German government warns Windows 8 is a security risk

http://www.zeit.de/digital/datenschutz/2013-08/trusted-computing-microsoft-windows-8-nsa

by reirob • 13 years ago

172 119 13 years ago

reirob4• 13 years ago

This leads to a German article. Sorry I did not find any English article on this topic yet. So here the short summary (actually my translations of selected passages):

[German] government experts warn, Windows 8 is an unacceptable security risk for governmental offices and companies. The so-called Trusted Computing might be a backdoor for NSA.

[..]

According to their [expert's] opinion the operating system contains a backdoor which cannot be closed. This backdoor is called Trusted Computing and might have the consequence that Microsoft could control every computer remotely. And therefore NSA could do it as well.

[..]

Three points are decisive: First the [new] TPM, in contrary to the existing standard, is active from the time when you switch on the computer. As soon as you start the computer you cannot decide anymore if you want Trusted-Computing (Opt-in). Secondly it is not possible to deactivate in future the TPM (Opt-out). Third the OS takes over the control over the TPM, in the case of Windows OS it means that the computer is controlled by Microsoft.

----

In the light of the current situation on spying, I have to say that I am happy that it goes in this direction.

ukdm• 13 years ago

Translated version: http://translate.google.co.uk/translate?sl=de&tl=en&js=n&pre...

digitalengineer2• 13 years ago

If what Snowden showed us is true, the same thing for the (recent) versions of MacOsX. I'd say things are looking up for Linux on the desktop.

pktgen2• 13 years ago

Can you elaborate on the OS X issue (I think I've missed that disclosure)? Everything I can find, which admittedly is not anything authoritative (nothing from Apple directly), says that Apple hasn't shipped TPMs for a few years now.

dotdot• 13 years ago

Being unable to read German I can't comment fully on the original article, but based on this summary this warning seems pretty silly.

The operating system kernel always has full control over the system, how are they suggesting the TPM adds control here? The TPM is a small chip that handles certain crypto operations more securely (especially key management), how does this provide any additional backdoor scenarios?

If Microsoft wanted a backdoor it could easily be added to the OS without a TPM.

fetbaffe• 13 years ago

If I remember my German correctly the articles argues around many different points.

One is spying (NSA), another is restrictions on what to install (Microsoft) and some parts discuss the threat from China, manufactures of the TPM chips.

polymatter• 13 years ago

If Microsoft wanted a backdoor it could easily be added to the OS without a TPM.

Without a TPM, it is possible to detect and remove (or more likely mitigate) a backdoor. With the TPM, even if you know about a backdoor and have a patch you can not apply it without Microsofts blessing. At least, thats my understanding.

anologwintermut• 13 years ago

This is about the TPM in windows 8. It's the same argument about treacherous computing that goes around, except the article seems to be suggesting people think it's a extent problem now because the TPM is always on, not a hypothetical in the future/ Microsoft's long term plan. Further, there is a nebulous assertion linking this to the NSA.

1) The TPM still can't control your computer(yet). It can only measure it's state, allow you access to keys you created in some state, and attest to things about the state (which would allow other parties to mandate what state your system is in when interacting with it, but presumably those entities would be bond by German law and likely be German themselves)

2) If Microsoft wanted to backdoor your system, they don't need the TPM to do it. In fact, the TPM can be used to protect against a whole bunch of malware that various intelligence agencies might use: it can protect keys with passwords (with rate limiting/self destruct for guessing), make sure the system is in the same state(i.e. malware free) when you created you PGP key as it is when your using it to decrypt an e-mail, and it can isolate an application from the rest of your system.

reirob4• 13 years ago

Your second point is exactly what the German government is afraid of according to the article. According to the article there seem to be security vulnerabilities on 3 levels in TPM 2.0, which might be used by intelligence agencies - the article states NSA and China who is actually producing most of the TPM chips.

TazeTSchnitzel• 13 years ago

Bundestrojaner.

abcd_f• 13 years ago

If Microsoft wanted to backdoor your system ...

