IBM Shipping More PCs with Trust Chips

Paranoia or truth? by AssProphet · 2004-10-03 07:33 · Score: 5, Insightful

Yeah, paranoia is fun and all, but I wouldn't mind a few links to support the downsides claim.
You'ld think IBM would know better than to associate the word "Trust" with "Technology". That combination is like a buzzword for suspicion to the Tech-wise.

Re:Paranoia or truth? by Antique+Geekmeister · 2004-10-03 07:58 · Score: 4, Insightful

"Trusted Computing" is actually spelled "Palladium". Look up the keyword "Palladium" and "Brian LaMacchia" to see what Microsoft plans for this hardware based feature set. It's simply been renamed "Trusted Computing", but it's the same developers with the same goals: signatures on software and hardware to prevent any "un-authorized" use of them. Checksumming or authenticating software packages is quite reasonable, and verifying the identity of hardware components for security hardware is also desirable. But the screwball, closed source nature of these tools and their implementation at the motherboard level means that while Microsoft software will be promised, *promised* to work without this signature software in the near future, working only with this kind of authentication can be planned in the 5 to 10 year timeframe for the Windows and Office and games and DVD/CD burner software upgrade paths. And the closed nature of the key repositories can be used to keep open source developers from releasing open source products that can do these functions, since the signatures will be prohibitively expensive.
Re:Paranoia or truth? by Christopher+Thomas · 2004-10-03 08:59 · Score: 4, Insightful

Are the `Trusted Computing' Frequently Asked Questions a good start for you?

I've been reading the TC FAQ, and I still don't understand how this is supposed to do something useful.

It works to prevent tampering by doing security checks against hardware-stored data while in a privileged operating mode, but the whole point of the latest slew of security problems is that unprivileged software can gain access to privileged operating modes. So, this won't do a whole lot to protect you from malware, as was one of its (many) claims.

I'd also expect cracked bios flashes to appear within months of a TC implementation that significantly hindered unlicensed software use. Not to mention cracked versions of the software that didn't handshake with the TC routines. Encryption of software to prevent cracking has been around for years, and has been ineffective for years - you just have to snag unencrypted images of the code and data you're interested in from memory. All of these cracking approaches have countermeasures that can be taken against them, but at this point you're trusting OS and application manufacturers to design software robustly and with keen foresight. I'm skeptical of this occurring in the near future.

There's also the problem of the hardware hashing making the machine non-upgradeable, and the problem of the machine requiring an active 'net connetion for applications to authenticate with their central servers, and the problem of "mod chipping" (removing the TC chip and replacing it with a compromised version).

In summary, I don't think that TC will work for its nominally intended purposes (securing machines against malicious attacks, and ensuring that software and media are used only as licensed). I'm kind of curious as to whether the proponents of TC realize this (and just want to alter licensing schemes for Joe Average), or not (and think it will work).

Not always a bad thing. by Supergoad · 2004-10-03 07:35 · Score: 5, Insightful

Remember, trusted computing has its place. Maybe not on the desktop, but I can see it useful to lockdown point-of-sale machines, kiosks and librarys. It would be a hell of a lot easier for some places than it is implementing Group Policies and permissions for a computer that should be used only for a specific task.

Usual bait and switch tactics.... by Atrax · 2004-10-03 07:35 · Score: 4, Insightful

Industry spokesman: "... but this will stop those evil hackers taking over your system. Surely this is what you want? Oh, well yes, it CAN be used to restrict the way you use your legitimately purchased software, but don't you think that's a small price to pay?"

what I don't like about this concept is that the problems that mainly affect the lower end (non-tech users who can't secure their PCs) will result in more restrictions on the top end (tech users who can 'creatively' use products for a purpose outside their original design parameters). the punters won't notice.

--
Screw you all! I'm off to the pub

Psychic Slashdot? by rsmith-mac · 2004-10-03 07:40 · Score: 4, Insightful

trusted chips will eventually be used by software manufacturers to make sure the computer's owner does not do anything with the software which the manufacturer does not want to permit.

When did Slashdot gain the ability to see the future? While I know we disapprove of "trusted computing" and similar systems, and for good reason, for a blurb wanting to talk about balance, that's a pretty damning statement. Trusted chips can be used to lock down software stop users, not will. We're still early in the game, and damn if we don't have any influence, but that future is still a long way off. How about instead of just bitching about "trusted computing" we start to drive it towards something that's mutually beneficial: something that allows businesses to exert power over their internal affairs(locking down documents and such), and something that lets users exert power, such as locking down systems against worms, viruses, and spyware?

