Major PC Makers Adopt Trusted Computing Schema

An anonymous reader wrote to let us known about a News.com story regarding so-called trusted computing, and its adoption by the major PC manufacturers. From the article: "The three largest computer makers--Dell, Hewlett-Packard and IBM--have started selling desktops and notebooks with so-called trusted computing hardware, which allows security-sensitive applications to lock down data to a specific PC." Interestingly, while Microsoft is said to be behind the idea support won't be forthcoming for trusted computing until they release Longhorn next year, making this a hardware-vendor lead initiative.

Comments

The end is coming and people want it!?!?

[garcia]

At the time, digital-rights advocates raised concerns that the technology could be used by software makers and media companies to control people's PCs, putting Microsoft on the defensive. The dispute even led the software giant to change the name of its technology from Palladium to the Next-Generation Secure Computing Base, or NGSCB.

And yes, we all know that now that the name of their security technology is different Microsoft can't "team up" with the hardware makers to lock down PCs to a single OS. It wouldn't be in the best interests of either side to do that right? Oh wait, MSFT already has contractual agreements that basically force this to happen why not take it a step further and make people not only pay extra for the OS pre-installed/distributed w/the PC but also make them have no choice but to run it once they get it.

I love the wording in the article... Oooh it's the hardware vendors taking the initiative and not Microsoft (like Microsoft is always at the forefront of technology or something). Is that supposed to make me feel better that the entire computing platform will be locked down leading to the end of free distribution of anything, the Internet as we know it, etc?

Didn't Ben Franklin say something about this? Yeah.

Re:The end is coming and people want it!?!?

[tabkey12]

I think it is important that you read this document from IBM which points out that the technology they will be introducing will not lock you down to a specific Operating System.

Re:The end is coming and people want it!?!?

[Nathan Forget]

why not take it a step further and make people not only pay extra for the OS pre-installed/distributed w/the PC but also make them have no choice but to run it once they get it.

It doesn't make sense for MS to force people to use Windows. Then they have to provide support for those people. It would also lead to a lot of disgruntled users. It also wouldn't be to the advantage of the hardware makers because they would lose customers not interested in Windows to smaller vendors.

It seems like the ideal system for Microsoft is one where Windows comes preinstalled on the major vendors' computers, but some users remove it. Then MS gets paid for those copies, but doesn't have to provide support for them.

Re:The end is coming and people want it!?!?

[garcia]

You are just as confused as everyone else. Microsoft dominates the computing world. They will dictate (via proxy through the masses of users that utilize their OS/software) which global network will prevail under "secure computing".

Don't want to interoperate with the rest of the secure users out there? Don't use hardware that is tied to THE secure OS.

See, DRM won't work otherwise.

Re:The end is coming and people want it!?!?

[rideaurocks]

We won't restrict you to one operating system!
You can choose from Windows 95, Windows 98, Windows ME, Windows NT, Windows 2000, AND Windows XP.

Heck we've even got some old Windows 3.1 disks here if you want 'em. How's that for choice?!

Re:The end is coming and people want it!?!?

[garcia]

Oh you can boot Linux but you won't be using it in any useful way. IIS will dominate the webservers in the world because their's will run on the "secure global information network".

Linux will fall into worthless obscurity because it will run on one of the various unsecure networks that the majority of computer users will never "want" to see. After all the only people that use unsecure computing are terrorists and those that are against the RIAA/MPAA/MSFT/GOV metroplex.

Re:The end is coming and people want it!?!?

[JWW]

Of course 90% of future computer viruses will be spread on the "secure global information network".

Re:The end is coming and people want it!?!?

[demachina]

"Don't want to interoperate with the rest of the secure users out there? Don't use hardware that is tied to THE secure OS."

If trusted computing reaches the point you can't get on the Internet unless you are running it, and at that point trusted computing means your completely relinquish control of your computer and your privacy, then maybe geeks should take this opportunity to start a network of their own free of corprate and government control. Think Pirate Radio except for the internet, the Pirate's Web, or Alternet.

