who's using it, who owns the keys, who's exploiting who.

The governments know this all too well; that's why they've been trying to ban cryptography, and it was (and I believe still is in many cases) classified as a munition.

mike_hearn6• 4 years ago

But that's not a good argument because SGX isn't something that empowers the Big Guys over the Little Guys. In fact it's the other way around - they took it out of their consumer chips and now it's only found in their server class chips. So companies can create RA proofs and send them to users, but not the other way around.

nitwit005• 4 years ago

You'd only be verifying the machine you sent the data to was up to date, but that is likely to be a file server or router of some sort. You'd need to validate the entire network that will touch the data.

While it might be theoretically possible to assert the whole network is up to date, the hospitals will definitely fail that check. There's all sorts of equipment the hospitals can't update for various reasons, such as aging radiology machines.

Schroedingersat4• 4 years ago

Let's say I'm a healthcare provider, and I'm about to send sensitive medical data to a third party vendor. Wouldn't you prefer that this data only be able to be decrypted by a computer that can prove to the world it booted a clean OS image with all the latest security patches installed?

I'd rather be able to access it without google or microsoft sticking their nose in.

I'd rather be able to combine it with my other data in whatever ways I see fit.

I'd rather be able to back it up in whatever way I see fit.

I'd rather be able to open it on a device that doesn't have a backdoor provided by the US government.

Because it's not microsoft'sor qualcomm's data, it's mine.

stefan_• 4 years ago

This crap hasn't worked and it will never work. Console vendors have built much stronger things than remote attestation but you know one thing stays true: if you sign crappy vulnerable code, you are just signing any code.

XorNot• 4 years ago

The reality though is none of this is "secure" except by extensive, massive collusion and centralization in society - and such a thing is implicitly able to be used against the people as much as it might be used for them.

The only reason such hardware is secure is because the resources required to hack it are large.

Basically, a sane system would be: two parties exchange their own TPM keys which they generated on device themselves. They agree to a common set of measurements they will use with their TPMs to determine if they believe the systems are running normally. They then exchange data.

What's happening instead: a large company uses its market position to bake in it's own security keys, which the user can't access or change. They then use their market position to demand your system be configured a specific way that they control. Everyone else suborns to them because they're a big player and manufacturing TPMs is complicated. They have full control of the process.

The essential difference is that rather then two individuals establishing trust, and agreeing to protocols for it - secured with the aid of technology, instead one larger party seizes control by coercion, pretends it'll never do wrong, and allows people to "trust" each other as mediated by its own definition. Trust between individuals ceases to exist, because it's trust provided you're not betrayed by the middle-man.

Weirdly enough, this is actually a big god damn problem if you actually work for any organization that's going government or security work, because the actual processes of those places tend to be behind whether or not they believe large corporate providers doing things like this are actually doing them well enough, or can be trusted enough, to be a part of the process. So even if you're notionally part of "the system" it doesn't actually make anything easier: in an ideal world open-source security parts would enable COTS systems to be used by defense and government departments with surety because they'd be built from an end-user trust and empowerment perspective.

So even the notional beneficiaries tend to have problems because a security assessment ends up at "well we just have to trust Microsoft not to screw up" and while the Head of the NSA might be able call them up and get access, random state-level government department trying to handle healthcare or traffic data or whatever cannot.

novok3• 4 years ago

IMO the entire remote attestation is an obfuscated dance about who has root, control and ultimately ownership over devices.

If vendors were plain about it, "attestation" wouldn't be a big deal: you do not own the devices, we do, and you lease it from us, maybe for a one time fee.

But companies know it won't actually fly if your plain about it, ESPECIALLY with large corporations and governments who will outright refuse to buy your services or equipment for many key things if they are not the ultimate controllers of the machines for multiple reasons.

rubatuga2• 4 years ago

No, that would be horrible for data portability, which is the reason many hospitals are locked into shitty EPR systems. If you are going to design a way to transfer data across healthcare providers, it better be as easy as sending a fax. Sheesh.

thwarted2• 4 years ago

Wouldn't you prefer that this data only be able to be decrypted by a computer that can prove to the world it booted a clean OS image with all the latest security patches installed?