... they already have Windows Update. It cannot be null-routed (respective entries in /etc/hosts are simply ignored), it is virtually always on and it can be trivially used to deliver custom patches to specific boxes. What more can you ask for?

TheAnimus• 13 years ago

What if you disable it? Doesn't it respect that setting?

acqq7• 13 years ago

You are right that MSFT has the "update". The bigger problem with Windows 8 computers is that similar things are in practice available to all the "third parties" who have hardware or kernel-driver components. And you have less control than before about them all. It's a broader problem than just Microsoft.

The new "you as the user can't control the kernel stuff, even with the debugger" concept is really about the user (you) giving up the control. The excuse is that you as the user aren't supposed to be able to copy movies. In practice, you have no more control of your own computer whereas the companies have real-time control even of the content by directly controlling your computer. Some routers already did such stuff. It is really worrying -- having the part of the "great firewall of China/whateverothercountry" on your own computer which you paid with your own money.

simonh• 13 years ago

Who says the original windows binaries don't have backdoors in them? So far as I can see the only difference TPM makes is that it potentially opens vulnerabilities in non-MS operating systems you run. If you're running any version Windows, or in fact any software you don't compile yourself from source(1), you just have to trust on faith it's not back-doored up to the eyeballs from the get-go. This has always been true.

(1) And in fact also have total confidence in the compiler itself: http://scienceblogs.com/goodmath/2007/04/15/strange-loops-de...

acqq7• 13 years ago

I have a Windows 8 notebook and for the first time in my life I have no control over my own general purpose computer:

- I can't enter BIOS before entering OS.

- Once I enter the BIOS from the OS I can't activate the hard disk password.

- I can't install the Windows 8 OS clean. The MSFT has the deal with the computer producers that doesn't allow them to deliver the pure OS medium, you can only backup the already present installed files to some external HDD.

- Because of the previous and the fact that the binaries are controlled on the hardware level (TPM), I have no control of what's running on my computer -- I can't know, to be precise.

- It's even worse than that, there is some Intel built-in technology on the hardware/BIOS/drivers level which also has built-in "features" that allow communication with some external "command and control center" which I don't control. It supposedly allows, among other "features" disabling the notebook once it's stolen. But I don't control how it's done, and I don't know if it has additional backdoors. It proudly claims to facilitate "remote access."

It's scary how it looks like all together. I haven't even figured out how I'd be able to install Linux on the computer. In some forums people claim that the OEM should allow that, but apparently a lot of people haven't managed to actually install it on different specific computers -- there are BIOS problems that can't be avoided, and the OEMs don't give you support or the updates. Mine is an Intel i5 processor-based modern Acer. It's fast, but I have no control. Definitely not FUD.

Personally I like Apple approach more: thanks to their approach of the OSX or iOS (no third party pre-installed crap) at least I have to just trust Apple. Here I have to trust Microsoft, Intel and every company who has the drivers on my machine. Much more chance for some of them to do what they want, in the name of "cloud." Remember routers that are controlled from the producer of the router, even "protecting" you from browsing all the sites? Remember Android phones which upload all your passwords to the cloud of the mobile operator? That's where the "cloud" support of the driver writers goes now. It is scary.

(Globally, we're talking about this: http://xkcd.com/743/ -- We've been giving up the control of "infrastructures" for a long time)

btb• 13 years ago

What brand notebook is that? Just so I can make a mental note to avoid purchasing that brand in the future :)

ZanyProgrammer4• 13 years ago

I had Windows 8 RTM installed on an old ThinkPad that I eventually wiped clean and put Ubuntu on. Granted its not a new laptop with Windows 8, but still, its not impossible to install Linux on a Win 8 laptop.

ZanyProgrammer4• 13 years ago

My roommate bought a Windows 8 equipped Asus a few months back and installed Mint on it. Seriously, Google 'How to install Linux on a Windows 8 laptop' sometime.

polskibus• 13 years ago

can anyone elaborate on TPMs, what are they, why are they the risk in MS case etc.?

jlgaddis• 13 years ago

http://en.wikipedia.org/wiki/Trusted_Platform_Module

josteink2• 13 years ago

Key point: "Trusted" in this sense refers to trust to an external entity and not the owner or user of the actual computer, which ironically is not trusted to have full access to all things on the computer.