At least at a local level you should be able to create a wirless mesh network free of the shackles the government and corporations are inevitably going to try to put on the Internet in the name of "security", "safety" and to protect their monopolies on music and films.

Its going to be a little harder to do the long haul part of the network, since you are going to have to do a lot of hops and latency will be terrible. Thankfully as disk drives and hardware get cheaper people can make liberal use of mirrors to that there are local copies of valuable stuff like Wikipedia and open source archives.

You will also probably be confined to latency sensitive online games only in your local community.

All in all I'm not sure it would be such a bad thing because:

- It would foster a greater sense of local community involvement, which is sorely lacking on the Internet.

- It would compel geeks to be resourceful and roll up their sleeves instead of just open up their wallet and dole out cash to the giant, abusive telecommunications giant every month.

- I wager the Internet is going to be in a pretty steady decline in usefulness as governments and corporations seek to exert ever more control over it and try to extract subscriptions and fees for anything interesting, or saturate you with advertising. Its also a near inevitability that they will seek to wipe out bit torrent, all p2p or anything that is used by pirates, even when they also have legitimate uses.

- People might start appreciating the value of the freedom things like open source give you once corporation controlled governments start taking them away. You usually don't value something until you lose it. Maybe it will be just the thing to ignite a sustainable and powerful political movement to regain control of our governments. As it is everyone is to fat, dumb and happy to do anything about it so corporation controlled governments are eviscerating out civil rights and no one give a damn as long as they have their porn, video games and reality TV.

All in all I favor college radio, which is the closes thing to pirate radio you can usually find. They play interesting, eclectic mixes of often good music because they are putting out content they like, not content that ClearChannel and the RIAA want to shove down peoples throats and make them like simply by depriving them of anything better.

Not sure that the Internet might not be rejuvenated if it goes back to its BBS, Modem roots. I wonder if spam, spyware, script kiddies and the like will be lesser or greater on the Pirate's net versus the "trusted" computing Internet. I wager the free lancers would be worse on the Pirate's net but the corporate controlled spam, spying, privacy invasion and intrusion will be worse on the "trusted" internet.

I wager we can pull off an Alternet as long as unregulated wireless is tolerated by the government and continues to improve. If once the Alternet starts rolling and the government, corporations seek to outlaw unregulated wireless and wipe it out, then it gets to be more interested. Could we run a usable and interesting mesh network in the face of a hostile, corporate controlled police state trying to wipe it out.

Re:The end is coming and people want it!?!?

[4of12]

I know very few computer users who are for the RIAA/MPAA/MSFT/GOV metroplex.

I know a lot more computer users who don't know jack, but do want to see that video of Michael Jackson, Brittney, etc. and will follow the helpful wizard into the path of *AA compliance for their "computer".

Re:The end is coming and people want it!?!?

[arr28]

See the Trusted Computing FAQ for the many reasons why this is a bad idea and why lock-in will in fact be a result, despite IBM's claims to the contrary. Written by Ross Anderson, Professor of Security Engineering at the UK's leading univeristy, this article is an excellent primer.

Re:The end is coming and people want it!?!?

[Enigma_Man]

I've always dreamt of something like that. A network setup by common geeks, of wireless and fiber-through-backyards. I wonder if there are enough geeks in the US to run fiber coast-to-coast via people's houses and yards.

-Jesse

Re:The end is coming and people want it!?!?

[utlemming]

What is more interesting is that IBM, according to the link you provided, is developing a GPL'ed version of TCPA for Linux. I think that is an important thing to note. Further, anyone that has said anything on Trusted Computing ought to take a look at that link. It dispells some myths and misconceptions about Trust Computing. After reading it, I am not too worried. The one thing that is common to the article is that it is to protect data, not DRM'ed stuff, against external hardware attack. In otherwords, the attitude of the article is that it is to protect you from some punk using software to get to your data like virii and trojans. IBM flattly denies that trusted computing is an attempt to implement DRM -- they even say that the scheme is poorly executed for use as a DRM. You will also notice the tone of the CNet article -- it said nothing about trusted OS's. Besides, you can bet that there would be issues with anti-trust concerns it trusted computer limited OS accessability.