This is a pretty bad example. The attack vector is rarely, if ever, the technical way the encrypted file is received or where it is decrypted. The attack vector is what happens after it's decrypted. You've given an encrypted file to a computer you've confirmed knows how to decrypt it "securely" (whatever that means). And after that, that clean OS image with all the latest security patches still enables, by design, the decrypted data to be used (read, manipulated, do whatever it is you sent it to them in the first place) and sent someplace else or copied to removable media.

chii2• 4 years ago

i dont think the attestation mechanism is wrong, but that the ability to perform remote attestation is going to be abused to lock in consumers (even if in some circumstances there's improved security using it).

no_time3• 4 years ago

Where are the pro-consumer advocacy groups from last time? EFF? FSF? They haven't even briefly mentioned the issue at hand.

dannyw• 4 years ago

Both groups are a shell of its former self, either sprouting unjustified clickbait or being silent on the dangers that matter.

oaiey3• 4 years ago

For them the battle starts when you cannot add your own root or doing silent attestation. Before this is a reasonable feature.

public_defender3• 4 years ago

Being able to potentially play 4K Blu-ray Discs on your PC again.

We cannot do this now because user-hostile vendors have locked the functionality away from us. I think this is a perfect microcosm for the whole tradeoff: lock away the rest of your userspace and we might let you watch the new Batman DVD you already bought.

kuschku• 4 years ago

I can watch 4K bkurays just fine on my PC, with the hacked firmware for my bkuray drive and the proper decryption keys.

matheusmoreira11• 4 years ago

we might let you watch

This choice of words perfectly captures the arrogance of these copyright corporations. Who are they to dictate how our computers work just to maintain their irrelevant business model? They're ones who should be playing by our rules, not the other way around. It makes me wish piracy was as bad as they make it out to be, to the point it kills them.

public_defender3• 4 years ago

It feels like they've been trying to shove variations on the celestial jukebox down our throats forever. Supply chain integration is definitely how they could win. I can see it now, DIVX on the desktop.

oaiey3• 4 years ago

Why you assume artists cannot define how you consume media they created? Yes they royally screwed up, but it is their product. They define how they sell it.

Just to be clear: I hate how movies are currently distributed.

alexhsamuel2• 4 years ago

The problem isn't the capability of remote attestation. The problem is who's using it, i.e. who's defining what "security" means. As noted above, for a company, "security" often means intentionally inhibiting my freedom, not actually securing anything I care about.

We would benefit from a better public discussion of what "security" encompasses. Else, we risk conflating "what MS wants me to do with my computer" with "preventing hackers from stealing my credit card number".

Imagine a world where you could submit personal information to a company, with the technological assurance that this information would not leave that company... and you could verify this with remote attestation of the software running on that company's servers.

userbinator7• 4 years ago

That's a classic "road to hell paved with good intentions". The approaching reality is more like:

Imagine a world where to be allowed to use the Internet you will be mandated to run certain software, which reports your personal information to a company you are obligated to use, and whose use of that information is absolutely something you do not want.

Yes, the problem is indeed "who's using it". Unfortunately you aren't going to be able to decide either, and it will certainly be used against you.

alexhsamuel2• 4 years ago

Indeed! My imagination was tongue-in-cheek; we're never going to get that.

nonrandomstring• 4 years ago

The problem is who's using it, who's defining what "security" means?

Ask that question every time you see the word "security" written. There is no such word as bare security.

- security for who?

- security from who?

- security to what ends?

Much of the time security is a closed system, fixed-sum game. My security means your loss of it.

ChadNauseam• 4 years ago

Can you give some examples?

django_hero2• 4 years ago

It can be used to heavily track user around the web.

mike_hearn6• 4 years ago

"Imagine a world where you could submit personal information to a company, with the technological assurance that this information would not leave that company... and you could verify this with remote attestation of the software running on that company's servers."

That world already exists, it just doesn't get used much. You can do this with Intel SGX and AMD SEV.

The obvious place for this is blocking cloud providers from accessing personal data. For example, it could be used to resolve concerns about using US based services from Europe, because any data uploaded to such a service can be encrypted such that it's only processed in a certain way (this is what RA does).