The biggest problem is that the "trusted" party which has full access is almost certainly under NSA/PRISM jurisdiction and can be forced to do things which most people would find objectionable.

grobmeier• 13 years ago

2013, it's the post-snowden era. We don't have a cold war any more, but the level of spying is unbelievable. I am currently moving out my emails from GMail and installed PGP. At the moment I am using OSX since I do for years. But in the end the only "safe" way to protect your business and privacy is to use Linux/Unix. The FSF said it for years; the german CCC told us for years. I admit, I didn't believe it's so bad. I always thought: good there are a few of us paranoid, they take care there is a balance.

Now we see, there is no balance. Good we have had these paranoid people because they are now providing us a chance to opt-out.

Good there were these programmers who worked for years and often in their prime time in free and open solutions like GNU/Linux. Snort, the intrusion detection system. GPG. And so on.

For me it is a hard job to opt-out of being spied. But I will move on, step for step. Email privacy is the first; no GMail, no Apple Mail. Old friend Thunderbird/Enigmail it is. I also installed TrueCrypt.

The biggest move will be to change the OS (again). Guess it takes me months or longer as I have a lot of great OSX software. But on the other hand, I can simply set up a new machine for private tasks - or dual boot my macbook with Linux.

I hope my government will take this warning serious and support more "Linux @ City" projects (Munich runs on Linux and Open- or LibreOffice).

Wow, long comment. I just needed to say. I am worried.

greyman• 13 years ago

What portion of people you communicate with email were you able to convince to use PGP with you?

My understanding is, that there isn't an email privacy, since at least they will have your metadata. In my limited understanding, secure communication is to be done using some secure chat service.

petera2• 13 years ago

For most contacts you just move away from people who don't use secure communication and may compromise you in the future, no need to convince someone. Works for me.

bad_user3• 13 years ago

The important first step is to give the option of encrypted communications to people that want it. Also, not all email is sensitive, and you can convince the people that matter, e.g. coworkers, friends, family.

I'm also fairly sure that Google will start integrating PGP into their desktop clients (Android, iOS) because this is affecting their bottom line (just wait until governments will start banning Gmail usage in the public sector).

progman3• 13 years ago

It is even worse. The attempt to escape into OSS/Linux is a step in the right direction. But as long as we are dependent on mass consumer hardware then there is always a risk of being spied through hardware backdoors. In this case it doesn't matter which software we use. Even encryption is useless. It is NOT enough to avoid Windows 8 because the real problem is modern hardware that uses Trusted Computing chips.

Trusted Computing (TC) is way more dangerous than classical hardware backdoors. I consider TC an evil technology because it not only takes control away from the user but it even allows to inject faked evidence into computers which could make innocent people -- independent journalists, political activists etc. -- suspect to crime.

TC could also be used to delete evidence from computers of journalists who would have no power to keep it. TC allows to control people without letting them even know about it. TC is a huge danger for freedom of speech. It should be banned politcally and boycotted in business. My recommendation: Don't buy consumer hardware but use embedded Linux systems with bare bone technology.

If we want to be truly secure from being spied then we must do a complete restart with new hardware and software from scratch. There is no way around.

I am actually "glad" about the NSA scandal (thank you Snowden) because it woke people up and made them aware of the reality of global surveilliance, and about the huge threats of Trusted Computing. NSA should be controlled by the people of the United States but obviously it has become out of control. This single NSA case has silenced the mouth of the conspiracy mockers once and for all.

knowaveragejoe• 13 years ago

silenced the mouth of the conspiracy mockers once and for all

Before the Snowden leaks, you'd be hard pressed to find a technically-minded person arguing that the NSA doesn't have, at the least, the potential to have their fingers in every pie.

thaumasiotes2• 13 years ago

TC could also be used to delete evidence from computers of journalists who would have no power to keep it.