The book on trusted computing hasn't been written yet, let's not call it before it's done.

Re:Psychic Slashdot? by Jeff+DeMaagd · 2004-10-03 07:53 · Score: 4, Insightful

The thing is that the motivation for this largely centers around DRM. Yeah, people mention point of sale, kiosks and such, but those functions should be on embedded computers, not desktops.

I really don't see what "Trusted Computing" gains me as a user of desktop software. I don't see why this is necessary to lock down computers against worms, viruses, and spyware because those are an end product of bad software, not the lack of trusted computing. I don't want trusted computing to be used as a cover to coddle bad software and then give me an added bug called DRM.
Re:Psychic Slashdot? by Dragoon412 · 2004-10-03 07:58 · Score: 4, Insightful

Trusted chips can be used to lock down software stop users, not will.

While that may be true in a literal sense, giving the likes of Microsoft and the RIAA a widely installed base of these 'trusted' machines is and expecting them not to abuse the power is like giving a junkie a hypodermic needle and expecting him to use it for something other than shooting up.
Re:Psychic Slashdot? by Alsee · 2004-10-03 09:33 · Score: 4, Insightful

It is not even a question of "can" or "will".

The FUNDAMENTAL DESIGN of Trusted computing itself is that if you attempt to modify the software it no longer works. There simply is no question of prediction about it.

If you attempt to modify the software then the Trust chip generates a different hash for that software. Without a changed hash value the Trust chip now generates entirely different encryption keys. Since the software no longer has access to it's old encryption keys it can no longer decrypt it's secured data files and it can no longer decrypt secured communications with other software over the internet.

It's certainly possible to make the effort to write software that doesn't have these issues, but that's kinda like making the effort to redesign an airplane to remove the wings. At that point it's not even an airplane anymore.

something that's mutually beneficial: something that allows businesses to exert power over their internal affairs(locking down documents and such), and something that lets users exert power, such as locking down systems against worms, viruses, and spyware?

That's easy! All they'd have to do is give you a printed copy of your master key along with your machine.

It should be pretty obvious that simply knowing your master key cannot possibly reduce your computers ability to protect you, it's still the exact same hardware. You are just as secure against viruses and worms and spyware. Companies would have just as much security over their machines - the company owns the machines and only the company would get the master keys to them, not each employee. Knowing your master key gives you ALL of the benefits and NONE of the downsides!

The very issue is that they REFUSE to offer such an option. They refuse to allow you to know your own master key. They refuse to sell you any Trust chip except one that keeps your key secret from you, one which is designed to self-destruct if you attempt to open it up to read your key.

The very purpose of Trusted Computing is to forbid you to know your master key so that your chip can keep secrets from you. So that your chip can control what you do with data. So that your chip can prevent you from altering software. So your chip can send secret messages to other people which you cannot read. To that your chip can securely tell other people exactly what software is running on your machine and exactly what hardware you have.

If you were allowed to know your master key the entire "Trust" system would fall appart. You computer would still be perfectly secure FOR you, but it would no longer be secure AGAINST you. You could use your key to unlock your own files, such as DRM'd music files. You could use your key to unlock your application data, allowing you to escape vendor lock-in. You could use your key to read the secret messages your chip sends to other people. You could use your key to be able to modify your own software or change your settings. You could use your master key to lie to other people about what software and hardware you are using - for example you would be able to tell a website you are using Internet Explorer when you are really using Netscape.

The very purpose of Trusted Computing is to make it impossible to do any of those things.

If they wanted to make a beneficial system for you and me they would simply allow you to know your own key.

-

--
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.

Bring it on. - I, for one, welcome this practice. by Anonymous Coward · 2004-10-03 07:42 · Score: 5, Insightful

computer's owner does not do anything with the software which the manufacturer does not want to permit.

Good.

Instead of encouraging people to break the law (pirate software, etc) - I wish more people would choose software that _grants_ them the right to use it as they see fit.

I wish everyone in the world had to pay full price for Microsoft and Adobe software instead of copy it or buy cheap pirated versions. Then people would start recognising the value of Free Software.

Until then, pirated windows is probably the strongest competitor Linux faces.

flawed by s4m7 · 2004-10-03 07:43 · Score: 4, Insightful

While vendor lock-out is definitely a threat, it's not a terrible threat because amateur developers are such a key part of the industry, and always will be.