RA gets demonized by people making the arguments found in the sibling comment, but they end up throwing the baby out with the bathwater. There are tons of privacy, control and decentralization problems that look intractable until you throw RA in the mix, then suddenly solving them becomes easy. Instead of needing teams of cryptographers to invent ad-hoc and app specific protocols for every app (which in reality they never do), you write a client that RAs the server to check that it's running software that won't leak your private information as part of the connect sequence.

account426• 4 years ago

The obvious place for this is blocking cloud providers from accessing personal data. For example, it could be used to resolve concerns about using US based services from Europe, because any data uploaded to such a service can be encrypted such that it's only processed in a certain way (this is what RA does).

This will not work because the concerns about US based services are legal ones due to access requirements by the US government which cannot be solved by technical restrictions while still complying with those requirements.

robot3• 4 years ago

Remote attestation or not, "Software freedom" fighters should understand that things happen based on some user base need. Somebody needed this and they added it, whoever needs it doesn't care if they can't run linux on it. If the user cares about running anything else on the hardware, they will add a way to disable the feature. it is all about the user need.

if you are a secondary priority user on some hardware, the way to fix it is to focus on becoming important enough to be prioritized instead of fearing some technology will limit things.

grishka6• 4 years ago

things happen based on some user base need

Of course not. Things happen based on what investors and developers want. Users are very much secondary. They're a nuisance. If things did really happen based on some user-base need, would we have had Instagram or Facebook in their current form?

Rebelgecko2• 4 years ago

I think so? FB exists in its current form because they're worried about users preferring TikTok

robot3• 4 years ago

There is some kind of balance since both of those are free. I'm sure they prioritize user engagement and any loss of users is inadvertent.

MereInterest2• 4 years ago

Somebody wanted this, but it might not be a user, and it might not fill any user need whatsoever. If I am the primary user of the hardware, my wants take precedence over anyone else, including the manufacturer and the software vendors.

robot3• 4 years ago

agreed, your wants take precedence. If there are enough buyers like you who care about hardware freedom they'll drop this feature.

blendergeek• 4 years ago

"Software freedom" fighters should understand that things happen based on some user base need.

I wish that were true. However, I think the movie Tron (1982) sums this up very nicely.

From the movie Tron:

Dr. Walter Gibbs: That MCP, that's half our problem right there.
Ed Dillinger: The MCP is the most efficient way of handling what we do! I can't sit here and worry about every little user request that comes in!
Dr. Walter Gibbs: User requests are what computers are for!
Ed Dillinger: Doing our business is what computers are for.

We are now moving toward a world where all computers have a "MCP". No, it is not to solve user problems, it is to do the business of the corporations that designed it.

jauer3• 4 years ago

This. All these comments (and this article) worried that this is MS coming to take their Linux or whatever are missing that this is something their biggest customers want.

We need this in our corporate client device fleet to counter specific threats. We need this in our servers for the same reason — we do remote attestation today for Linux servers in semi-trusted locations. We’ve conveyed to our vendors that this is a desired capability in next-gen network equipment.

We’re not doing this to control data once it’s on an end-user’s computer. We’re doing it because we have a regulatory (and moral) obligation to protect the data that is entrusted to us.

We’re not Intel/AMD/NVIDIA/etc’s largest customer, but when we defer orders or shift vendor allocation it gets mentioned in their quarterly earnings reports. They tend to listen when we ask for features, and when our peer companies (not to mention governments) ask for the same thing because we have similar data security requirements?

Cloud and Business products is what, ~2/3rds of Microsoft’s revenue at this point? This isn’t being driven by the MPAA or whoever looking for better ways to screw over consumers.

userbinator7• 4 years ago

We’re doing it because we have a regulatory (and moral) obligation to protect the data that is entrusted to us.

The same insane regulations that were probably the result of corporate lobbying are now the excuse for these hostile features? WTF?

novok3• 4 years ago

I think if owners of devices have ultimate control over the root key / credential that determines attestation, I don't think people care about that.

So in your case, for devices you buy, you set up your corporate TPM key as the root owner, and then you send the device to employees, vendors, etc. The ownership chain is clear and you can send attestation requests. The corp is the owner of the device, and that is fairly obvious.

The issue is when people and corps buy devices, they do not have effective root. Microsoft, apple, google, etc have the tpm root key, and you as a corporation actually do not have root yourself. They can force you to do things you want to do. It makes you more vulnerable, because if it is in MSFTs interest (or they are coerced by the state to do so clandestinely) a lot of threats can happen, and you don't even need an 0day to do so!