Since Amazon deleted all those copies of 1984 from everyone's Kindles, I don't keep mine connected to the internet. If you have data, you can keep it. Keep it on your own devices.

64598u3wieodsk• 13 years ago

Thanks for your insight. I completely agree. Can you recommend any tutorials and secure hardware components?

marvin2• 13 years ago

Do you have any more information about the use of Trusted Computing/the Trusted Platform Module to remotely run arbitrary code on a victim's computer? This is news to me.

Spearchucker2• 13 years ago

I have no intention of moving away from Windows 8. I do, however, have a laptop that never connects to a network. Ever. It's where I keep things I consider private. Data transfer, minimal as it is, is done using swivel-chair integration.

Everything else (i.e. all my remaining devices and apps on those devices) are treated like any PC in an Internet café - untrusted and compromised.

T-hawk• 13 years ago

How do you back up the private data on that laptop?

ihsw• 13 years ago

We don't have a cold war any more

We absolutely have a cold war, except, rather than a continuously increasing stockpile of nuclear weapons, we have a continuously increasing stockpile of zero-day exploits.

Another hallmark of the cold war is escalation and regional hegemony, and consider that draconian spying legislation is disseminating from the USA to her vassal states -- Canada, UK, Australia, NZ. Similar technology and legislation is being deployed in other major world players under the guise of fighting "terrorism," but it stands to reason that it's in response to Chinese espionage/reconnaissance.

The USA has a very serious rivalry with China, and vice versa. We can expect to see the USA trying to further compete with China by trying to level the playing field across a variety of fields. The TPP and the F35 Joint Task Force are shining examples of attempts to curry favour with fellow nation states.

thaumasiotes2• 13 years ago

The USA has a very serious rivalry with China, and vice versa.

Can you say more about this? Are we afraid of them doing something to us? What? Are they afraid of us doing something to them? What?

pilif2• 13 years ago

So because Windows 8 has support for trusted boot and friends that might (it's pure speculation) contain a backdoor, it's less secure than previous versions that did not support trusted boot at all?

I agree that the NSA spying is a real threat, but so is traditional malware. The article is basically saying that, because the malware protection is not good enough (i.e. not securing against NSA malware), it's worse than no protection at all.

FUD.

I do agree that locking down the OS so that it runs only MS-signed applications is a dick move in general and we'll probably see really bad changes in the market overall, but I see no relation to the NSA spying issue. The NSA can install malware as well on XP machines as it can on Windows 8 machines, so in that regard, Win8 is no better nor worse than previous versions.

(also: I really don't intend to be trolling and my argument seems reasonable. As such I wonder what the reason for the downvotes is. Is it possible that you guys are getting an english article with a different content? If I click the link I get to see a german article)

SideburnsOfDoom• 13 years ago

that might (it's pure speculation) contain a backdoor

Maybe, just maybe we have come to the point in time that unless a system has been shown to be secure, it should be assumed to be wiretaping the user. We can no longer assume secure until proven insecure.

FUD.

Absolutely. This is what the reputational damage to american firms like Microsoft looks like. Why the hell should their systems be trusted now?

pilif2• 13 years ago

Maybe, just maybe we have come to the point in time that unless a system has been shown to be secure, it should be assumed to be wiretaping the user. We can no longer assume secure until proven insecure.

I 100% agree. But I really fail to see how this makes Windows 8 a worse operating system in that regards than its predecessors. A system that provides no trusted computing support is equally easily hacked by the NSA as is a system that does support trusted computing. The latter does have the benefit of making hacking significantly more difficult for everybody but the NSA, so I would say it's still a net positive and not a huge negative which the article makes it out to be.

Security-wise only of course. I hate the idea of losing control over the hardware I purchased and I will resist as long as humanly possible installing a system that removes this kind of control from me. It just has _nothing_ to do with NSA spying and everything with corporate control of the OS maker.

fauigerzigerk• 13 years ago

The relation to the NSA is that whoever controls Microsoft also controls which programs can and cannot run on a Windows 8 computer. The assumption is that the NSA controls Microsoft. Is that really FUD? I'm not so sure.

belorn2• 13 years ago

The article is basically saying that, because the malware protection is not good enough (i.e. not securing against NSA malware), it's worse than no protection at all.