Re:The end is coming and people want it!?!?

[HiThere]

Don't wait until it's too late. Start now.

It's currently legal if you keep your broadcast power level low enough (5 watts?). This means that your mesh will be quite local, but the software you need has already been developed, and the hardware is essentially there. (WiFi local nets running TCP/IP with local name servers, authentication, etc...essentially a mini-internet.)

But do note all the pieces that you need to have in place, especially the hardware. Now figure out what your points of vulnerability are, and fix them. A good choice is to re-design to remove all centralized control so that any 2-3 stations form a complete net. This means a distributed name-server, etc., which is new software.

Re:The end is coming and people want it!?!?

[Alsee]

Have you bought any good bridges lately?

The IBM paper was mostly factually accurate, entirely deceptive, and contained at least one flat out lie. The one flat out lie is "they even say that the scheme is poorly executed for use as a DRM". The only way that is not a lie is if IBM has a very peculiar definition of "poorly". While everyone involved in Trusted computing is constantly chanting that it was not designed for DRM, each and every one of them has at one time or another directly admited that it is in fact a perfect platform for building "security systems" including "DRM Security systems". It is simply a matter of writing DRM software and the rollout of well documented network servers and databases. If you're a programmer I can easily walk you through step by step exactly how you deploy DRM on Trusted Computing. There's certainly several layers involved in Trusted Computing DRM, but it is anything but "poorly designed". In fact short of physically ripping open a chip and reading out your key it is damn near impenetrable.

Yes, there will be Trusted Linux. And it will be just as bad as Trusted Windows. In fact Trusted Computing DEFEATS THE GPL. Sure you can have the source code, but that source code is ABSOLUTELY UNUSABLE. If you change a single line of the code then the Trust chip prohibits the software from working. Sure the new software will run, but it won't work. The Trust chip will prohit it from reading any of the files, and over the internet the Trust chip "authenticates" it as incompatible software and the software will not be able to connect or communicate.

The one thing that is common to the article is that it is to protect data, not DRM'ed stuff

Sure Trusted Computing is designed to "protect data". It is explicitly designed to "protect data" AGAINST THE OWNER!!!!

The foundation of Trusted Computing is a pair of cryptographic keys locked inside a chip. The specifications REQUIRE that the owner be forbidfden to know his own keys. The specification explicitly states that it is to be secure against owner attack. The sepecication explicitly states that the the chip shall selfdestruct if the owner attempts to get his keys out of the chip. I find it amusing that they in fact that advertized this point on TV in the IBM Thinkpad Man-In-Black commercial. The one where the government agent-type guy says that the chip self destructs if you attempt to remove it. Of course they didn't advertize the other parts about the data and software being secure against the owner.

The specification requires that the owner be unable to use these keys, except as the system permits him to do so. The specification requires that the owner be unable to read or alter HIS OWN FILES, unless the system permits him to do so. The specification requires that it be impossible for you to ever recover your data if the chip dies. The specification requires that it be impossible for you to upgrade your computer and transfer your data, except to a new computer with the exact same manufacturer and model of chip, and only after the destruction of the data on the original machine. If that Trust chip manufacturer has gone out of business or no longer makes that model chip, then it is impossible to upgrade to a new computer without losing your files and buying your software again. When the old computer dies your files and software die with it.

The Trust chip is desigtned to spy on your computer and report over the internet what hardware you have and exactly what software you are running. The specification says that you can turn this report on or off, but it requires that you be unable to control or alter this spy report. If you turn that report off, then the system wuill not work at all. You will be unable to register and install software and you will be unable to access any "secure" files.

There was a very comical and honest item on the Trusted Computing Group's website FAQ. On privacy it says that in order to use the system you must opt-in. Yep, if you d

Re:The end is coming and people want it!?!?

[Alsee]

It may sound like "tin foil hat paranoia", but there is in fact a "conspiracy" of over 200 corporations pushing Trusted Computing and Governments (US and EU and others) are in fact also "conspiring" to push Trusted Computing and there are in fact Trusted Computing initiatives inside the UN.