If it starts becoming status quo, the freedom to do the things you need to your devices starts going away.

matheusmoreira11• 4 years ago

This isn’t being driven by the MPAA or whoever looking for better ways to screw over consumers.

Then they should prove it. I'm sure they have lots of expensive lobbyists under their employ, have them go to the government and tell the politicians the computer industry needs regulation to make it illegal to screw over users by depriving them of their computer freedom. If effective rules make it into law, I will trust their intentions.

66fm472tjy7• 4 years ago

We need this in our corporate client device fleet to counter specific threats

Can you please expand on what you verify via remote attestation and against which attack vectors this protects you?

Does this protect you against the usual attack vectors of your employees logging in on phishing sites, downloading malware, running office macros etc? Stealing your data usually does not need any root/kernel access.

salawat7• 4 years ago

We’re not doing this to control data once it’s on an end-user’s computer. We’re doing it because we have a regulatory (and moral) obligation to protect the data that is entrusted to us.
Cloud and Business products is what, ~2/3rds of Microsoft’s revenue at this point? This isn’t being driven by the MPAA or whoever looking for better ways to screw over consumers.

Except... Yes it is. When your Ur business case was "do computation on someone else's computer, but ensure the operator cannot have full transparent access to their own computer's operational details", you are in the end casting the first stone. Just because I don't have an LLC, or Inc. or other legal fiction tied to my name, doesn't mean I'm not bound by the same moral imperatives you claim to be, but more importantly (I am not willing to sell everyone else's computational freedom up the river for a pole of quick bucks).

Get your collective heads out of your arses. Get back out in the sun. This nonsense is ripping every last bit of potential computing ever had and ripping it out of the hands of the lay consumer unless they dance the blessed dance of upstream.

You do not know best. You think you do. You've gotten where you are without that which you seek to create, and once created, that which you make can and will never be taken back. It creates and magnifies too much power asymmetry.

My god, have you never really stopped to think through the ethical implications? To really walk down the garden path?

matheusmoreira11• 4 years ago

"Somebody" means billion dollar corporations that already have way too much power over people. Their ability to want and actually realize this bleak attestation future needs to be regulated out of existence.

cesarb3• 4 years ago

Somebody needed this and they added it, whoever needs it doesn't care if they can't run linux on it.

Originally, the ones who "needed" features like this this are the big content distributors. Without these features, it's too easy for normal people to extract content and give copies of it to their friends and family.

As a parallel development, another one who "needed" features like this is Microsoft, for a different reason. They were taking reputational damage from malware, and needed a way to prevent malware from running before their operating system kernel (malware loading after the operating system kernel could be contained by the normal security mechanisms like ACLs).

These two development threads had enough in common that they ended up merging together, and those who want to prevent copying content can now point to security as an excuse. And yes, neither of these two groups care if you can't run Linux on your own devices.

if you are a secondary priority user on some hardware, the way to fix it is to focus on becoming important enough to be prioritized instead of fearing some technology will limit things.

I fully agree that this is our best defense. In fact, the only reason we can still run Linux on our desktops and notebooks is that, when SecureBoot was developed, Linux was already important enough. However, this could only happen because Linux had time to grow and become important enough (while being a "secondary priority user" of the hardware) before things started to become limited. Had SecureBoot come before Linux became important enough, running third party operating systems would not have been allowed, and Linux would not have had a chance to grow and gain importance.

jstanley2• 4 years ago

malware loading after the operating system kernel could be contained by the normal security mechanisms like ACLs

If this were true, how would the malware ever get itself to the point where it is loaded before the kernel is?

walterbell5• 4 years ago

Prior thread, https://news.ycombinator.com/item?id=32234561

On-premise, open-source, customer-owned remote attestation servers are possible. Avoid outsourcing integrity verification to 3rd-party clouds.

With owner-operated OSS MDM & attestation servers, PCs can have diverse, owner-customized OS and configs, reducing monoculture binary blobs.

userbinator7• 4 years ago

PCs can have diverse, owner-customized OS and configs,

...which won't be able to interact with any of the walled gardens which will be enabled by these same technologies.

walterbell5• 4 years ago

That cuts in both directions. If sufficiently large customers run their own attestation servers, the discussion moves from binary yes/no attestation to the details of interoperable measurements, single-purpose OS components and provable security vs vendor lock-in.