No. If the OS is locked down so only MS-signed applications can run, it is impossible to run software that can detect malware that has been approved by MS. It is also impossible to run software that can remove such malware.

If the OS makes it impossible to detect or remove malware, it is less secure than OS that do allow detection and removal of malware. This is not FUD.

What should happen, is that MS should be held strict liable for any illegal acts which their restrictions helps to propagate. Held under vicarious liability by non-US markets (so they can't get immunity by the US government), MS shareholders would demand the elimination of the restrictions in favor of less legal risk for the company.

amanne3• 13 years ago

First, Windows 8 allows you to run whatever desktop apps you want, including third party antivirus software of your choice that have full access to the system.

Second, I haven't seen your argument made for iOS and Chromebooks which are much more locked down than Windows 8. Though one could argue that Chromebook doesn't need to have malware since everything is helpfully uploaded to the cloud.

siculars• 13 years ago

FUD.

Fud or not, this is what happens when you shake the public's trust in... anything. In this case it happens to be government, the internet and technology. The NSA scandal will have wide reaching and unpredictable implications.

Losers will be traditional technology providers like Microsoft, HP, Cisco, etc. Remember how the US blocked China from supplying networking gear domestically on grounds of "security concerns"? (Which no doubt are totally valid.) Well, would you trust your company's or government's security to Cisco gear?

forgottenpaswrd• 13 years ago

"I do agree that locking down the OS so that it runs only MS-signed applications is a dick move in general and we'll probably see really bad changes in the market overall, but I see no relation to the NSA spying issue."

You see no relation?

If MS is the only who could control your computer, and MS is an American company tat has to obey American laws, and the American laws says they must spy on every customer, specially non Americans, like Germans, as they are defined "adversaries"...

You see no relation?

lispm• 13 years ago

http://www.golem.de/news/trusted-computing-bundesregierung-w...

frank_boyd• 13 years ago

TPM combined with the recent revelations may become Windows' final nail in the coffin.

esw• 13 years ago

I certainly understand the sentiment, but we've been talking about the end of the Windows era for at least fifteen years. At some point it will inevitably end, but I suspect that we will only be able to point to the 'final nail' in hindsight.

D9u2• 13 years ago

If Microsoft has been complying with government requests to facilitate access to Microsoft online services, then it wouldn't be entirely unreasonable to extrapolate from there to question whether or not Microsoft operating systems have also been engineered to facilitate government access.

petera2• 13 years ago

The core-argument is that the Windows 8 way of using, implementing and enforcing TPM and establishing a so called feudal security approach isn't considered good security practice any longer.

It's not so hard to understand.

cmarschner• 13 years ago

Nothing prevents you from buying a non-Windows, non-Mac laptop. It's not the year 2000 anymore when there were hardly any other options.

walshemj5• 13 years ago

Or using a system without tpm I am looking at building a new pc and all the motherboards I have looked at do not have a tpm module they have the header to implement one but its not installed by default.

ZanyProgrammer4• 13 years ago

Tell me where these mythical laptops are, other than the Dell XPS 13?

nileshtrivedi• 13 years ago

http://www.system76.com/ among others.

walshemj5• 13 years ago

So just don't install a TPM module if your getting paranoid and does any one know what powers the BND and the plethora of secret police have in Germany?

This smells of poujadist knee jerk Anti Americanism

kintamanimatt8• 13 years ago

I'd be under the impression that TPM 2.0 modules come pre-installed and are probably surface mounted chips, the removal of which would void any warranty and possibly cause damage to the motherboard.

walshemj5• 13 years ago

So and your point is? for example None of the consumer Ausus 8 series MB's (1150 Haswell) come with a pre installed TPM they just have the header.

muyuu• 13 years ago

I would pay a 50%+ premium for competitive open source hardware. Happily.