The Trusted Computing Group has in fact stated that they are creating a system that would deny you an internet connection unless you are running a Trusted Computer. The US presiden'ts Cyber Security advisor did in fact give a speech calling upon ISP's is impose exactly this sort of system as a mandatory part of their internet Terms of Service. A call to "Secure the National Information Infrastucture". It was at a Washington D.C. Global Tech Summit. And the audience applauded.

Yes, it would take a couple of years before they could take that final step of making Trusted Computing mandatory for internet access, but you are kidding youself if yuou think it is impossible. The plan is that the Trust chip will be standard hardware on everty motherboard, if not inside the CPU itself. Yes, Intel is already putting Trust chips inside CPUs, though it is not yet activated, and every other CPU manufacturer also has a project for Trusted CPU. So every single new PC will be Trusted Compliant hardware. Once Longhorn is released every single PC supplier will be supplying nothing but Trusted Compliant machines. Microsoft has announced that nonTrusted hardware WILL NOT BE FULLY WINDOWS COMPATIBLE. No PC supplier can realisitically survive selling hardware that is Windows-INCOMPATIBLE. Everyone who buys a new PC will simply be HANDED a Trusted Compliant machine. Through the normal obselesence and upgrade cycle, the vast majority of PC's get replaced in any four year period. If Longhorn comes out in 2006, add about 4 years to get 2010, at that point the vast majority of installed PCs may be Trusted Compliant. At that point it does in fact become very possible for ISP's to begin making Trust Compliance a mandatory part of their Terms of Service.

-

Re:The end is coming and people want it!?!?

[demachina]

Dude, if you are forming your world view based on the alternate reality that is South Park you are the one with issues here :)

South Park shreds everyone equally, its only fair they give liberal college grads and hippies equal time. Its comedy, satire, parody....laugh.

Not sure I said they are out to "get us". The corporate part of the combine are out to milk us for all the profit they can squeeze out of us. The government part is out to exert the maximum control over us that they can get away with(i.e. as much as we let them), and most of them are out to steer pork to their rich friends and corporate benefactors. When they retire from politics most of them rake in fat paybacks from the companies and people they bestowed the pork upon.

Just go back and read the history of the Medicare "reform" bill, the one with the supposed drug benefit for seniors. It was written by drug, healthcare, and insurance companies for their benefit, not for the benefit of seniors or tax payers. They basically bought the Medicare adminstrator, he was job shopping with these very companies while the bill was being negotiated, with White House permission though it was a blatant conflict of interest. He intentionally concealed the cost of the bill, threatened his subordinates who wanted to give the real number to Congress, and outright lied when he told everyone it would be $400 million which was exactly the highest figure that would pass Congress. As soon as it passed the Bush adminsitration admitted it would really be at least $500 billion. A month or two ago it was jacked up to $720 billion. There is in fact no limit on how much it will cost because the drug companies told Congress to add a clause forbidding Medicare from negotiating fair prices for the drugs it buys as part of the drug benefit. The drug companies can charge as much as they feel like and will. Don't be surprised when it really kicks in the Republican's will declare Medicare in a fiscal crisis and either jack up our payroll taxes or cut benefits.

If you think corporations don't control the American government at this point you are either naive, clueless or not paying attention.

I doubt the corprate/government combine is going to take the net to trusted computing suddenly, it will probably happen slowly and gradually so no one freaks. But you just have to look at Slashdot to see that governments/corporations are in full scale war against bittorrent and p2p, the NSA is getting geered up to spy on everyone, not just those outside America.

Seems to me its a good idea to take advantage of all the goodness that is wireless and mesh and at least start building community networks that retain some freedom. Fact is the Internet and your beloved giant telecom company ISP's and government are going to do no nothing but charge more, outlaw more and allow less and less as time goes by.

Re:The end is coming and people want it!?!?

[demachina]

I've wondered how much dark fiber there is laying around the world and if anybody would notice if you started using it. I'm pretty sure fiber infrastructure was way overbuilt thanks to everyone listening to Bernard Ebber's fantasy predictions for global demand for bandwidth.

