Slashdot Mirror
IBM Shipping More PCs with Trust Chips
rts008 submits this EWeek story about IBM shipping more computers with trusted computing inside. Since the article mentions none of the downsides, we should: trusted chips will eventually be used by software manufacturers to make sure the computer's owner does not do anything with the software which the manufacturer does not want to permit.
I TRUST YOU
Yeah, paranoia is fun and all, but I wouldn't mind a few links to support the downsides claim.
You'ld think IBM would know better than to associate the word "Trust" with "Technology". That combination is like a buzzword for suspicion to the Tech-wise.
trusted chips will eventually be used by software manufacturers to make sure the computer's owner does not do anything with the software which the manufacturer does not want to permit
This concerns me.
More from a grammatical standpoint than anything else.
(and my grammar/spelling is not necessarily perfect...but I dont get edited
[I can picture a world without war, without hate. I can picture us attacking that world, because they'd never expect it]
Remember, trusted computing has its place. Maybe not on the desktop, but I can see it useful to lockdown point-of-sale machines, kiosks and librarys. It would be a hell of a lot easier for some places than it is implementing Group Policies and permissions for a computer that should be used only for a specific task.
Remember, only hackers run Linux, and other un-american things on their machines! Buy today, or the terrorists win!
Industry spokesman: "... but this will stop those evil hackers taking over your system. Surely this is what you want? Oh, well yes, it CAN be used to restrict the way you use your legitimately purchased software, but don't you think that's a small price to pay?"
what I don't like about this concept is that the problems that mainly affect the lower end (non-tech users who can't secure their PCs) will result in more restrictions on the top end (tech users who can 'creatively' use products for a purpose outside their original design parameters). the punters won't notice.
Screw you all! I'm off to the pub
Does anyone know if PPC chips have "Trusted Computing" components built into them? With the G5 becoming more prevalent in Apple's product line, and being manufactured by IBM, I wonder if Apple would hop aboard. My PowerBook is fairly new and I won't have to upgrade for a few more years but this worries me a bit. Hell, I started using a Mac to get away from Windows Activation and all that crap in the first place.
I like big butts and I cannot lie.
The main problem, as I see it isnt even with using this kind of technology fro copy protection - its the changes in software licensing that will come as a result of this. Think windows XP activation is a bitch? imagine quicken refusing to install because your new laptops trust chip is different... :(
"Putting the data in the system's hardware makes it more difficult for hackers to access, according to National Semiconductor."
If the system software can access it, so can a hacker.
Ignorance is curable, stupid is forever.
Urm ... What happened to the old saying "Trust is something you earn" ?
In my book money cannot buy trust. And just because somebody slaps the name "trusted computing" on a piece of silicon it does not mean that I am going to "trust" it without question- even if they are being shipped by IBM (who can do no wrong!)
I also have an issue in that who's trusting who here ? IBM ? the computer hardware ? the software ? or me?
I dont need a chip to tell me that i can trust myself, thats for sure!
Nick
Electronic Music Made Using Linux http://soundcloud.com/polyp
My 2 year old Thinkpad R32 allready has a TCPA Chip build in. :-)
It's really nice, if you want to hardware encrypt your data. Just hope the TCPA chip never fails...
I can assure that no processes run on my machines that I didn't authorize now. It's when I can't run any processes on my machines that Bill doesn't authorize that we have a problem. You can cry "tin-foil hat" all you want, but where this technology ultimately leads is to DRM locked-down boxes that won't run anything not signed by an endorsement key from an "authorized" developer.
When did Slashdot gain the ability to see the future? While I know we disapprove of "trusted computing" and similar systems, and for good reason, for a blurb wanting to talk about balance, that's a pretty damning statement. Trusted chips can be used to lock down software stop users, not will. We're still early in the game, and damn if we don't have any influence, but that future is still a long way off. How about instead of just bitching about "trusted computing" we start to drive it towards something that's mutually beneficial: something that allows businesses to exert power over their internal affairs(locking down documents and such), and something that lets users exert power, such as locking down systems against worms, viruses, and spyware?
The book on trusted computing hasn't been written yet, let's not call it before it's done.
I wonder how long it will be until everything contains trust chips.
I was thinking about this earlier last week, and made a decision I'll try to stick with - I'll get the most cutting edge PC I can that doesn't contain any builtin DRM, and then see how long I'll last.
Except for games, I think I can last quite some time. As it stands, the only thing I need a lot of extra horsepower for is gaming. I don't mind waiting an extra bit of time for a program to compile, and everything I use now works fine even on an old P3 667. If push comes to shove, I'll just game on a console and do my compiling on a stand alone machine.
The only 'bite me in the ass' possibility is if they start building hardware (video cards, hard drives, ram, etc) that demands the use of this DRM chipset, then I'd be screwed. If not, I bet I could push my next PC purchase out to easily over 5 years.
Looking for hardware (Currently need: Large Etch-a-Sketch) Have one? See my journal!
Actually, I know that the recent IBM Thinkpad laptops have shipped with this "trusted computing" system for awhile now. It's not (yet) supposed to lock your system to Windows only, as it is a way to lock your laptop so that your data is safe (on a hardware level) if it gets stolen.
As this is something new that PC users might not expect, I wonder if IBM is taking any effort to educate purchasers about the "new functionality." While people might like to know that this might help stop the evil hackers, they should be told that software might stop functioning like they want (assuming the user does something bad, like use pirated copies). I can imagine the increased tech support calls arising from this...
Good.
Instead of encouraging people to break the law (pirate software, etc) - I wish more people would choose software that _grants_ them the right to use it as they see fit.
I wish everyone in the world had to pay full price for Microsoft and Adobe software instead of copy it or buy cheap pirated versions. Then people would start recognising the value of Free Software.
Until then, pirated windows is probably the strongest competitor Linux faces.
trusted chips will eventually be used by software manufacturers to make sure the computer's owner does not do anything with the software which the manufacturer does not want to per
My god, you can see the future too? I thought it was just me! How long have you had the gift?
[/sarcasm]
Seriously, the chips the article is talking about are completely user-controllable. If they don't want to take advantage of the functionality, they don't have to. Did you even read the article? It talks about how the chips facilitate encryption and secure storage of passwords and other sensitive information, not controlling what the user does with their computer.
Making vague, unverifiable assertions about the possible applications of a technology that could potentially be derived from this one is nothing but FUD.
This space intentionally left blank.
trusted chips will eventually be used by software manufacturers to make sure the computer's owner does not do anything with the software which the manufacturer does not want to permit. at least it will prevent you from running unsigned spywares.
This Sig is removed due to factual inaccuracy
While vendor lock-out is definitely a threat, it's not a terrible threat because amateur developers are such a key part of the industry, and always will be.
What concerns me much more is the stuff that's going to start happening when "trusty" computing becomes ubiquitous, if it ever does. More and more important transactions and secret info exchange will take place over the net. and of course you know the government doesn't allow good encryption for "national security" reasons.
the article talks about the security and encryption being in hardware rather than software as though that was some sort of improvement on it, but who wants to replace their hardware as soon as some 1337 5kr1p7 k1d5 figure out an exploit? and it's only a matter of time.
on the other hand this is one of the few technologies that could permanently cure the world of spyware (the other obvious one being dumping windows altogether.). of course with every new anti-spam technology, the spammers are the first on board, so I imagine the industry will sell out again and no good will come of it.
This comment is fully compliant with RFC 527.
It seems that manufacturers and publishers are just determined to alienate the consumer with this kind of shit. The only way to stop it is to take their profit out of it. Just say no with your pocketbook. They'll get the message sooner or later, assuming they don't pay off some politicians and get a law passed to make DRM mandatory. Oh wait... we're screwed.