Udo• 13 years ago

Translation (it's a very long-winded article with many repetitions, I left some passages out):

How trustworthy is Microsoft? This is the question that concerns the Federal Administration and other German government agencies, as well as companies and private users who might want to use the Windows operation system now and in the future. Sooner or later they will be forced to use Windows 8 or its successor. According to documents available to the ZEIT ONLINE, government IT experts consider Windows 8 to be dangerous. They contend that the operating system contains a backdoor which cannot be closed. This backdoor is called Trusted Computing and it might empower Microsoft and the NSA to remotely control any device that uses it.

[...] The way in which the chip and the operating system cooperate is standardized and the specification for this is defined by the Trusted Computing Group (TCG). The TCG was founded ten years ago by Microsoft, Intel, Cisco, AMD, HP, and Wave Systems - all of which are US companies.

The current TPM specification is scheduled to be replaced by a new one dubbed TPM 2.0. Together, TPM 2.0 and Windows 8 achieve what has become the norm on smartphones, tablets, and gaming consoles: hardware and operating system become a tightly coupled unit that allows the OS vendor to tie down precisely what can be installed on a device and what cannot. To put it another way, Trusted Computing is a vehicle for Digital Rights Management (DRM) enforcement.

[...] Three issues arise here: First, contrary to the current generation standard TPM will be enabled right from the first boot-up of the device. Whoever uses this computer will no longer be able to decide if they want to use TPM (Opt-in). Secondly, TPM can no longer be deactivated on systems that have it (Opt-out). Thirdly, how TPM functions are used is entirely up to the operating system [vendor], in the case of Windows computers this will be Microsoft.

From the year 2015 on every single PC will be shipped with Windows 8.x and TPM 2.0. For the user there is simply no way to tell what exactly Microsoft does to their system through remote updates.

To summarize, users of a Trusted Computing System lose control of their computer. This is the design goal of Trusted Computing, as the Federal Ministry for IT Security (BSI) explains in detail here [link]. The BSI suggests that government agencies, companies, and private users actually make use of this technology - but only if certain conditions are met. A way to Opt-in and Opt-out is part of these conditions, and these options are being eliminated now. [...] Accordingly, the Federal Administration and the BSI now express very clear warnings against the use of Trusted Computing 2.0 within German agencies.

According to a paper issued by the Ministry for Commerce from early 2012: "Due to the loss of control over [the capabilities of] information technology" "the security-oriented principles of 'confidentiality' and 'integrity' are no longer achievable". Other statements assert for example: "this could have severe consequences for the IT security of the Federal Administration." Thus the conclusion is: "The use of 'Trusted Computing' technology in this form ... is not acceptable within the Federal Administration and other critical infrastructure".

[end of page 1]

Another document reveals that Windows 8 and its successors combined with TPM 2.0 are already unusable "even today". Windows 7 could "be used securely until 2020". After that, other solutions would have to be found.

In an assessment the BSI writes that "unconditional and complete trust" in Trusted Computing is not possible with TPM 2.0. The documents contain evidence that the German government did try to influence the development of the new standard. This type of cooperation has been taking place for years, this time the Germans have been simply ignored though. However, other parties got exactly what they wanted. The NSA, for example. "The NSA approves" was a catch phrase that has been issued during the last meeting between TCG and interested parties, according to some participants.

[end of translation]

The second page contains a lot of predictable conclusions about suspected NSA/US spying capabilities.

amanne3• 13 years ago

It's funny how Windows 8 is singled out as if other Windows versions are any better. Windows 7 can be securely used till 2020? That's the cut off date for updates from MS. The same MS that the article says " For the user there is simply no way to tell what exactly Microsoft does to their system through remote updates."

The above is true of Apple and Google, but it is glossed over.

First, I fail to see any relevance or technical info about what the TPM or trusted boot has to do with the issue at hand.

If anything they should be warning people about using Chromebooks where everything is uploaded to the cloud by default, same with Google Apps and Skydrive. Or Outlook.com and Gmail.

Oh, also be careful about Ubuntu, Shuttleworth said he has root on your machines.