I imagine once you started using dark fiber on any scale eventually the owner would notice. Alternately I'm wondering if you can tap fiber cables and run a rogue signal on it without the owner noticing it.

I wonder if ISP's working under the new trusted computing mandate would let you run a data stream point to point on their networks, using hosts that at least appear trusted but would basicly being working as routers between Alternet and Corpranet, ideally encrypting everything in the Alternet stream to keep the NSA and friends from spying on it while its in Corpranet.

Fiber through back yards would be a nice idea for high bandwidth in small areas but you would inevitably have people that wouldn't let you run it through your yard and you would have a huge hurdle to clear everytime you had to cross a street or other significant expanses you don't own.

Wireless is obviously better for the community network though you would be completely at the mercy of the FCC or your country's equivalent regulator. Would also be very vulnerable to being spyed on by Corpranet unless its strongly encrypted. As soon as corprate controlled government figured out Alternet was being used to ... gasp ... share music they probably would seek to snuff out all wireless networks unless they were certified and trusted.

Re:The end is coming and people want it!?!?

[Reziac]

An expensive lesson about Thinkpad security:
http://www.gripe2ed.com/scoop/story/2005/3/14/2354 40/804

Now, what if this were the case for EVERY computer... I foresee a thriving and extremely lucrative business in TC data recovery, where rather than merely sending Ontrack or whomever your wonked HD, you have to $$$$end them the entire computer (um... can TC include the monitor??)

How about...

[turtled]

How about trusted users? The computers aren't the problem, it's the users. It takes a confident voice to say, I'm person X and I am working on the mainframe, I need your username and password. Big words like mainframe scare people. People can't be trusted.

Backups?

[mattspammail]

What happens when your PC dies? How do you recover using the now useless backups? There's bound to be a way to bypass that. Sounds like the data requires a physical key (sentry?). Someone somehow will bypass it.

Re:Backups?

[Anonymous Coward]

the "key" is right in the hardware itself....

i have no doubt that this so-called 'trusted computing' will be compromised by hackers at some point....

what bothers me is:

software and hardware vendors will CONTROL the computer, not the owner (well, they will control the owner and his use of the computer. the owner will have no control). billy boy will control whether or not your microsoft word will function (even if you've paid for it).

new software "activation" (which is complete bs to begin with) will soon be tied to this trusted chip.. replace the motherboard, you'll need to replace the software too? (or be inconvenienced by having to phone each one's india-based call center and beg for mercy)...

i've also read (dont remember where, it was awhile ago) that software may very well refuse to install on computers with non-compliant hardware (read: no "chip" or hacked chip)......

since each computer will have it's own "key" embedded right in the hardware, each one will be different...

individual computers will be easy to track on the internet...... spyware will be able to track you by PC.. here, there, and everywhere.. even if you format and reinstall the os.. when they "get" you again, they'll be able to match up the current infestation with the last......

this is worse, much worse, than the cpu serial numbers intel tried to force onto people a few years ago (starting with the p3).

thank the mighty powers that be, for open source solutions.....

Re:Backups?

[Alsee]

What happens when your PC dies?

I read the hardware technical specification. The rules are quite explicit:

If your chip dies, your data must be irretrievable. Period.

If your computer has *not yet died* and you wish to upgrade to a new computer, you may only do so to a computer using the exact same model chip from the exact same manufacturer, and only with the assistance of that manufacturer, and only after destroying the data on the original machine. Under those conditions and only those conditions may you activate your files and software on the new machine.

If that manufacturer goes out of business or they no longer make that model chip in new computers, then it is impossible to upgrade your data and software to a new machine. When the old computer dies you data dies with it. You also have to pay for a new copy of any Trusted-installed software AGAIN for the new computer.

-

Note to self:

[Stick_Fig]

Hug my mac tightly tonight, and trust it to only have one master: me.

**Ker-PLONK**

[stevens]

...that was the sound of me moving from x86 to PPC.

(As long as debian keeps up support.)

Re:**Ker-PLONK**

[avalys]

Ker-BOOM, that's the sound of a mailbox exploding...