When all else fails, run.
ok, so IBM is shipping those machines... but does anyone think that IBM could use those chips eventually to block WINDOWS from being installed on them? look at the bright side, we may end up with a 'LINUX ONLY' line of machines... Big Blue is pro-open source, as it's showing in the SCO lawsuit and elsewhere... So, I wouldn't worry too much about it... yet.
---- I am certain of only one thing : I know nothing else.
If these silly licenses will finally be enforced, people will start to demand software that they legally own the rights to - as opposed to simply stealing it from work.
The best thing that could ever happen to Free Software would be if people were no longer able to steal software from their companies an no longer able to buy cheap pirated versions.
Finally the general public would understand what the Free Software movement is all about.
Knowing how exposed most software is to things like worms, it would be very easy with powerful control hardware to lock people out of their systems without actually damaging the system. One of the things I find very interesting is how does one go about preventing a worm from rewriting certain parts of Windows and user apps so that they think the trusted hardware is either not present or does not let the user do what they are trying to do?
If after a year and incredible amounts of money spent on R&D, Microsoft cannot really slow down the spread of worms, how can they write an operating system that cannot be totally mindfucked by a worm that twists how Windows deals with the trusted hardware? So maybe Microsoft requires code signing, who is to say that someone isn't going to find a way to spoof a real code signature so that the worm appears to be Microsoft?
My money is the proposition that they'll try it, it'll work great for 3-6 months then people will start writing worms that target trusted systems and that totally ruin them. Then it will be a big flop within 2 years. IBM, Microsoft and other companies need to realize that the human component of security simply cannot be automated. Despite all of their attempts at real security, Microsoft cannot deal with the fact that the single greatest security hole in its OS is the user that never patches and that thinks it's not cool to remember what they aren't supposed to do to avoid getting worms and other hacks.
And if it doesn't work, just stock up on as much pre-trusted hardware as possible and put it into a closet for safe keeping....
Click here or a puppy gets stomped!
My main problem with "trusted" computing is the fact that it could lock out software that the manufacturer of the computer deems "not trustworthy." But, what does "not trustworthy" mean? Could some manufacturers use this technology to further entrench the Windows monopoly by locking me out of my "not trustworthy" Linux or *BSD disks? I could just think of the things that MS could do, such as force its vendors (Dell, HP, Gateway, etc.) to only ship "trusted" computers. I know, I know, I might be paranoid here, but I'm just saying that this is possible.
Michael, I'm afraid you're mistaken. No processes will be allowed to run on your machine that *Microsoft* or a similar vendor did not specifically authorize. This means that the boot loader can be signed to prevent you from running a non-Windows operating system, a CD or DVD or hard drive disk can be signed to prevent legal and authorized duplication for what is legal home copying, and emulation software such as OpenOffice can be prevented from making the system calls to open data files generated with Microsoft Office, helping keep the Microsoft monopoly locked up.
Moreover, it can prevent experimenters from being able to design new drivers and software tools to work with the crypto-authorized hardware without spending very large amounts of money on development tool suites with frankly larcenous intellectual property agreements.
This development is potentially extremely nasty: while we're somewhat paranoid about it, the history of abuse of standards to lock customers into their monopoly justifies extreme concern about what Microsoft might do with these features.
Trusted computing: when a corporation will sell you piece of software/hardware for your hard earned cash, and not have enough TRUST in you to use it properly.
:/ Serf it up!
Seems a little "guilty until proven innocent", eh?
We trade our money (which is ~time) to a corporation for their product. Then they try to tell us what we can/cannot do AFTER the transaction. Seems like feudalism is alive and well
I don't see how that fill succeed. I mean Trusted Computing is a quick fix to a problem with no real solution. There are ways to crack/bypass trusted computing, what then? This will only work for so long.
... and nothing really bad happens.
Lets look at mobile phones; for example in SE T 610-630 you can only run signed Mophun and limited Java code; in cheap models you cannot run anything not directly installed. Why not?
I prefer this situation even to Symbian phones in which some viruses are already been created.
I guess I will need to code some trusted hardware emulator soon, 'cause my current boxes lacks that preciouss chip. Any spec on sight, anyone?
There you are, staring at me again.
Before we jump to conclusions about how this will ruin our computing lives, let's think about this for a second.
Some companies, such as IBM will provide systems with these chips in them. Some customers will buy them, specifically, customers who want to have only authorized programs running on their systems - customers worried about security. That there is a market for these systems is not a question.
However, there is also a market for systems WITHOUT these "trust" chips. And manufacturers will continue to provide systems without trust chips. If you don't want to buy a "trust" computer, don't. There will continue to be plenty of computers without this feature.
Thank you Mario! But our princess is in another castle!
What if this goes against a country's laws, if a country has laws in place of something like this?
Michael
http://s1.sfgame.us/index.php?rec=58163
That's complete bullshit, and anyone with half a clue about the industry knows it.
Even Linus has no problem with trusted computing. As far as sensible people are concerned, Microsoft is free to make their OS as cumbersome and useless as possible.
Trusted/Treacherous Computing is for one reason only. (Like they really care deep-down if your copy of Word or your Britney tune is legit!) But they DO want to control your ability to communicate in ways they can't sniff and your ability to publish something they don't like.
"Don't belong. Never join. Think for yourself. Peace." V.Stone, Microsoft Corporation
I can just he the healines on hacking sites:
HowTo: Hacking your IBM
Or warez headline:
IBM ____ Crack By ___
You mean a similar vendor like SuSE, Debian, or gentoo.org?
Trusted computing enables software vendors to enforce the license restrictions that they put on their software. If you don't like the licensing terms of your OS provider, you should really look for a different one.
I'm fine with most of the restrictions Debian puts in their licensing agreement. I never did understand Microsoft's (what, you mean I can't install it on all my machines!?!) so I don't buy OS's from them.
I for one welcome our new...
*ducks*
except it the hardware will also enforce it
Suppose that I back up my data and then my motherboard dies. Now I can't restore my backed up data because the new computer doesn't trust it or it doesn't trust the new computer.
I remember a time when software vendors made it impossible to back up 5 1/4" disks by physically damaging them. The customers reacted by not buying their software and they backed off. I also remember a very early version of XP that wouldn't let you change any part of your computer without phoning Microsoft for a new key. Customer reaction was such that XP is much easier to deal with now.
It also occurs to me that if the trusted computing chip keeps legitimate software from running then that is restraint of trade.
The attempt is futile because every attempt to prevent illegal copying has been defeated. Some Taiwanese engineer will design a hardware addon to enable the customer to illegally copy the software.
The only way to protect the trust chips is to obtain a federal injunction (from a judge) barring hardware hackers from circumventing the hardware anti-piracy chips. However, those injunctions apply only to the USA. The Taiwanese engineers will gleefully ignore the injuntion -- as is their wont. The Chinese in China (including Taiwan province and Hong Kong) routinely ignore Western standards and custom.
After all, China is the software-piracy capital of the world. The piracy rate exceeds 91%.
Move along. /. is not the site you were looking for. Move along.
Only problem is the HARDWARE is 'trusted', meaning the os will have to be 'trusted'
This could be a good idea IF it were optional, rather than embedded in every single chip that rolls off the line. Most of us know that the majority of sytems out there are horribly insecure, mostly because their users have no idea what to do when it comes to sysstem security. This hardware could be marketed towards the technically challenged, and it would tie up a lot of the loose ends that give headaches to those of us who know what the hell we're actually doing.
The problem is that including this across the board will cause more headaces in the long run than it would cure. I certainly have no need for such hardware, and I'm pretty damned sure most of the readers here don't need it, either. If we had these things embedded in our own systems, it would cause us more problems than it would solve.