What concerns me much more is the stuff that's going to start happening when "trusty" computing becomes ubiquitous, if it ever does. More and more important transactions and secret info exchange will take place over the net. and of course you know the government doesn't allow good encryption for "national security" reasons.

the article talks about the security and encryption being in hardware rather than software as though that was some sort of improvement on it, but who wants to replace their hardware as soon as some 1337 5kr1p7 k1d5 figure out an exploit? and it's only a matter of time.

on the other hand this is one of the few technologies that could permanently cure the world of spyware (the other obvious one being dumping windows altogether.). of course with every new anti-spam technology, the spammers are the first on board, so I imagine the industry will sell out again and no good will come of it.

--
This comment is fully compliant with RFC 527.

Just say no to DRM by Whammy666 · 2004-10-03 07:44 · Score: 4, Insightful

I for one will not buy any piece of hardware that is equiped with this nonsense, unless there is a BIOS setting to fully disable it. I plan to keep a couple of spare motherboards without the DRM crap just to have for spares in case the one I'm using dies.

It seems that manufacturers and publishers are just determined to alienate the consumer with this kind of shit. The only way to stop it is to take their profit out of it. Just say no with your pocketbook. They'll get the message sooner or later, assuming they don't pay off some politicians and get a law passed to make DRM mandatory. Oh wait... we're screwed.

--
When all else fails, run.

The Birth of owning software. by Anonymous Coward · 2004-10-03 07:45 · Score: 5, Insightful

Quite the contrary.

If these silly licenses will finally be enforced, people will start to demand software that they legally own the rights to - as opposed to simply stealing it from work.

The best thing that could ever happen to Free Software would be if people were no longer able to steal software from their companies an no longer able to buy cheap pirated versions.

Finally the general public would understand what the Free Software movement is all about.

Re:michael by Antique+Geekmeister · 2004-10-03 07:49 · Score: 5, Insightful

Michael, I'm afraid you're mistaken. No processes will be allowed to run on your machine that *Microsoft* or a similar vendor did not specifically authorize. This means that the boot loader can be signed to prevent you from running a non-Windows operating system, a CD or DVD or hard drive disk can be signed to prevent legal and authorized duplication for what is legal home copying, and emulation software such as OpenOffice can be prevented from making the system calls to open data files generated with Microsoft Office, helping keep the Microsoft monopoly locked up.

Moreover, it can prevent experimenters from being able to design new drivers and software tools to work with the crypto-authorized hardware without spending very large amounts of money on development tool suites with frankly larcenous intellectual property agreements.

This development is potentially extremely nasty: while we're somewhat paranoid about it, the history of abuse of standards to lock customers into their monopoly justifies extreme concern about what Microsoft might do with these features.

Trust will Wilt in Face of Taiwanese Engineers by reporter · 2004-10-03 08:05 · Score: 5, Insightful

These trust chips appear to be an attempt at preventing software piracy.

The attempt is futile because every attempt to prevent illegal copying has been defeated. Some Taiwanese engineer will design a hardware addon to enable the customer to illegally copy the software.

The only way to protect the trust chips is to obtain a federal injunction (from a judge) barring hardware hackers from circumventing the hardware anti-piracy chips. However, those injunctions apply only to the USA. The Taiwanese engineers will gleefully ignore the injuntion -- as is their wont. The Chinese in China (including Taiwan province and Hong Kong) routinely ignore Western standards and custom.

After all, China is the software-piracy capital of the world. The piracy rate exceeds 91%.

Parent going places. Up hopefully. by Mr+Thinly+Sliced · 2004-10-03 08:09 · Score: 4, Insightful

Totally, like totally, 100% with you on that one.

At the moment, its just too easy to pop the CD in, or download something you only want to use this one time.

If that one time _really_ did cost you the $400, its suddenly not the package for you, is it?

Example - The missus complains that she doesn't want to use or understand Linux, so what do we have to do, we have to install that nasty stuff - but we shouldn't fork out the list price of $900 for the software - O no. You're in IT aren't you, you can easily grab a copy from work .....

This is not what TCPA is for by lkaos · 2004-10-03 08:12 · Score: 5, Insightful

TCPA (the chip that's in these PCs) is simply a Crypto co-processor. It provides acceleration for common crypto algorithms and it also provides a tamper-resistant storage location for keys. IBM maintains an Open Source implementation for the processor.

There's already been really neat things done with the chip like a truely secure version of Linux that's entirely tamper proof (this is doing by signing the kernel and boot loader with the TCPA.

Put away the foil hats people, this is actually really cool innovative technology that so far has given Linux an edge in the security world over Windows.