Your computer won't trust you

[FunWithHeadlines]

Just remember, folks: "Trusted computing" is an Orwellian phrase that actually means your computer won't trust you. So if you want your computer to have to ability to say to you, "Sorry, I won't play that MP3 file" or "Sorry, that movie is not authorized for this PC," well step right up. Barnum & Co. -- er, sorry, I mean major PC hardware companies have some new machines to sell to you.

Re:Your computer won't trust you

[LiquidCoooled]

I don't care about that mp3 file, or that movie.

I care about a future where I am still able to download, modify and share OSS software.

If executables have to be validated and signed for trustworthyness, then everyone will need to compile their own.

The "legit" version of firefox may work, but modify the source and compile your own, and it won't play in your windows system. Don't even think of taking it to your friends' house.

(somebody please tell me I am wrong about this)

Re:Your computer won't trust you

[Anonymous Coward]

Notice the "safety in numbers" flocking together of these vendors. None of them dare take such a step alone, because they know damned well that the publicity will be bad... and people won't buy their hardware. But put together and nice consortium of the largest hardware makers... and boom, everything's ok and fuck the consumer since he no longer has much choice.

Re:Your computer won't trust you

[FunWithHeadlines]

Sadly, you are not wrong. From the Stallman article I linked:

"Treacherous computing puts the existence of free operating systems and free applications at risk, because you may not be able to run them at all. Some versions of treacherous computing would require the operating system to be specifically authorized by a particular company. Free operating systems could not be installed. Some versions of treacherous computing would require every program to be specifically authorized by the operating system developer. You could not run free applications on such a system. If you did figure out how, and told someone, that could be a crime."

Re:Your computer won't trust you

[justforaday]

So if you want your computer to have to ability to say to you, "Sorry, I won't play that MP3 file" or "Sorry, that movie is not authorized for this PC," well step right up.

Well, I'll buy it only if it says those things in that cool HAL 9000 voice...

Re:Your computer won't trust you

[interiot]

Who does your computer trust at that point then? It has to trust someone, otherwise we'll have all sorts of viruses and spyware that tell the CPU "trust me, but don't trust the user, or any of his evil antispyw^H^H^H^H^H^H^H^H hacker tools." So all computers will be controlled by some particular oligarchy then?

Re:Your computer won't trust you

[ceeam]

> "Well, I'll buy it only if it says those things in that cool HAL 9000 voice..."

<voice type=5-yr-old-girl pitch=High> Sorry, HAL 9000 voice files are not authorized for this PC </voice>

Before posting any comments...

[Anonymous Coward]

..please read this:

http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html

this: http://www.gentoo.org/news/20050202-trustedgentoo. xml and, linked from there, this:

http://www.research.ibm.com/gsal/tcpa/tcpa_rebutta l.pdf

Re:Before posting any comments...

[IamTheRealMike]

IIRC the major problem people have with this is the "remote attestation" part, which means that a remote computer can verify your system is trusted, where "trusted" means "conforms to some arbitrary set of rules". Sure the hardware itself does not force you to run anything in particular, however if parts of the internet start requiring you to run Windows (or MacOS!) in order to connect - which this technology absolutely allows - then we have problems. Especially if ISPs start requiring it.

This doesn't have to be controlled by Microsoft

[tabkey12]

If Linux gets in on the game then surely this could be a positive thing for computer users.

See the Trusted Gentoo project for example.

Until we see locked down BIOSes then this is hardly a threat to Linux if it responds quickly.

Re:This doesn't have to be controlled by Microsoft

[pentalive]

When trusted computing was a USB chip that the os could ignore, I did nothing - my os did ignore it.

When the trusted computing chip was needed to run Windows, I did nothing, I did not run windows.

When the trusted computing chip checksummed the bios, I did nothing, I could still boot linux.

When the trusted computing chip could lock out the bios or any OS not signed I did nothing...

my computer no longer worked.

