Slashdot Mirror
A Critical Look at Trusted Computing
mod12 writes "After just attending a two-week summer program on the theoretical foundations of security (one of the speakers was from Microsoft research), I have been interested in trying to find out if the "trusted computing" initiative was still alive. I got my answer today in the New York Times from an article that was fortunately rather critical of the concept."
As long as Microsoft is there, there is no trust.
for those of you who don't know, Markoff is the journalist who wrote several articles about kevin mitnick in which he "created the myth of kevin mitnick" (in kevin's words). many untrue allegations were presented as supposed facts.
but don't let that discourage you from reading the article.
This post was brought to you by the number 584811 and the characters / and .
I recommend not tossing systems when you upgrade--pre-ban PCs should be worth a tidy sum soon.
Call (206) 338-5780 COLLECT for information about a genuine BA, BS, MA, MS, MBA, or Ph.D.
- For example, Mr. Juarez, the Microsoft executive, said that if the company created a more secure side to its operating system software, customers might draw the conclusion that its current software is not as safe to use.
NO!! Y'think?The word "trust" is pretty much the central idea in formal security. And ultimately is comes down to deciding if one person trusts another person. Of course when you mix in technologies, then that expands into trusting the system components. Do you trust the website is the correct one? Do you trust the CA registrar. Do you trust that the web browser isn't lying to you. Do you trust that your keyboard isn't recording all your keystrokes? Its all about trust, and no secure system can avoid the subject. And no formal security method can avoid it either.
So yes, trusted security is very much alive, or it had better be, or we won't have any security. But the big question is whom or what is being trusted? And the big media companies are trying their best to confuse the issue. It's just like their "secure media". Their concept of trust is that they, the media distributors, want to be able to trust your hardware to not trust you the consumer. They also want to also insure that other consumers will not trust you, or you could otherwise become your own media producer and distributor and compete with them. If DVD players only play content that is digitally signed by the cartel, then you are barred from competing because you can no longer produce your own content that other's hardware will trust. But on the other side I want to trust that my computer is not infected with a virus; I want to trust that my legally copied media is not corrupted by the media police. Trust is the just the tool.
Trusted computed could be a very good thing, but you absolutely must define what you mean by trust before you can begin any discussion or evaluation, or to say whether it it "bad" or "good". From a purely technical and formal perspective trusted computing is the next step forward. From a society's perspective the answer is not so easy.
If the Wintel crowd were serious about security, they'd push for a hardware architecture that supports secure microkernels really well and put a very partitioned OS on top of it. But no; it's all about boot-time lock in.
Beyond changing the appearance and control of Windows, the system will also require a new generation of computer hardware, not only replacing the computer logic board but also peripherals like mice, keyboards and video cards
Like most new Windows features, I don't see anything in this that the consumer actually wants, I think it is just a way to force yet another upgrade on us.
-- the only thing we have to fear is really scary things
The National Security Agency's "security-enhanced" Linux is an attempt to make Linux into a "trusted" computing platform, but that has NOTHING to do with DRM and other MPAA- and RIAA-borne stupidity.
Security researchers are putting a lot of effort into defining trust relationships and developing guidelines for applying the term "trusted" to software. Has the software design been verified? How about the code? Who verified the design and audited the code? Have there been security problems in the past? Is the concept fundamentally compatible with security?
Then along come the MPAA and RIAA, and they convince Microsoft (among others) to start talking about a totally fucking DIFFERENT definition of "trusted". Whereas the OLD definition of "trusted" involved concepts like integrity, secrecy, reliability, and auditability, the NEW meaning of "trusted" is essentially "crippled".
As somebody who studies security for a living, it irritates me to see the two concepts confused. Microsoft's DRM-enabled operating systems will NOT include the features I've outlined above, and a highly "trusted" operating system could very well include software that allows you to "rip, mix, and burn" just as people are accustomed to doing today.
Really, just who is "trusting" the DRM operating systems? Not the users-- I imagine there will be just as many viruses and exploits and bugs as before. Not software developers-- Microsoft hasn't really announced any plans to do things like, say, encrypt the swap space or integrate stack protection into their linkers, loaders, and compilers.
In fact, the only people who are really trusting the DRM operating systems are the content industry associations. Which makes sense, as Microsoft and company are essentially doing the whole "trusted computing" thing at the behest of the MPAA's congressional whore.
Please, folks, let's call a spade a spade: the DRM-enabled operating systems are NOT "trusted". They're "content-industry-friendly". They're "crippled". They're a lot of things, but they're not "trusted".
Let's start asking for some precision of language, here.
OTOH it looks like this stuff will only effect Intel and MS products. Personally, I have always used Apple products myself. It has protected me from MS viral licenses. It has protected me from Intel's occasional desire to track all users. It is now protecting me from silly DRM schemes that do nothing but protect antique business models. Apple has done more for security by allowing the user to turn off HTML in mail.app that MS could possibly hope to do in a decade.