Walled gardens care about including their large customers, so it's not as simple as locking them out. There is also an ongoing EU legislative effort to mandate digital platform interoperability, which will likely apply to attestation.

modshatereality• 4 years ago

This "security" feature confuses the hell out of me. HOW in the sam hill are they going to prove every process running with privileges is in a "secure" state, how can that be possible? Even with constant wasteful memory scans there could be data files that evade micro-brother. So what if it booted in an authentic manner, the user could have tampered with any number of privileged processes, and the second they opened one of THREE web browser engines and ran some unknown 3'rd party advertisement code all bets are off. Not even going to get into malicious firmware/drivers that microsoft will happily sign (see: lenovo superfish, or razer driver menu privilege escalation for recent examples). This is more security theatrics from the same old players, when will it stop? When will all you supporters see what is happening? This is more about operational control than security; it makes me sick to see so-called hackers supporting such an obvious trap. Yall need to dump your shares and join the right side of history because it only gets worse until the weight of oppression ignites a revolution. If you're still holding, think about what is the next "security" frontier after you let them have this? Require every program on the OS, and then every website to sign javascript with cryptographic keys they don't have root control over? GTFO board room members, you're drunk. You want to throw out our freedoms just because microsoft and intel designed a garbage (UEFI) spec that doesn't have a way to physically prevent writes, and damn near requires you to use an ancient FAT filesystem? WHY WOULD YOU TRUST THEM NOT TO BOTCH THIS ONE TOO?

heavyset_go4• 4 years ago

"Secure" doesn't mean secure for the user, it means that the interests and revenue streams of platform providers are secured.

outworlder• 4 years ago

Some video games are already requiring Secure Boot and TPM on Windows 11.

Great...

Just now that we have Proton, Vulkan and other technologies allowing us to seamless run an incredible number of Windows games, we are going backwards and locking down again. That's even assuming we'll be able to run other operating systems. Because why stop at remote attestation? Force secure boot because, hey, noone is using other operating systems anymore since all cloud providers are requiring remote attestation.

YeBanKo2• 4 years ago

Attestation is great for cloud computing. Horrible for user devices.

capdeck2• 4 years ago

Attestation is great for consolidating power and eliminating competition. As far as the cloud goes - you will only be able to use AWS, Google or Azure, because they will have proper certificates and attestation. Browser support will be built for "big three". For all the others there will be a fee for said certificates which will increase barriers to entry, and there will be even less competition and choice. Existing cloud providers will be the only game in town, just like it is with mobile operators and cable companies.

YeBanKo2• 4 years ago

Here is an example of contact discovery protocol by Signal using remote attestation [1]. Client itself can ensure that the code running on the server is authentic. It is computationally insensitive, but beneficial to the end user.

[1] https://signal.org/blog/private-contact-discovery/

badrabbit• 4 years ago

Has this ever been challenged by reporting it to the FTC and consumer protection agencies in any country?

ece3• 4 years ago

DRM is separate from security when the user has control of what exactly they want to run and how much data it may collect.

RA is a shortcut companies are taking to market for privacy and security while not mentioning lock-in, network effects and DRM. When pressed, they will ultimately still say privacy and security aren't 100%.

That said, could a Linux distro come out with the same thing as these PATs using IMA/EVM/TPM/ME/PSP? Probably (Graphene has some support for RA, but I haven't looked in depth), and as long as Cloudflare had multi-platform support, and the implementation still allows letting me have control, I wouldn't see the problem. Bugs can be exploited by anyone with the know how, and I see no reason why I should give up control because companies want to take a shortcut instead of designing proper systems.

We see Epic has already said they won't support Linux because of anti-cheat, so that scapegoat exists, but there are other games that didn't go that route! Porting costs, and size of install base are real excuses among others, but anti-cheat is a BS excuse. No shortcuts by companies and no short cuts by platforms, but we know lock-in, network effects and DRM are too good to let go.

ece3• 4 years ago

To be clear, any OS can attest they're running signed kernel/modules, it says nothing about how determined an attacker is. If you just want some confidence a user isn't a bad actor, there are other ways of doing that.

tjpnz• 4 years ago

Why do I need Remote Attestation to enjoy 4K content when I can more conveniently pirate it?

taco99992• 4 years ago

See: https://xkcd.com/488/

Also, since a lot of different movie streaming services (e.g. Hulu, Disney+) have launched, a lot of content has moved off of Netflix, leading to a higher piracy rate.

django_hero2• 4 years ago

I totally agree. I don't want Microsoft controlling my devices. If Cloudflare starts giving this feature easily like by a click of a button, almost all website will start using it. Making web more difficult and useless to navigate.

bunnie3• 4 years ago

Is there any way we can make Remote Attestation providers liable for any losses incurred while using their services? Can we make it so that banks, record companies, and individuals can sue Microsoft or Google if their system doesn't deliver on the promise? If we still see cheating in on-line gaming even though all machines are attested, can we we get our money back?