Techheads don't need this chip... but AOL users do. if its optional, I'm all for the idea -- but if it's just going to be there, then I don't want anything to do with it.
At the moment, its just too easy to pop the CD in, or download something you only want to use this one time.
If that one time _really_ did cost you the $400, its suddenly not the package for you, is it?
Example - The missus complains that she doesn't want to use or understand Linux, so what do we have to do, we have to install that nasty stuff - but we shouldn't fork out the list price of $900 for the software - O no. You're in IT aren't you, you can easily grab a copy from work .....
TCPA (the chip that's in these PCs) is simply a Crypto co-processor. It provides acceleration for common crypto algorithms and it also provides a tamper-resistant storage location for keys. IBM maintains an Open Source implementation for the processor.
There's already been really neat things done with the chip like a truely secure version of Linux that's entirely tamper proof (this is doing by signing the kernel and boot loader with the TCPA.
Put away the foil hats people, this is actually really cool innovative technology that so far has given Linux an edge in the security world over Windows.
int func(int a);
func((b += 3, b));
Doesn't the Pentium III have that dreaded CPU identifier built in that's set on by default so people can log and track where you're browsing? Wasn't this supposed to cause the sky to fall in 1999 or something?
Introducing the new Occam Fusion! Now with sqrt(-1) fewer blades!
Or at least one of the primary problems is that average customers have become so accustomed to shitty programming(thanks, in large part, to our boys in Redmond)that they're being duped into thinking the only way to have a secure system is to use a computer that has devices like this installed.
I gotta hand it to BillyG. Using shoddy software to lock out the competition.(That's what it'll turn into.)
Of course, the RIAA and MPAA wont have too much of a problem with this either.
You bet I can. I run only Free Software!!!
:-)
Personally I am not opposed to the trust chip technologies because I think that we are to the point now where the interests against extending copyright protections are stronger than those for it. I also think that such trust chips may allow many new applications which we can't think of today in the Free Software world.
One trend I think people often fail to understand is that freedom from EULA's becomes more appealing the more the mainstream technologies become encumbered. If Microsoft wants to fight their users, great! We welcome the refugees
LedgerSMB: Open source Accounting/ERP
Just curious how these things works. Anybody got an overview ?
It seems it can store digital certificates.
Now, things have to be verified against these things I guess ?
Won't someone find a clever way to intercept the communication to that
chip, and fake responses ?
Or if the software (e.g. an exe file) needs to be decrypted to run, won't someone find a way to snatch the decrypted code from memory ?
The fact that Linux even exists means The Terrorists have already won.
The hardware doesn't enforce crap. It provides a layer that can't be modified by software (ie: "trusted") to perform certain operations invoked by software.
Man, did anyone read the article or check out how IBM markets them on their webpages? These things are for encrypting documents, passwords, storing things you don't want people to get to easily. I've sat through a few seminars and presentations from IBM and how they tout this is to protect your DATA from other people, not protect a copyright holder from you.
As a rock-in-roll Physicist once said, No matter where you go, there you are.
Kiosks and the like would be better locked down by putting up only the display for the public to get at, and by keeping the guts of the machine (especially the disk) out of the way (behind a wall, locked up in a box etc). If I can reboot the machine from the access given to the public, I suspect I can do quite a bit - even with trusted computing infrastructure.
What kind of "root access" doesn't allow a customer to run his own binaries? If a customer can't be trusted with root access without damaging anything other than his own resources, he or she shouldn't be given it. Now if these were removable, opt-in, devices (not just software switchable, but physically removable), I could support them in that sort of application.
You mean only run a small set of programs that someone chooses, with compile options, version, etc., etc. also chosen for them?
# cat
Damn, my RAM is full of llamas.
The whole point of "trusted computing" is that your computer trusts some other entity more than the user or administrator of that machine. If you had the encryption keys to make anything you wanted work then it would be a good thing, but that would defeat the purpose MS et al. have designed it for.
Trusted computing means your computer doesn't trust you. Personally, I'd find it rather hard to trust my computer in such a situation.
At best this will mean owning two computers; one which doesn't trust you (but which Microsoft does trust), and one which you can trust. I just hope the machines we can use to run code we can trust (ie open source) won't become prohibitivley expensive or even illegal (and you can bet the **AA et al. will want *every* machine sold to trust them more than you).
Chernobyl 'not a wildlife haven' - BBC News
should be reading John Walker's Digital Imprimatur to see what its real purpose is.
This sounds like a nice idea until you find out that the hardware manufacturers are working with the software vendors, and will prohibit you from installing anything other then what *they* approve..
Approval wont techincally be 'restricted', but you will have to go thru a approval process, which wont be cost-free.. ( just look at getting ISO certification.. its not cheap )
So, that means little LEGAL free software will run on your 'trusted PC', as the cost of 'certification' ( as well as the rules and regulations you must follow for approval ) will be far to high for an OSS project to afford.
In the end, its got little to do with piracy, and more to do with control.
---- Booth was a patriot ----
I wish everyone in the world had to pay full price for Microsoft and Adobe software instead of copy it or buy cheap pirated versions. Then people would start recognising the value of Free Software.
There are other legal ways of getting software below the full retail price.
I still have a valid college ID. I can get academic discounts. I work in this field, and have for a long time. I can get cheap copies of programs from company reps. Adobe gave me a free copy of Photoshop.
Until then, pirated windows is probably the strongest competitor Linux faces.
Linux just isn't for everyone. I have 3 linux servers running under my desk right now. I'm also typing this on a machine running XP. Each OS has its strengths and weaknesses. If you have more than just a hammer, not everything will look like a nail.
LK
"Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
Until then, pirated windows is probably the strongest competitor Linux faces.
Marketing FUD is the true competition for linux and similar, IMHO.
In which case you have authorised anything to run. The original poster is correct apart from instances of machines being hacked into, virus, etc.
Obviously, those of us who build our computers have a bit of a buffer zone when
it comes to trusted computing, but that isn't going to keep people safe
forever. What are the signs and/or identifying marks of Trusted Computer based
parts? I can build computers all day long, but if I don't know that the swanky
new motherboard I bought has a Fritz chip on it, that's obviously a problem.
Hopefully China will still be making non-TC'ed parts.
SealBeater
-- Its survival of the fittest...and we got the fucking guns!!!
This is clearly a troll.
"But trusted computing to the OSS world really means that no processes will run on my machines that I didn't specifically authorize."
It's already like that; "trusted" computing isn't about you keeping control of your machine, it's about *others* controlling your machine.
If trusted computing does become a reality, I hope that it is successful in enforcing one thing... preventing the pirating of large commercial applications like Photoshop, MS Office, and Windows itself. How many "Joe Users" do you think would actually be using MS Office if they actually had to PAY for it? I'm sick of my friends/collegues saying, "Why would I use The Gimp or Openoffice for free when I can use Photoshop or MS Office for free?". I'd like to see how quick they are to dismiss OSS alternatives when they actually have to PAY for the software they are so used to stealing.
I'm not saying that Trusted Computing isn't without a myriad of faults, I just think it will be a big eye opener for the general populus when they realize how much they would be getting ripped off if they were actually playing by the rules.
What do you think?
That is today. If ever OSS is outlawed and prevented, then you can bet on it that the price will be the same for everybody; 2K+ for the OS,and 1K+ for each app.
Each OS has its strengths and weaknesses.
Yes, but some are concerned with doing more with the desktop while others are concerned with preventing others from playing.
I prefer the "u" in honour as it seems to be missing these days.
However, there is also a market for systems WITHOUT these "trust" chips. And manufacturers will continue to provide systems without trust chips. If you don't want to buy a "trust" computer, don't. There will continue to be plenty of computers without this feature.
