Slashdot Mirror
IBM Shipping More PCs with Trust Chips
rts008 submits this EWeek story about IBM shipping more computers with trusted computing inside. Since the article mentions none of the downsides, we should: trusted chips will eventually be used by software manufacturers to make sure the computer's owner does not do anything with the software which the manufacturer does not want to permit.
You should also read Can you trust your computer? and The right to read, both by Richard Stallman
This last particular one is very insidious about effects made possible by Treacherous Computing.
Yes, it's already here in mobile phones and it's already been used to cripple a perfectly good handset's bluetooth stack meaning images can only be sent over the cell network at an extortionate data rate rather than being beamed straight across the gap between two bluetooth phones. I think I'll take my chances on the viruses thanks. BTW, I'm running some nice open source apps on my P900 which I doubt would've been created if they needed signing (maybe why I can get apps for my SE P900 but I never could for my T610) - hell, even Opera Mobile Browser came up with an 'unsigned code' warning when I installed it, but I can click 'install anyway' on the Symbian model and I'm quite happy with that - there's no override on the T610.
The hardware doesn't enforce crap. It provides a layer that can't be modified by software (ie: "trusted") to perform certain operations invoked by software.
Man, did anyone read the article or check out how IBM markets them on their webpages? These things are for encrypting documents, passwords, storing things you don't want people to get to easily. I've sat through a few seminars and presentations from IBM and how they tout this is to protect your DATA from other people, not protect a copyright holder from you.
As a rock-in-roll Physicist once said, No matter where you go, there you are.
AMD is a member of the Trusted Computing Group, along with MS, Sun, IBM, Intel, HP, Sony, and a whole slew of contributors and adopters of this technology, too.
should be reading John Walker's Digital Imprimatur to see what its real purpose is.
You build motherboards for export, you build to the specs demanded by your foreign clients, not the occasional hacker who posts a rant to Slashdot.
Most fo the software I run consists of stable, widely accepted projects which have good maintenance records and a large community of coders behind them.
I trust this software more than I trust software from businesses who do not have the incentive to put out quality products....
LedgerSMB: Open source Accounting/ERP
I don't know what's going on in the Apple universe, but an inactive Trust Chip is already rolled into the Intel Prescott CPU. It eats up about 20% of the chip area.
There is a micrograph of the chip at the bottom of this page. La Grande is Intel's codename for Trusted Computing.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
You're correct. Both articles talk about how Steve Jobs and Apple don't support "trusted" computing.
If you want to know more about the difference, you can read an article about it here.
Aren't most of the evil ActiveX spyware launchers "certified" anyway? I really don't think Trusted Computing has anything to offer since the business world accepts spyware as valid.
It would be cool if it didn't suck.
Given this particular definition, "trusted" is exactly the right thing to call this sort of hardware, although perhaps "blindly trusted computing" would be better.
Their actual plan is quite insidious and the Trusted Computing Group and hardware makers pretty effectively dodge issue of anti-trust.
The hardware will launch absolutely any operating system you like. However new software will refuse to insall or run unless the software publisher approves of your system. Music and movie and other datafiles will be inacccessible unless the publisher approves of your system. Websites will be unviewable unless they approve of your system.
And ultimately your ISP may deny you an internet connection unless they approve of your system.
Obviously everyone is going to approve of Microsoft's next operating system Longhorn. Most everyone is going to be running the next version of Windows, so their software and media and websites would be pretty much unusable if they didn't. They are also perfectly free to choose to approve of other operating systems. If they do bother approving other OSs they are still only going to do so if that system properly enforces DRM and pretty much the exact same rules and restrictions that Microsoft imposes and enforces.
There is already a project developing a Trusted Linux, and Trusted Solaris, and probably others.
So yeah, music downloads *might* be useable on Trusted Linux, IF they bother adding it to their approved list. And if you do run Trusted Linux, well, you have the exact same set of handcuffs impossed on you. And the Trust system completely defeats the GPL. If you attempt to modify your system in any way it ceases to be Trusted. Nothing will work on it anymore. The source code is entirely useless. Change it all you like, recompile it all you like, it simply doesn't WORK.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
I'm not a "computer wizard" but isn't ALL of the data already stored in the hardware? Where else does one store their data? The Ether?