I feel like part of the problem is that Remote Attestation providers get to have their cake and eat it too: they make a theme park, set up boundaries, and charge admission under the premise that it's safer to play in their walled garden than in a public park.

But if a bad actor slips through their gate and picks a few pockets or kidnaps a couple children, the operators get to say "not our problem, our services have no warranty -- read the EULA".

I feel like in the real world, if a park operator explicitly bills itself as "a safe place to play" it's their problem if someone goes on a crime spree on their property -- there is some duty to deliver on the advertised safety promise.

But somehow, in the software world people can control admission, control what you do and somehow have no liability if things still go off the rails. It's just a sucker's game.

Of course, I'd rather not see remote attestation happen, but maybe part of the reason it keeps creeping back is exactly because there is zero legal downside to making security promises that can't be kept, but incredible market advantages if they can sucker enough people to believe in the scheme.

saurik2• 4 years ago

If we still see cheating in on-line gaming even though all machines are attested, can we we get our money back?

The concept of remote attestation isn't somehow safer if it works perfectly, and it isn't clear to me that this is actually impossible to build (within an acceptable and specified liability constraint) as opposed to merely exceedingly difficult. I do relish the schadenfreude, though ;P.

Of course, I'd rather not see remote attestation happen...

Interestingly, the CEO of MobileCoin told me earlier this year that they were "going deeper on discussions with [you] to design a fully open source enclave specifically for [their] use case" (which, for anyone who doesn't know much about this, currently relies on remote attestation and encrypted RAM from Intel SGX to allow mobile devices to offload privacy-sensitive computations and database lookups to their server). I wrote a long letter to you a few days later in the hope of (after verifying with you whether that was even true or not) convincing you to stop, but then decided I should probably try to talk to Kyle and/or Cory first on my way to you (and even later ended up deciding I was stressed out about too many things at the time to deal with it)... does this mean you actually aren't, and we are all safe? ;P (I guess it could be the case that this special design somehow doesn't involve any form of remote attestation--as while my core issue with their product is their reliance on such, I went back through the entire argument and I didn't use that term with THEM--in which case I'm very curious how that could actually work.)

bunnie3• 4 years ago

Huh...maybe I didn't parse your comment correctly, but I just checked and I don't think I ever got an email from you on the subject? Totally possible I just bungled it, I'm terrible with names and my inbox is a dumpster fire :P

It's also interesting to see how the game of "telephone" works out when the message comes full circle. Mobilecoin did reach out to me, initially to see if I would write a whitepaper on SGX. After I told them I would be frank about all my opinions, the conversation pivoted to "well, if you could make something that fixed this problem what would it be?". Which I entertained by saying I think the problem may not be solvable, but whatever it was, it had to be open source; and "oh by the way let me tell you about my latest projects, perhaps I could interest you in those". To which it trailed off with a "I'll have my people call your people" and that was that, modulo a podcast I did for them about a month ago which surprisingly didn’t touch on SGX.

So: long story short, no, I'm not creating a solution for them, and I think remote attestation is both a bad idea and not practical. Is it worse than burning some hundreds of tera-watt hours of power per annum to secure a cryptocurrency? That is a harder question to answer: is climate change a bigger problem than remote attestation? The answer is probably obvious to anyone who reads that question, but no two people will agree on what it is.

To your point on RA being not impossible but possibly just exceedingly difficult – you might be right. My take on it is that remote attestation is only "transiently feasible": you can create a system that is unbreakable with the known techniques today; but the very "unbreakability" of such a scheme would cause ever more valuable secrets to be put in such devices, which eventually promotes sufficient investment to uncover an as of yet unknown technique that, once again, breaks the whole model.