Right, until a law gets passed requiring all new hardware to be "trusted". And before you think that can't possibly happen, look at some of the semi-draconian laws that have ALREADY been passed in recent history (DMCA, Patriot Act), and then, keep in mind that companies like Intel and MS are ALREADY trying to lobby for this (i.e. some kind of DRM in all of the software and hardware, in everything).
Now, I think the chances of such a law getting passed are relatively low (kind of like the INDUCE act, because it's just TOO broad), but, the sooner we raise our concerns about all of this, the less likely it is to actually happen. If we sit complacent all the time and "just don't worry about it", bad laws will keep getting passed. And it's a lot harder getting a law shot down than it is getting it passed.
The story said:
It should be noted that what we're really talking about is preventing the computer's owner from doing things that Microsoft and their allies (such as the MPAA) don't want to permit.The computer manufacturer, such as IBM, is largely irrelevant, except to the extent that they may eventually offer hardware that will refuse to run operating systems they don't approve of. Since IBM supports Linux, it doesn't seem likely that they will build machines that can't run Linux, but many other vendors have hitched their wagons more firmly to Microsoft.
Seriously: we have this already. We have the Playstation 2, we have the X-Box, we have (name your favourite piece of controlled hardware here). Both of them incorporate something that could be called "trusted computing". If it ain't signed properly - it ain't trusted - it ain't run.
Few consumers accept(s/ed) this and buys a modkit to solve the problem. Same way it will be for the IBM hardware.
Maybe this even has a more negative impact for software sales than they envision:
If software manufacturers rely on this piece of technology to protect their investment completely (as with XBox and PS2), their software is going to go just as easily as buying the modkit. And because their software get's spread more easily (any person with a modkit can copy their software), they will lose more money - and need larger margins to keep afloat, which leads to a spiral of less software sales. Thus, in the end, noone but large players will stay behind.
I vote for a namechange:
Trusted computing becomes Assured economic software failure...
Slashdot: stuff for news, nerds that matter, matter for news, stuff that nerd
If this prevents the computer illiterate people from running malicious software (which probably makes up 99% of the world), I'm all for it. If you think this can be used to prevent legitimate software from running, I wouldn't be worried about it. How quickly do you think an anticompetitive lawsuit would be filed if that happened? There's a good chance this feature can be enabled/disabled (preferrably not programmtically).
If there's a law passed in the US banning such hardware; import.
Looks can be deceiving. Or CAN they?
Of course they will be less expensive for the same reasons Winmodem are less expensive than hardware modem
You mean they'll be half-assed imitations made for the purpose of bilking those who don't know better than to buy them?
This looks to me like something that is already happening, namely the move from general-purpose computers that you install software on, to computers for email, word processing, web browsing that don't even seem to need the capibility of running 3rd party binaries. Look at Windows users. Many of them do not install anything that didn't come with the machine. They use outlook express, IE, word, MSN messenger and thats it.
This is crazy. A PC is a general-purpose computer. It is there so you can do things it wasn't designed for.
# cat
Damn, my RAM is full of llamas.
Oh, like THAT will take the virus/worm writers all of 3 minutes to work around...
They'll just make the same mistakes in the hardware/firmware as they do over and over again in the software. Nothing will change, other than the less technically savvy losing more of their computer to the manufacturers and developers.
I work for the Department of Redundancy Department.
> This means that the boot loader can be signed to prevent you from running a non-Windows operating system,
Although I fear that as much as the next guy, actually I trust that having a windows-only boot loader would be such a clear sign of monopolistic behaviour that even Microsoft wouldn't get away with it in court.
Visit http://ringbreak.dnd.utwente.nl/~mrjb/growingbettersoftware to download your free copy of the book
Since none of the big time hardware makers also make major software, why the heck do they give a second thought about software piracy issues at all?
And exactly why is AAC's DRM "less evil" than WMA's DRM? Because it is made by Apple and not MS??!?!
Anyone else like a big slice of bias with that? Anyone?
Who is it that truly has control over the software industry? Who is it that developes the software, tests it, fixes it, improves it? Is it the marketroid with his thousand dollar suits? Is it the CEO, the Compay President? HR? No, it's us. The geeks, the only bunch of people on this planet what have a complete grasp of the technologies upon which everyone has placed their future prosperity and dependency.
It's about time we realized that no matter what technology the business types come up with to protect their so-called "intellectual property", no matter how subtle or insidious the technique, they will requrie one if us to implement it. This one fact means we will forever have access to information that others do not, and the attempt to prevent us access to this information is futile. We are smarter then you. We will figure out problems in your design before it's even implemented, because that's what we have been trained to do.
It's about time the rest of the world learned that it is in *everybody's* best interest, including the marketroids, to let us fuck around with technology without restriction. You can do whetever you like with what we create, we don't really care. All we want to do is to create new and ingeneous solutions to difficult problems, and to find newer and more difficult problems to create solutions for.
As the level of technoloy increases, and the complexity of that technology also increases, it will take a special kind of brain to keep up with those changes. A geek brain. C'mon folks, most people can't even program their VCR! How will they react to a world where everything, from currency to shoe leather, has some kind of "smart" technology embedded in it? They wont - they'll get us to deal with it. Like they always have.
While trusted computing for general purpose home PCs is a dangerous concept for civil liberties, trusted computing does have places I think could be very useful.
Corporate PCs and servers. With a hardware enforced trusted computing policy, it will be much harder for users to bork the corporate network by installing a virus and spyware ridden warez game or weather bug thing.
Safety critical systems could also benefit, to prevent user modifications that could cause the system to operate in an unsafe manner.
Trusted Computing certainly isn't a cureall even in these cases, but its not a completely evil thing. It does have legitimate uses.
"Since the article mentions none of the downsides, we should: trusted chips will eventually be used by software manufacturers to make sure the computer's owner does not do anything with the software which the manufacturer does not want to permit."
Then people will start choosing the software that does permit them to do what they want. Might be a downside for uninformed users in the short run, but seems like a good thing in the long run.
If you want to know more about the difference, you can read an article about it here.
So...don't buy them. The only people that will buy these products will be people that don't care in the first place because they don't have anything to be worried about. And as far as I know, Orrin Hatch hasn't come up with some horribly worded bill to force Trusted Computing on everyone. Vote with your wallet.
HI, MY NAME IS ISAAC.
I've been thinking about the same problems caused by a "trusted computing" system. Obviously they are immense, but there seems to be an out.
New systems that use TC will likely have a hard time being sold. I can only see businesses buying them, and without a reasonable test base (of gamers, music pirates, and geeks) MS will have a hard time convincing businesses that their new software is sufficiently reliable.
In the past Microsoft has succeeded in marketing. I think however that when they are trying to sell something for which there is no demand, they face a much larger challenge. It would seem that initial low costs would lure buyers, but in the past microsoft has succeeded by providing the biggest and baddest(no pun) product. Hey, Sun even decided they needed to charge more for their product to get respect.
"And we have seen and do testify that the Father sent the Son to be the Savior of the World"
1 John 4:14
Stop bellyaching and stock up on non-drm PC stuff.
While you are at it, simply do not buy any DRM-encumbered PC hardware (provided the vendors reveal this fact in their advertising). Use the only language the hardware vendors understand: money talks!
Should the internet 'go-DRM' and non-DRM PCs are 'locked out', bring back the good old days of BBSes and Fidonet which was, if I am not mistaken, an 'internet' comprised of networked, always connected BBSes.
Given this particular definition, "trusted" is exactly the right thing to call this sort of hardware, although perhaps "blindly trusted computing" would be better.
THIS should have been posted with the story, not Michael's snarky, cluless little comment (note: how is this guy still an editor?)