--
int func(int a);
func((b += 3, b));

Re:Can I trust my computer? by Cyclops · 2004-10-03 08:17 · Score: 4, Insightful

Right. Just until the BIOS uses Treacherous Computing to determine wether you're launching an approved operating system.

Phoenix has already announced they support TCPA... and many others do too.

You will suport it until... by nurb432 · 2004-10-03 08:33 · Score: 4, Insightful

This sounds like a nice idea until you find out that the hardware manufacturers are working with the software vendors, and will prohibit you from installing anything other then what *they* approve..

Approval wont techincally be 'restricted', but you will have to go thru a approval process, which wont be cost-free.. ( just look at getting ISO certification.. its not cheap )

So, that means little LEGAL free software will run on your 'trusted PC', as the cost of 'certification' ( as well as the rules and regulations you must follow for approval ) will be far to high for an OSS project to afford.

In the end, its got little to do with piracy, and more to do with control.

--
---- Booth was a patriot ----

On sale: solderless mod kit for IBM PC XYZ by thrill12 · 2004-10-03 08:51 · Score: 4, Insightful

Seriously: we have this already. We have the Playstation 2, we have the X-Box, we have (name your favourite piece of controlled hardware here). Both of them incorporate something that could be called "trusted computing". If it ain't signed properly - it ain't trusted - it ain't run.
Few consumers accept(s/ed) this and buys a modkit to solve the problem. Same way it will be for the IBM hardware.

Maybe this even has a more negative impact for software sales than they envision:
If software manufacturers rely on this piece of technology to protect their investment completely (as with XBox and PS2), their software is going to go just as easily as buying the modkit. And because their software get's spread more easily (any person with a modkit can copy their software), they will lose more money - and need larger margins to keep afloat, which leads to a spiral of less software sales. Thus, in the end, noone but large players will stay behind.

I vote for a namechange:
Trusted computing becomes Assured economic software failure...

--
Slashdot: stuff for news, nerds that matter, matter for news, stuff that nerd

Nothing monopolistic by Teun · 2004-10-03 10:17 · Score: 4, Insightful

They don't have to.
There'll be a nice licensing scheme for the key.
Which will first be incompatible with Open Software (licences) and second cost so it can't be included in freely distributed software.

Microsoft, Adobe etc. will just hold up their hands, it's not *their* fault this 'free' software will not run...

--
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."

Re:The beginning of the end? by Alsee · 2004-10-03 10:18 · Score: 4, Insightful

I'll get the most cutting edge PC I can that doesn't contain any builtin DRM, and then see how long I'll last.

You missunderstand the threat. There is absolutely no reason to hold onto a Trust-free machine. It's like holding onto a speaker-free machine. You can just go out and buy a new computer that happens to have speakers, and then pretend the speakers aren't there. Simply don't use them.

The new Trusted-enhanced machines can do everything the old machines can do.

The entire plan is that ordinary old machine will increasingly get locked out of everything. New software will only run on the new machines, and only in the new Trusted-enhanced handcuff mode. New websites will only be viewable on the new machines, and only in the new Trusted-enhanced handcuff mode.

You'll get a FREE music CD with your McDonalds Happymeal. If you try to play it on a normal old computer it will give an error message that you need a new Trust-enhaced machine. Your old machine is obsolete and incompatible. So Uncle Bob will run out to buy a new Trusted-enhanced machine just to get the damn free music to play. And that music will only play in Trusted-enhanced handcuff mode.

You will start getting get secure e-mail from your friends and family and maybe even your boss. And it will be impossible to read that e-mail except on the new machines, and only in the new Trusted-enhanced handcuff mode. And if you refuse to submit to Trusted Computing then your friends and family and boss all blame YOU for having an old obsolete and incompatible machine, that YOU are causing the problem.

So not only will you get locked out of more and more as long as you refuse to submit, they even subvert your friends and family and boss (who have moved to Trusted Computing) into making you suffer even more.

There is absolutely no reason to hold onto old hardware. That is part of the insidious nature of their plan. It is the old Microsoft Embrace Extend Exterminate tactic. They Embrace everything current computers can do, Extend it with stuff that only Trusted machines can do in handcuff mode, and Exterminate normal old computers which are now incompatible with everything new.

-

--
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.

Re:Can I trust my computer? by Zangief · 2004-10-03 10:38 · Score: 4, Insightful

Yeah, and 15 years after they crushed all competition, they will get a terrible slap in the hand, everything wiull be forgotten.

Slashdot Mirror

IBM Shipping More PCs with Trust Chips

23 of 476 comments (clear)