The same could be said for GNU/Linux and other non-MS users. For these users there are only three concerns. First, laws could be passed to require certain attributes in entire classes of software. For example, as the article suggests, all email and music might have to be signed with a CPU generated hash. Of course all advanced users know that such technology could be circumvented, and, even with laws against circumvention, such actions will routinely occur.
Second, the makers of Intel clone chips might, and probably will, succumb to pressure and include security features. This would be bad because right now OSS is very tied to Intel class chips. The solution to this is to build open hardware platforms around non-Intel class chips, and create OSS projects that run on such platforms. Intel may be a slave to MS, but AMD and others might be more scared of lost sales due to OSS moving to Motorola and IBM chipsets. In five years if OSS is still tied to the Intel instruction set, and Intel is only making chips that spy on the user, there will be no one to blame.
The third issue comes from a quote in the article
the system will also require a new generation of computer hardware, not only replacing the computer logic board but also peripherals like mice, keyboards and video cards
from this we can infer that MS intends to push DRM to all hardware connected to the CPU, which, of course, is the logical course of action. The issue is as above. OSS runs mostly on what is essentially MS hardware. If all MS hardware requires software that is cryptographically signed and externally validated, probably by MS related service, one wonders if OSS will exist. If OSS does exist, one wonders if it would have any purpose the user was still ultimately tied to MS licenses and security schemes.
This has always been the danger of the single environment ecosystem. The OSS people seem to forget how inherently dependent on MS whims they are. One wonders if some diversification might be in order.
"She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
"The company is dealing with both technical and marketing challenges presented by the new software security system. For example, Mr. Juarez, the Microsoft executive, said that if the company created a more secure side to its operating system software, customers might draw the conclusion that its current software is not as safe to use. "
he went on to explain:
"What I mean is that we cannot have our customers using deductive reasoning to come to an obvious conclusion which might jeopardize our market share (control). Could you imagine the implications? We would rather them just trust us - and relax - big broth.. uhhh... I mean Microsoft has it all taken care of"
TCPA is going to be bad for more reasons than just Palladium... it's going to be a major headache for IT departments trying to cope with software that is actively unfriendly. Why? It's about visibility. When an IT department needs to replace a legacy app, write bridge code to shuffle data b/t two different software systems, or make revisions to a relic in-house app, the amount of visibility will determine how quickly and cheaply the change can be accomplished.
Visible things include: good documentation, available source code, standard protocals, open data formats, strongly defined interfaces, generous/lax security, unencrypted traffic, non-regulated/classified data, informative error messages, enthusiastic vendor support, open bug databases, and software-oriented community forums (yay Google Groups!).
Invisible things include: missing/shoddy/incomplete documentation, overly-flexible products, binary network protocals and file formats, marketing-centric websites [heh... just try to find technical info about Crystal Reports], "friendly" error messages, abandoned development platforms, and (getting to the point)... stuff that's too locked down.
DRM and trusted computing will add yet another layer of flaky security that prevents casual intrustion while seriously hendering IT. Businesses will be tantalized by the idea that they can precisely control how a memo get distributed, archived, and destroyed. They will be oohed and ahhed that they can enforce their "email retention policies" through the use of TCPA. But this will come with some heavy costs... of which visibility is one of the major ones. I can see it now:
- Client: "Here's that email you needed to hook up system A to system B, but I can't send it to you. It says it's protected. I tried taking a screenshot, but it came out all black. I can't seem to print it out either. We could probably call Ginger and find out who could give the authorization to transfer this, but she's not here today. How about I just read it to you over the phone?" [Stupid DRMish Feature]
- Product Expert: "Oh yeah... to import text records into RiskModeller3000, you have to create an executable and pay the vendor a wad of cash to sign it. Only then will RiskModeller be willing to execute your binary and munch in the text it produces." [Stupid Licensing Scheme]
- Packaging Expert: "To transfer this program from our testing environment to the produciton environment, you'll need to recompile the binary and sign it with this 'production certificate'... hope your build environment hasn't shifted around much or you'll blow the integrity of all that 'final release testing' your clients just spent four weeks on." [Stupid Security Requirement]
Visibility affects the agility of business and the cost of IT. It's not just an abstract good... it provides lubrication for business IT and reduces real cost. A company with a lot of visibility will be more agile and flexible than one without it. And, in the final analysis, a society with visibility will generate more wealth than one that gets too tangled up in an artifical form of security. TMCA is basically bad, because--while it could have good uses--it will ultimately reduce visibility and harm society.It's not just about pirating MP3's... it's about the creation of real wealth and new technologies.
-1, Too Many Layers Of Abstraction