You mean compared to the rest of them? Really, Michael's no better or worse than any of the other slashdot editors. This has never been the place to come for unbiased news; nowadays, it's barely even the place to come for biased news.
It's official. Most of you are morons.
There'll be a nice licensing scheme for the key.
Which will first be incompatible with Open Software (licences) and second cost so it can't be included in freely distributed software.
Microsoft, Adobe etc. will just hold up their hands, it's not *their* fault this 'free' software will not run...
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
As it should be.
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
That's funny, I seem to remember Steve Jobs telling the MPAA that they absolutely should not release the next generation HD video formats until it can be completely and totally hackerproofed and DRMed. Sorry, I can't find the reference link on Slashdot (get a better search engine, please!!) or news.com.com, but it was reported on both.
they will be less expensive for the same reasons Winmodem are less expensive than hardware modem
Winmodems are less expensive than (fully) hardware modems because they leave some of the processing up to software. That means that they can skimp on the components, and so cost less to produce.
In contrast, these motherboards will have *extra* components on them, and so all other things being equal, will be *more* expensive than ones without.
(Note that I said "all other things being equal" - the manufacturers are free to take a loss by selling them cheaper, or skimp on other components/features, etc)
It's official. Most of you are morons.
Not really.
And why would you need new hardware for that?
TCPA does not give you more control than a boot-cd.
to those students out there studying computing? or those independant software developers?
Will these chips suddenly stop any written program from working unless 'signed'?
What will they do to let peoples program as usual? special compilers which auto-sign programs for them?
And what happens if one of those suddenly got out to the rest of the world. all programs which are signed from it get blocked?
hypotheticaly, what happens if such a compiler from say, Microsoft got out. would they block ALL microsoft products?
I think not. The potential for abuse of this system is staggering, and its ultimate worthlessness is astronomical. All it takes is for the system for 'signing' such programs to 'escape' ( or be rescued, depending on your point of view ) from a major software developer , and the whole thing is worthless.
"Of course they will be less expensive for the same reasons Winmodem are less expensive than hardware modem"
Um...by that logic the non-trusted hardware would be cheaper because it has less parts.
Winmodems aren't cheaper because of any tethering to Windows (in fact they aren't even tethered to Windows), they're cheaper because they're simpler, and use software to perform many of the functions that a standard modem performs in hardware.
Charging more for the board without the "trust chip" is plainly stupid.
I used to get high on life, but I developed a tolerance. Now I need something stronger.
But trusted computing to the OSS world really means that no processes will run on my machines that I didn't specifically authorize
You are running processes on your OS operating system, that you DIDN'T authorize?! WTF!
By the way, even with Trusted computing, buffer overruns, and exploits will still happen.
Ypu know the rest. This is about as scary as a dust bunny.
Sure, after you've inserted your national ID into the smart card reader.
One CPU cycle wasted on digital restrictions management is ONE TOO MANY.
It's so nobody swipes the RAM in the middle of the night to upgrade their own desktops....
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
What "Trusted Computing" gains you as a user is the ability to buy and run software written for the Trusted-By-Them environment, which the vendors might not sell for non-trusted platforms. So if you want to play "Example FPS Game" or play music CDs using the "Evil Record Label's Protected Music Player", using a trusted-by-them platform lets you do that. If you don't run a Trusted-By-Them platform, they might not sell you their game/music at all, or they might sell you a CD that plays the low-res version of the music on untrusted platforms, or sell you the crippleware version of the game that only has levels 1-3, or lets you play the whole game but doesn't include the Surround Sound or graphics accelerator support or something.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Hmm. It would be obvious, but so are various other behaviors of theirs. Given their demonstrable immunity from criminal liability for, say, stealing VMS from DEC and relabeling it as the Windows NT kernel, I'm afraid they will keep trying.
I'm still running Win2k on the MS system I have to keep around. This is solely due to product activation.
My 2100 users were still using Win2k primarily until we got an activation-free corporate copy.
Trusted computing is unwelcome in my environment and commercial off the shelf software that depends on it will not be purchased.
HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
Such chips make it more difficult for hackers to steal information from the user's machine.
And don't give me any shit about how since the article already mentions the upsides the summary can ignore them. We all already know how many /. readers fail to RTFA.
Dismissing an entire technology just because it could be used for un-/. purposes is not generally considered conducive to a good discussion. In fact, it really is no different from the RIAA bashing all p2p related technologies just because they could be used for piracy (in fact if anything it is probably worse, as p2p has a track record for being used to promote piracy).
Mathematics is made of 50 percent formulas, 50 percent proofs, and 50 percent imagination.
They've already done it. What is the X-Box, if not a PC locked down to MS-approved software? All they don't do is call it what it is.
However, remember that the X-Box is a bad example - it's Microsoft's product from base hardware up. You purchased the X-Box from them and you can only get their software (according to you, I don't own one, nor do I condone it).
Remember, the various parts and chips in a PC are made by quite a few different companies, even they do have a common aim...
IBM has had these Security chips available in their machines since 1999. I remember PII's with them built in.
All these are designed to do is interface with an IBM software product to encrypt files using a Hardware chip, do on the fly disk and network encryption and other security related protections that you couldn't do practically with just a CPU software solution.
Specificially, If you have a Thinkpad there's a good chance it has one of these right now. This was one of their selling points that if the System was ever stolen they couldn't get access to any of the data because it's all encrypted to the physicial hardware itself and only the original laptop could access it.
Their site for the current data on their security chip is here
This new chip definetly looks more advanced, and could possibly be used for DRM purposes, but in the end its going to do the same things as the older hardware and the older hardware could be used for the same thing.
In Soviet Russia, Trojan exploits YOU!
The trusted computing platform can prevent some kinds of malware from running, by limiting what you can do to the operating system without the platform's consent. Depending on how it's implemented, that could limit the spread of the malware, or could just turn it into a denial-of-service attack against the operating system, or could turn it into a denial-or-service against other Trusted-Platform-Only software (because the platform looks like it's been tampered with, the copy-protection in "Example Trusted FPS Game" decides not to let you play.) But more likely, malware vendors will concentrate on writing applications like IE Plugins that'll run fine on trusted platforms.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
preventing a worm from rewriting certain parts of Windows and user apps so that they think the trusted hardware is either not present or does not let the user do what they are trying to do?
Yes. The Trust system is intentionally designed to be extremely fragile. In the event of even the slightest disruption it is designed to die completely. Once you have a virus it is absolutlely trivial to have it nuke the Trust system and make all of your secure data and software irretrievable.
people will start writing worms that target trusted systems
I wouldn't condone such tactics, but I have to admit I find Trusted Computing so vile and malicious that part of me hopes it happens.
just stock up on as much pre-trusted hardware as possible and put it into a closet for safe keeping.
No, that is a missunderstanding of Trusted Computing. That's like stocking up on computers without speakers - there's no point. You can always use a new computer with built in speakers and simply ignore them. However then none of the new software or files or websites work at all, and you may even be denied internet access.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
If they've implemented it right, even if the Trust-Us-chip gets activated, that shouldn't bother your Linux any. It might prevent you from running Windows, or applications that use the chip, unless you've got the right licenses.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
IBM, Apple and Sun don't make software? Wow. News to me.
How come nobody has yet thought to take the "copy-protected CDs boycott" approach to all of this? It shouldn't be hard - let your friends, neighbors, employers, and coworkers know that their software vendors don't WANT them to be in control of the computer THEY worked so hard to "purchase," so they're trying a friendly little extortion tactic with their hardware vendors to implement potentially user-hostile technology. Let them know that they CAN and SHOULD return merchandise that doesn't function to expectations for a full and immediate refund. Have them call it a "fundamental defect" or something along those lines. I don't know about you, but "give us our master keys or we bankrupt your distributors" sounds like a reasonable approach to me.