Which is why I’m calling out the legal angle, because the next step in the playbook of the corps currently pushing RA is to break that cycle -- by lobbying to make it unlawful to break their attestation toys. Yet, somehow, they still carry no liability themselves for the fact that their toys never worked in the first place. I feel like if they actually bore a consequence for selling technology that was broken, they’d stop trying to peddle it. However, if they can get enough of society to buy into their lie, they’ll have the votes they need to change the laws so that people like you and me could bear the penalty of their failure. With that strategy, they get to decide when the music stops – as well as where they sit.

I'd like to see a return to sanity. Security is fundamentally a problem of dealing with people acting as humans, not of ciphers and code. Technology tends to only delay the manifestation of malintent, while doing little to address the root cause, or worse yet -- hiding the root cause.

mike_hearn6• 4 years ago

"Is there any way we can make Remote Attestation providers liable for any losses incurred while using their services?"

RA is a use-case neutral hardware feature, so it doesn't really make sense to talk about making providers liable for anything. That's an argument for making CPU manufacturers liable for anything that goes wrong with any use of a computer.

The sort of companies that use RA are already exposed to losses if RA breaks, that's why they invest in it to start with. Console makers lose money if cheating is rampant on their platforms for example, because people will stop playing games when they realize they can't win without cheating.

So what you're saying is, let's incentivize these already incentivized people to use RA even more, and moreover, let's strongly incentivize companies that don't use it to start doing so. Because if you think governments will say "oh, you didn't use the best available tech to protect the kids, fair enough no liability" then you're not very experienced with how governments work! They will say "you should have used RA like your competitors, 10x the fine".

mindslight5• 4 years ago

IMO this just seems like bargaining and hoping for a just world where the law actually applies equally and constrains too-big-to-fail actors. What would actually happen is various limits/exceptions would get written in, like as long as you used "proper" software (read: microsoft) and did "proper" audits (read: tediously check moar boxes) then you could pass that liability onto someone else or have it be "nobody's fault". We'd likely end up with the same software totalitarianism even faster, because companies would be even more incentivized to deploy cookie cutter centralizing solutions to escape the additional liability.

Never mind that you can't really put a dollar value on personal information to substantiate damages or even personal time spent dealing with the fallout from someone else's negligence, which is like one of the fundamental problems with our legal system.

(There's also the elephant in the room that one of the main industries clamoring for ever more "security" still continues to insist that widely-published numbers (ssn/acct/etc) are somehow secret.)

ece3• 4 years ago

Perhaps incentivizing better methods is more helpful than an outcomes in this case.

tgsovlerkhgsel• 4 years ago

That feels like making a bike lock manufacturer liable if someone uses an angle grinder and steals your bike anyways.

In practice, both a good bike lock and remote attestation raise the bar against attacks significantly, without providing 100% security.

ThePowerOfFuet• 4 years ago

Published by Gabriel Sieben
Gabriel Sieben is a 20-year-old software developer from St. Paul, MN, who enjoys experimenting with computers and loves to share his various technology-related projects. He owns and runs this blog, and is a traditional Catholic.

Well isn't that something, someone who writes blog posts proselytizing the importance of individual freedoms while also making sure his readers know he's a "traditional Catholic".

The level of cognitive dissonance is impressive.

naikrovek• 4 years ago

without any negative meaning whatsoever, I wish I had 1% of the confidence today that this 20-year old person has.

I do not agree with this person's conclusions on any article they've self-promoted on this site, but their self-confidence is unparalleled.

UltraViolence• 4 years ago

I really wonder if we need to be concerned at all about this. In the end people are always able to vote with their feet. We've seen this happening with SACD (Super Audio CD), the successor to the CD which had unbreakable encryption. People ended up simply ignoring it. Today, you can buy HiRes audio files without DRM of any kind online. These files have mostly been ripped from SACD's with their unbreakable encryption. The record companies thought they might as well sell them online, lest they become worthless.

If people feel they're being hampered too much by Windows' DRM they'll most likely switch over to some RISC-V processor from some Chinese company. I'll bet you that if that happens Microsoft will flush Pluton down the toilet before you can say "Clippy." It simply isn't worth it to them. Sure they want to lock in their customers even more, but as soon as they start leaving in droves they'll swiftly move to stem the outflow.

account426• 4 years ago

The only reason SACD failed and you can buy DRM-free music today is because people were concerned an pushed back hard against that crap.

Remote Attestation is coming back

Related Stories