In short, this is a rambling article full of technical sounding gibberish designed to get semi technical folks riled up with scary sounding buzzwords instead of actually educating people.

Edit: Fixed typo reported in reply.

moocowduckquack2• 13 years ago

"First, I fail to see any relevance or technical info about how TPM or trusted boot to the issue at hand."

Is that a sentence? It sort of looks like a sentence, but something seems missing.

AsymetricCom• 13 years ago

Windows 8 features MS's version of Apple-style walled garden app infrastructure, which is in turn protected by hardware TPM. Windows 7 can be installed without this hardware support, but will utilize it when available (by securing signed drivers). Windows 8 doesn't require TPM (yet), Windows 9 has been in development since before the release of 7. TPM support was introduced as a core component in Vista, iirc.

Zigurd2• 13 years ago

It is fairly amazing that any non-"Five Eyes" nation would use non-auditable and non-buildable software on systems they want to secure for quite a while now. I suppose the recent revelations have drained the last drop of credibility from the "we could but we wouldn't" argument.

mjg59• 13 years ago

TPMs can't be used to control which software you can install. All they can do is prove what software you're running, which means that a remote provider can choose whether or not to provide a service based on what you're running. Trusted Boot is about providing proof, not about enforcing local policies. Secure Boot can be used to restrict which software you can install, as demonstrated in Windows RT. But that has nothing to do with TPMs - iOS behaves in the same way without using any TPMs.

So I don't really understand the article. Placing trust in TPMs to maintain your secrets obviously depends on you trusting the TPM manufacturer not to hand over any of the secret keys, but having a TPM doesn't mean that you have to place trust in it.

mpyne3• 13 years ago

For all of you who (somehow) don't recognize the UID here, this isn't just some "interested observer", this is the person implementing support for booting Linux on systems with these TPMs. In fact if I understand it right Linux can now optionally use a TPM to verify that kernel modules are only loaded if cryptographically signed.

A good intro to TPM on Linux: http://mjg59.dreamwidth.org/24818.html

MichaelGG• 13 years ago

TPMs are also pretty handy for low-level corporate security. Setup disk encryption, store in the TPM then either boot directly (allowing RAM attacks) or require a PIN (requiring someone to break the TPM itself). That's a pretty nifty feature for general security.

I think the distrust and confusion around TPMs and so on is due to Microsoft's moronic handling of Vista's protected playback system and people have extrapolated from there.

eru• 13 years ago

I believe the Chromebook uses TPM quite well.

kunai• 13 years ago

I never really understood how TC works. Does the TPM actually do anything on-the-fly that is noticeable? Is it used at all on any consumer devices?

Fill me in here, because I'm at a loss.

EDIT: Never mind. It seems like prior TPMs shipped with hardware, but were opt-in instead of opt-out, and now, with the W8.1 hardware spec, TPM 2.0 (which has a greater range of TC technologies) will need to be enabled as default on hardware shipped with W8.1, and there is no possible way to opt-out.

A shame that hardware manufacturers are just Microsoft lackeys.

reirob4• 13 years ago

Just have found another article that might give some more details. It is again a German article, so I hope that German speaking community will step in again (the last Google translation was really bad) and provide its interpretation.

The article is an interview of Professor Dr. Rüdiger Weis, who is a cryptology expert:

https://netzpolitik.org/2013/interview-trusted-computing-sti...

orionblastar• 13 years ago

I tried my hand at Translating the article here: http://www.greatdox.com/windows8/

Sorry for any errors in Grammar or mistranslations. I also don't claim the technical 'facts' in the article are true, but they are what the original article was stating.

A link back to Hacker News on this thread and other related links. Plus a link to Lunubtu and Linux.org at the end.

Please ignore my affiliate links near the bottom, I am having problems finding a job, and paying for web hosting, etc. Most people don't click on them anyway, and the entire web page is text no javascript, no images, no pop-ups, etc.

Hen4732• 13 years ago

https://www.bsi.bund.de/DE/Presse/Pressemitteilungen/Presse2...

German government warns Windows 8 is a security risk

Related Stories