With or without trusted computing, I think Windows users are going to experience more pain in the future. Ironically, the cause is XP SP2. I wrote a nice little journal article about it: MS vs the World. Though I agree, trusted computing (and a flashable BIOS) are just going to make the problems worse.
Eurohacker European paranoia, gun rights, and h
Not so fast... There is already a precedence. Have you ever heard of the mandatory broadcast flag that is being required in HDTV receivers starting next year? First televisions, then computers. It's not that big a jump.
When all else fails, run.
The TCG chip, also called Fritz chip and TPM (Trusted Platform Module) is mostly a repository of information. It doen't store by itself anything. The software/firmware of the computer does all this work. This is done by concanating hashes. Of course, it can work also as a repository of keys, and to sign (the TPM does not have a symmetric encryption like AES or DES). The information in the repository can also be bounded to a specific hardware state, hence the possibility of DRM schemes. But this is NOT the main purpose of the TCG. Security in Hardware is a MUST. TCG is a step in the right direction by creating a secure repository of information.
Software complexity increases exponentially versus time. Sure, "Trusted Computing" may be attractive to some companies, but so is "Reliable Computing" It only takes some Mark Twain style arithmetic to see that in a hundred years, every man, woman and child on the face of the earth will need to be working for M$ in order to keep Microsoft's rediculous excuse for an OS lineup bug-free . . . whereas the Open Source community is already pretty much a small nation.
And to those of you who are screaming about not being able to run linux on your computer, come on. That's vendor lock-in. Microsoft has already been buttraped enough times in Antitrust law suits.
Listening to the FUD on slashdot makes me think that the guys who wrote the Deus Ex script are regular users:)
Yeah, I dunno about runtime flags. I think if you wanted to restrict the system enough that only one specific program could .. say bind to port 22 .. you would also strip out the options/config file processing and hardcode everything. Also, of course, static link the binary. That'd probably be the safest way to go, and I really do think there's value in this.
I've seen some proposals for this for FreeBSD, but I don't see any of them being implemented unfortunately.
They own the server, and have other people install software on it. It's a less than ideal situation, I admit.
;)
I'm thinking it'd just be a kernel mod. If you can lock down the kernel (disable loadable modules, of course), perhaps even boot it off of read-only media, that would be enough most of the time. Physical access changes all of that, but then there's little that can be done there other than hire a trustworthy guard.
And of course, I'm speaking of an opt-in device (pseudodevice or otherwise), and only for specific situations at the sysadmin's discretion. I would not be in favor of a company forcing this sort of thing down my throat.
It's more like they've authorized us to work on the server. They own it and are ultimately responsible for it. We provide our expertise in the form of advice and often times sysadminly stuff such as installing software/monitoring processes.
These users often have to hire out to have software installed (closed-source type stuff). We do what we can to advise they change the passwords afterwards, but ultimately, it's their decision who they give it to.
If we could provide them with a reasonable assurance that, even though they're having someone install software for them, their server's core functions will remain untouched, that would be great.
InnerWeb
Freud might say that Intelligent Design is religion's ID.
It's not actually locked to MS-only.... well not successfully anyway
X-Box Linux
I'm not a "computer wizard" but isn't ALL of the data already stored in the hardware? Where else does one store their data? The Ether?
Normaly data is "in the hardware", but you can pull it up on the screen and see it and change it. It's not normally locked within the hardware and inaccessible.
The point of Trusted Computing is that there is a secret key locked inside a single chip and it never leaves that chip. You, the owner, are forbidden to see this key or to use it except in the way they permit you to use it.
And this key is used to lock (encrypt) pretty much all of the other data on your computer. You cannot look at or P2P your music files. You cannot even PLAY your music files, except in the manner the chip permits you to. Once you turn on the chip the chip owns your machine. It's not your computer anymore and you can't do squat except what other people specificly permit you to do.
And if you choose not to turn on the chip, well then none of the new software and files and websites work at all. You may ultimately be denied internet access unless you submit.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
If the system software can access it, so can a hacker.
The entire point of Trusted Computing is that the system software CANNOT access it. No software can access the data except the exact and unmodified software to which it was bound.
When you start a program it hashes that program. The chip uses that hash to create a decryption key. If you change the software you change the hash. If you change the hash you end up with a different and useless decryption key.
And another part of the new hardware is that even the operating system will be unable to look at the memory belonging to a Trusted program.
You can't get at the data without the original program, you cannot modify the original program, and no other software can peek at that program's memory. Depending how they implement the hardware the RAM itself might even be encrypted, so even a hardware attack would be useless unless you could break into the self-destructing CPU itself.
There is a damn good reason they are spending billions on this new system. It simply is not vulnerable to all of the usual attacks. It's not your usual futile DRM scheme. This is a plan to change the fundamental nature of computers, to deny you ownership and control of your own machine.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
Question: what's the difference between an integrated cryptography system that will protect your personal information from bad guys even if they steal your computer and an integrated DRM system that will take away control of your own computer and give it to various large corporations?
Answer: They are identical except that in the first situation, you have the all of the private keys and in the second you don't.
So Trusted Computing is a good thing if and only if I can replace all of the keys with ones I've generated myself.
If you did have the master key for your chip, then would you be able to "do your own thing," in a practical manner? Suppose I don't care about DRM issues too much, but I still want to be able to install Linux or some non-MS-approved software. Would the Palladium chip prevent me from using it even if I had the master key?
So, I see that you trust IBM, but I don't. And even if I did, it wasn't IBM's idea, it was Microsoft's. And even if you trust IBM and Microsoft, the RIAA and MPAA are going to use this too, along with the rest of the software and media industries. Do you trust all of them? Because regardless of how IBM uses this technology, it has a great potential for abuse, especially when, from what I understand, Microsoft designed it to facilitate that very abuse!
What we're seeing is the equivalent of Hitler (whoops, there goes the thread!) rationalizing to the Allies as he eyes Czechoslovakia. First they came for the "pirates"...
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
Fixing these problems takes serious work. Stop taking the techs for granted and try to lighted thier work load by preventing things tlike this.
You are right that it will not prevent Linux from loading. However the fact that some criticisms of the system are invalid in no way changes the fact of countless other criticisms of the system which are in fact valid.
The system is designed to forbid the owner to know his own keys. The system is designed to deny the owner the ability to read access or modify his own data except as permitted by other people. The specification mandates that if the chip glitches or dies it must be impossible for the owner to ever retreive his keys or data, no matter how many backups you have. The spec also mandates that it be impossible to migrate data except to a machine with an identical Trust chip from the same manufacturer. If they manufacturer goes out of business or ceases making that obsolete model of chip then when you computer dies or gets too old then your instaleld software and your data files MUST die with it.
The Trust system entirely defeats the GPL and any other open source licence. The source code is useless. If you change a single line the Trust chip prohibits that software from working by denying it the required keys.
The chip is designed to secretly communicate data to other people, data the owner is forbidden to see.
The chip is designed to spy on the owner, reporting exactly what software he is running and exactly what hardware he has.
Not only does every chip come with a unique tracking number, but I really love the Trusted Computing Group's own FAQ explaining their privacy policy. It says that the owner MUST opt-in or the system does not work at all. If some software or website or music file wants to see your unique ID number, or wants to violate your privacy, you MUST opt-in or that portion of your computer refuses to work at all.
The list goes on and on and on. And it would be a good system if they simply gave the owner a printed copy of his own keys. That would preserve every single benefit for the owner and eliminate every single valid objection to the system. However they simply refuse to allow people to have that good and beneficial system.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
Too lazy to create a sig...