Normaly data is "in the hardware", but you can pull it up on the screen and see it and change it. It's not normally locked within the hardware and inaccessible.
The point of Trusted Computing is that there is a secret key locked inside a single chip and it never leaves that chip. You, the owner, are forbidden to see this key or to use it except in the way they permit you to use it.
And this key is used to lock (encrypt) pretty much all of the other data on your computer. You cannot look at or P2P your music files. You cannot even PLAY your music files, except in the manner the chip permits you to. Once you turn on the chip the chip owns your machine. It's not your computer anymore and you can't do squat except what other people specificly permit you to do.
And if you choose not to turn on the chip, well then none of the new software and files and websites work at all. You may ultimately be denied internet access unless you submit.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
If the system software can access it, so can a hacker.
The entire point of Trusted Computing is that the system software CANNOT access it. No software can access the data except the exact and unmodified software to which it was bound.
When you start a program it hashes that program. The chip uses that hash to create a decryption key. If you change the software you change the hash. If you change the hash you end up with a different and useless decryption key.
And another part of the new hardware is that even the operating system will be unable to look at the memory belonging to a Trusted program.
You can't get at the data without the original program, you cannot modify the original program, and no other software can peek at that program's memory. Depending how they implement the hardware the RAM itself might even be encrypted, so even a hardware attack would be useless unless you could break into the self-destructing CPU itself.
There is a damn good reason they are spending billions on this new system. It simply is not vulnerable to all of the usual attacks. It's not your usual futile DRM scheme. This is a plan to change the fundamental nature of computers, to deny you ownership and control of your own machine.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
I believe the way it works is that there's actually some sort of corusive material that will get released and literally destroy the chip.
No need. It has all sorts of tamper detection circutry. If you try to open it it simply wipe the master key from RAM or flash memory. Without that key the chip is usless. Once that key is wiped you can tamper all you like, there's nothing left of value.
Dah, dude, you can shut it off in the BIOS. It's not a bad thing.
If you shut it off it is impossible to install or run any of the new software. It is impossible to access any trusted files. It is impossible to read secure e-mail. It is impossible to view all of the new websites. The government and industry plan is that in a few years you will be denied internet access. The President's Cyber Security advisor called for that at it at a Gobal Tech summit in Washington DC. All part of securing the internet against viruses and terrorist cyber attack. Oh joy.
there's no sort of unique identifier or anything on this chip
Who the hell told you that?!
The Trusted Computing Group's own techinal specifications document that every chip contains a unique Private Endorsment key. It effectively is an ID number, but it's much more powerful than that. It allows your chip to transmit and receive messges that you cannot read.
you supply it with the private keys
No, it comes with the Private endorsment key. It internally generates the Root Storage Key and most every other signifigant key. Most of the other keys will will be generated inside some other Trust chip and passed to your chip encrypted, so that it's impossible for you to see or know them. For example the key to a DRM'd music file.
I guess you could give it a low level worthless key for encrypting things yourself, but you are NEVER allowed any access to or control over any signifigant key.
you could easily disable it and the software would know no difference
With the chip disabled it is impossible to access and of the encrypted files. Any Trusted software would simply fail to work.
There is no reason anyone should be concerned about TCPA. IBM has been a very responsible citizen here.
I admit many TCPA/Trusted Comuting critics are badly botching the critisisms. However they are botched versions of VALID criticisms. IBM and freinds certainly arent going to advertize any negative aspect of the system.
And the postive aspects they advertize - well you could get ALL of those benefits from an almost identical system. One where you know your key. Merely knowing you key cannot alter or reduce the functionality and capabilities of your machine. You still get all of the security benefits. Howver when you know your key the machine is no longer secure AGAINST YOU. You can unlock any file you like, such as a DRM'd music file. Your chip can no longer keep secrets from you.
And they REFEUSE to allow you to have such a good and beneficial system. They will only permit you to buy a system with the added poison pill of forbidding you to know your own key. One that can enforce DRM against you.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
It aims to describe the difference between TCPA, MS Palladium and DRM, and explains what TCPA is usable for (crypt personnal data, store passwords,etc.), and what TCP is unusable for (restrain software execution).