I'm surprised this hasn't been mentioned yet, but anyway ...
.... ;-)
With the appearance of PCs with trustchips inside, surely the PC market is **ripe** for someone to set up a "certified as trustchip-free" body / organisation?
Just as you can now get your OSS certified as "open source", a "trustchip free" monitoring body could certify PCs as being "trustchip free", and pop a sticker on the case (just like certain chipmakers do
A nice big, bold sticker with a diagonal slash.
Ok someone, how 'bout setting up http://trustchipfree.org ?
There is ** Mega PC market share here for the taking** for anyone far-sighted enough to do this. OSS people would surely buy such PCs in preference to those PCs which were not certified as "trustchip-free".
Since none of the big time hardware makers also make major software, why the heck do they give a second thought about software piracy issues at all?
This is about VASTLY more than piracy issues. It is about changing the fundamental nature of computers, to secure them against their owners.
But to answer your question about why hardware makers are all on board, that's an easy one. Microsoft has announced that the next version of Windows - Longhorn - will only fully run with Trusted hardware.
That's it, a single Microsoft decree and every single hardware maker and BIOS maker and everyone else has no choice but to comply. If they didn't then their product would not be WindowsCompatible. When someone using Windows and that product complained then Microsoft would simply blame that product for being incompatible. That company would suddenly find themselves unable to sell their product and rapidly bankrupt.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
Surely this would not be intensely hard to get round. It needn't, after all, be one certification per distro - one cert for a single bootloader app ought to be enough surely? Once you've got something other than the default Windows loader allowing you to choose where to go next, its just a matter of tweaking - e.g. including an option to emulate a pre-trust bios in that bootloader (which is certified as being trusted) and boot from a CD, ISO, or wheresoever you want. Ok, the first certification process would be expensive. Bloody expensive. But lets face it, we're a community of 20000 plus here (hence the term Slashdotting). If every one of us donated £5, that's £100000. If 20% of us did, that's still £20000 - and I cannot believe the fee would be much more than that; after a while, it starts to bite into even the big companies. Once there's one properly designed free program that the bios knows it can trust, then free software has a way in, surely. And once there's a way in, the plan has, essentially, failed. At least for M$. £5 for free computing for the rest of this horrible era we're moving into. For me that's worth it. Granted, this way, the entertainment industry still has a lot of control. At least, until someone developes a trust chip emulator (by trial and error most likely, but I'd be surprised if it didn't happen). Then, of course, we suddenly find ourselves in a somewhat more favourable position than we do at the moment. Sacrifice some CPU time to emulate it, create a virtual virtual sandbox that gets there first, and all of a sudden the industry thinks it can trust you but no longer can. We, gentlemen, are on the brink of a long and bloody war. But its by no means one - even should trusted computing become the standard that everyone expects - that we cannot win.
Out of interest, would it be remotely possible to gain your master key through the use of trusted emails, perchance? Or something similar at least.
I mean, if I'm getting it right, when a piece of trusted software comes through, you have an excrypted lump of goo sitting on your HDD. Then you run it through the trust chip and it essentially cleans it up until its usable (perhaps a bad description considering what's really going on).
However.
The enigma machine code was broken by knowing what was supposed to be being said. The weather was obvious. It was encoded using the Enigma. Therefore if you have the weather code book and the encoded message you can decode all messages.
So. Think about it. Send yourself an email - preferably a long one. Make sure it is trusted. You, as the author of that email, know precisely what's in it. If you send it via a local private SMTP server directly to an account on the internal network, then you probably know all the header information too. And you've also got the "trusted" email, all nicely encrypted up. Do that a few times, and surely it would be possible (if not easy) to create a program to decode the trusted email into the original one. Which is, presumably, your master key.
Voila. Broken trusted computing.
Any chance anyone could tell me why this wouldn't work?
I'll tell you one reason to hang onto that non-TC hardware: THAT is where my data I can't live without will reside. Where *I* can have my way with it however I please. If the price of keeping my critical data *MINE* is using primitive (and unTrusted) software that barely does the job, that is still better than the scenario engendered by "TC chip failed, chip company out of business, data lost forever?? aw, so sad..."
~REZ~ #43301. Who'd fake being me anyway?
Using this chip is entirely a matter of the operating system (kernel). If Microsoft wants to enforce its use, so let them! As far as Linux and other free operating systems are concerned, there's always the option of turning this chip off.
Hardware security is always a matter of combining kernel und hardware resources. It's the kernel that loads a program, opens a file etc..., not the hardware. The hardware is used by the kernel to do such stuff. If the kernel doesn't want to use a particular chip, it can always do without (e.g. emulating stuff in software, or even using the chip in creative ways that the chip designers never thought about in the first place).
The real restrictions are ultimately imposed by the kernel (and other userland programs), not by the hardware per se.
On a "political" side, the existence of such chips may even be beneficial to Linux: imagine a tightly controlled "corporate" or Microsoft software world where users are being bound by vendors (just like today, but even worse); and a free Linux world where users are free to choose whatever setup they like.
In the long run, if you can do things under Linux that you can't under Windows, esp. popular stuff, do you expect Windows' supremacy to last?
cpghost at Cordula's Web.
Here's why:
1) Palladium will prevent wide-spread piracy of existing software, such as Photoshop, MS Office and Quickbooks.
2) Users will want to get software which does this, so they will turn in desperation to Gimp, OpenOffice.org and GNUCash.
3) Local open-source advocates will earn $$$ from supporting these applications.
4) Profit! (for everyone but the convicted monopolists.)
Paul Gillingwater
MBA, CISSP, CISM
...and yet I get "first post" on the article feedback link over at e-Week? For shame, Slashdotters, I was expecting a serious amount of easily visible criticism for non-geek readers of the article.
;-)
Unless, of course, all anti-TC comments are being removed from the feedback area by ZDnet
Sean Ellis
Follow OfQuack's antics on Twitter.
That's an argument for hosting them virtually rather than directly (e.g. VMWare as an instance).
I welcome the new trust chips. I always worry my computer will turn on me. Sometimes when I get in to the room the computer shuts up like it was speaking behind my back. I don't even known who he's speaking to. My stereo?
TC chip failed, chip company out of business, data lost forever?
Your old normal files can live just fine on a Trusted Computer. It only loses locked files, and it doesn't lock files without a reason/request to do so.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
We may not like trusted environments, but the alternative (of the infinitely hackable, trojanable, virus infested sesspool that we have now) is not very appealing.
Trusted computing = secure hardware + code signing
It does not mean the systems will not be hackable - there will still be exploits in signed software, but they will be much more rare. Presumably the hardware will refuse to run blocks of code that were not signed. But sign a language interpreter (VM) and you don't have to sign the code that runs in it, etc...
This will give us access to content and economics that have never been made available to us. Being able to spend (and profit!) will become easier and the stuff we can get access to will be higher quality as a result.
The real problem is not that you won't be able to burn that cd, but that you may have to have Microsoft approve your product before it will be signed. That is kinda scary...
If this is done right, there will be trusted "virtual computers" that can run alongside (e.g. as another user) from untrusted "virtual computers". Running trusted software in untrusted environments might result in a lack of features or content, but there is no reason that the software would have to stop running.
If this is done right (and it probably won't be), consumers will have the right to use their money to make decisions on how much sandboxing is acceptable and how much is not.
The reason that it can be true that 1+1 > 2 is that very peculiar nonzero value of the + operator
It aims to describe the difference between TCPA, MS Palladium and DRM, and explains what TCPA is usable for (crypt personnal data, store passwords,etc.), and what TCP is unusable for (restrain software execution).
The article is actually about chips that IBM allows sensitive information to be securely stored into and only retrieved by applications that are digitally signed or somesuch.
So your credit-card number would never be on your hard-drive or in the memory of an application that was not approved to fetch it.
This is a good idea.
The reason that it can be true that 1+1 > 2 is that very peculiar nonzero value of the + operator
If the sky really is falling, and tin foil ain't gonna protect me, then I want to find other ways round this.
Things like reversing the trust chip to privatise my hard-disk against anyone else reading it (and perhaps even wiping it if the correct login sequence isn't followed), or maybe developing a bittorrented equivalent of the William Gibson "Killfile" concept (such as amending torrents so that they are dynamically generated and interactive, so as to carrier and encrypt http-gets, among other TCP traffic).
However, being denied access to the internet is a ludicrous proposition: the internet works on free principles like mutually sharing messages (the peering agreement), and there will always be people willing to take the risk that freedom brings. I really hope that the people in the "land of the free" don't end up kidding themselves that they're free in the same way that 'freedoms' under communism were free.
Equally, tinfoil-hat talk of MS denying Windows Firefox access to run on its Trusted Platform will just result in another Anti-Trust suit. The OSS will PayPal (etc.) the cash for the lawyers, and the process becomes unfeasible.
Take care.
Ken.
Thank you for the information.
Looking at it another way, I don't see this chip itself as untrustworthy, because its operation appears "sufficiently open." In that respect, perhaps it can be considered a piece of "good security" because it's secret is the key.
The real issue here is whether you want any hardware Trust at all in your computer, because once you've decided to allow it at all, this looks like a decent implementation. I can readily accept that Trust may be necessary in some contexts, such as DOD or DHS or other security-intensive roles. I can almost see it in media players, because it is *their* content.
The problem I see is when it quits being *my* computer and starts belonging to someone else. I can see delegating Trust to a media company temporarily, in order to use their content. But when it goes beyond that temporary and limited Trust, I get queasy, too. I suspect the *explicit and temporary* act of delegation is the key, and some sort of requirement to verify that it is both explicit and temporary. Otherwise it's not *my* computer, it's the media's computer that they've somehow conned me into financing.
One side aspect where Trust intersects with Open Source... Sufficient information should be published for me to build the application and public key, to see that it matches the key of the distributed binary. In other words, if the source can be inspected and Trusted by the community, (meaning others better qualified than me) then I guess I can Trust the program, too.
But I'll have to agree, closed source software becomes a crap-shoot.
The living have better things to do than to continue hating the dead.
But if the TC chip dies and takes the OS with it, and maybe the filesystem with it for that matter (if you want to extend this to worst-case, a TC OS ought to require an encrypted filesystem, which in turn requires said TC to be visible) ... NOW what about your files, even your unlocked files? How the hell do you recover them without the original TC keys?
... and if it's a TC backup program, you can bet will it require the same TC system for restore to work (we wouldn't want someone restoring *restricted* files to a [gasp] different PC, now would we?) Or if you backup to some species of optical disk (CDR/DVD etc), it may require TC-applied DRM on the disk to prevent you from archiving files that it has decreed are one-system-only.
:)
That's what I was getting at re why old hardware may develop irreplaceable value -- I have a hard time imagining a TC system allowing a non-TC backup program to operate, and backups typically compress files
I can easily see "unlocked" files getting caught up in that sort of scenario; I just can't bring myself to trust it to never ever eat my data.
I've had to rescue a client's data files from a simple "fake bad sector transferred from floppy to HD" type of copy protection; even tho the files were there and not "harmed", they could not be backed up normally (you couldn't even PKZIP the directory), as the fake bad sector FUBAR'd backups of any sort. ISTM that a TC system could have much the same effect (only that they'd probably be lost forever) on nominally-unlocked files vs backups and/or hardware failures and/or OS/filesystem corruption.
(Gah, a person could get out of breath just *reading* that last paragraph
~REZ~ #43301. Who'd fake being me anyway?
I indicated everything in the TCPA rebuttle was correct. I just remembered there is at least one false claim. It says that the chip is not designed to be protected against pysical attacks. The tcg_specification_1_1b.pdf page 311 states that the chip MUST check "tamper-resistance or tamper evident markers".
One of his two papers, I forget which, claimed that the chip was ill suited to implementing DRM. I have read, and can personally lay out, exactly how the chip can be used to implement DRM using appropriate software support. The OASIS group and others are already working out extensive interoperable DRM systems to live on top of Trusted Computing. There's a software stack in the works and a full "rights markup language" called XrML.
On at least these two points David Spafford (author of Why_TCPA) was, at best, insufficently informed of the intended design, purpose, and capability of the system.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
TC OS ought to require an encrypted filesystem
Such a setup is possible, but it completely defeats the plan for driving adoption. The number one priority is backwards compatibility, ensuring there is no reason not to have/use the new machines.
I have a hard time imagining a TC system allowing a non-TC backup program to operate
Every TV machine has completely different keys. All TC data is encrypted to a key that only exists on that single machine. A backup program can duplicate encrypted data, but the only thing it can do is put it back onto the exact computer you got it from. Try to put it on another machine and it's unreadable garbage.
Non-TC programs simply cannot use or alter anything within the Trust realm (short of simply deleting some/all of it). It's all encrypted. Non-Trusted software simply is not a threat to the Trust side, it can't even peek through the window, much less get inside.
Allowing non-TC software to run avoids giving people a reason to stick with a non-TC machine.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
Every TV machine has completely different keys. All TC data is encrypted to a key that only exists on that single machine. A backup program can duplicate encrypted data, but the only thing it can do is put it back onto the exact computer you got it from. Try to put it on another machine and it's unreadable garbage.
And I expect with no way to sort out non-TC files from TC-encrypted files. That's what bothers me -- if you backed up your non-TC files from a TC system, how do you restore those non-TC files to another system in the event that the first system dies? Tell me if I'm wrong, but my guess is that you can't, because a backup won't differentiate data file "ownership".
I suppose one could do separate backups for TC and non-TC files, but if you have to go to that much trouble, might as well have a non-TC system for those files in the first place, and be sure that the TC OS won't go awry and assign them the wrong system attribute (or whatever they call it), thus removing them from your control (presumably this is a one-way trip, too).
BTW do you mind if I dump all your slashdot comments re TC (most of which I've archived) into One Big Rant and put 'em on one of my sites, to make it easier to point folk at the discussion? (Since it's been a lot more informative than just reading the official info.)
~REZ~ #43301. Who'd fake being me anyway?
if you backed up your non-TC files from a TC system, how do you restore those non-TC files
They aren't encrypted. They're ordinary files and they simply work when you load them on another machine.
If you save and load both types at the same time onto a new machine then the non-TC files work and the TC files are garbage.
do you mind if I dump all your slashdot comments re TC
Go for it. Anything to help get the word out. I've been thinking of making such a website, but the only traffic it would get would probably from any links I post on here. chuckle.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
Hmm... so the result, using non-TC backup software, would be a dirtree with some real files and some garbage?
:) Well, I'll try to get to it (in my copious free time, of course :)
Howeeeeever... Backup software normally uses proprietary compression; I'm thinking that a TC-aware backup program likely would encrypt one and all, and your non-TC files would be SOL.
And having seen Windows flipflop ordinary file attributes for no good reason, how can we trust a TC OS to *never* fuck up and thereby wrongfully encrypt non-TC files??
My various sites presently get ~35k visitors per year, and my buddy Chrome Oxide gets +100k/yr. If even a fraction follow a link to a distillate-of-TC-comments page, that's a few more progressively-paranoid folk.
[checking] What? no one has yet registered "trustedcomputingsucks.com" ?!!
~REZ~ #43301. Who'd fake being me anyway?