Catchy slogan

[Anonymous Coward]

Trustworthy computing... brought to you by a monopolist convicted using anti-trust laws.

rms' writing about trusted computing

[latroM]

rms on trusted computing

Nothing new

[afidel]

IBM has had the hardware in place in their laptop line for the last several years. It makes repairs which require a motherboard swap a PITA because you have to be sure to order the part with the crypto in place if your current system had one, which might not know about the first time you do one, resulting in a several day delay....

Problem for Apple

[vijayiyer]

This sort of crap runs contrary to Apple's philosophy, and I don't think they'll want it in their hardware (heck, they don't even copy protect their OS). However, they may get forced into it for compatibility. I believe in trusted computing - I trust myself not to be dumb.

what does this really mean?

[yagu]

I've read the article, and many related articles, but it is still not clear to me what this technology really means...

• How far does it extend? (software apps run only if trusted?.... or can user override, much like browser certificates).
• What does it mean for linux installs? Dual boot installs?
• Who controls these "keys"?
• Who controls "trust"?
• Is there a mod classification of "paranoid" for this post?

I am pretty sure there are answers to this technology, but I haven't found a clear concise source to make me feel any better about what this technology may bring upon OSS. I'm afraid it might be bad. Someone reassure me.

As an aside, is this really a direction technology needed to take? Is there really that much of a need for "trusted" computing? Sheeesh, I've not found this to be a huge issue, and I hope this technology incurs huge backlash when its inconvenience far exceeds its benefits.... (especially since the type of intrusion and hacking I've ever seen has little to do with protecting data and much more to do with social engineering).

Re:what does this really mean?

[Anonymous Coward]

Who controls these "keys"?

I think this guy does.

Re:what does this really mean?

[rincebrain]

As I understand it:
The current implementation is optional, and you don't have to even enable the security crap. I know I have my IBM Thinkpad with one of these chips in it, and I just flicked it off in the BIOS when I found out. The keys are user-controlled, as I recall, not manufacturer-distributed.

The fear is that either some big company M****s*ft will make software which won't run if you don't have trusted computer installed, and/or that Microsoft's implementation [Palladium, or whatever they're calling it five minutes from now] will be far more restrictive.

There was a great post on this a few weeks ago the last time a trusted computing article showed up, with some really helpful links...I can't seem to find it right now, though. Go check it out if you're worried.

Personally...it scares the shit out of me.

Microsoft's Version Here

[MLopat]

Just in case anyone wants to see the software side of what's happening with trusted computing, here's Microsoft's plans to integrate certain software technologies with these new hardware components. It's called Microsoft Palladium.

will it work?

[logicnazi]

So my understanding is that it is far too complicated to have the content only accesible by hardware (isolated HD or sectors directly controlled by the hardware which would need to convert to output without going through main memory).

I believe instead these systems work by only giving access to certain content areas if the booting software has the right key or matches the right checksum. However, once that access has been granted the software is in control and a software flaw in the software could allow for copying.

How long do you think it will be till they find a bug in longhorn?

Locking data to a PC...

[Anonymous Coward]

... is bound to be a pain in the arse if you get a new PC.

I suspect that the idea is that you'd use hardware-based encryption (which must be optional, otherwise general removable media would be worthless) and the OS would be expected to support it through some service layer. But anything it does in hardware should be emulatable in software. So, the solution is only truly useful if all parties agree to play nice. That seems to be a ludicrous expectation.

It seems to me that the strategy is wrong. There's no mechanism that isn't ultimately circumventable, so simply eliminate the complex hurdles and work such that there's nothing to circumvent and no reason to do so (change the model of how you operate).

IBM

[White Roses]

I'm hard pressed to see them doing this. They've sold their PC business to Lenovo. Why would Lenovo care about trusted computing? Isn't China pretty much against MS operating systems? Don't they officially use a home-grown version of Linux?

Another reason I'm glad I use Macs, really. Let's hope Linus's PowerMac really does drive Linux on PPC as much as we all hope it will. Then, let's hope IBM starts pushing PPC based systems more than the Xeon powered servers I always see advertised.

not a big deal really...

[havaloc]

...this is something that businesses want (ones that already control your computing environment, like at work), and I really don't see it being aimed at the typical consumer.
I would also say that there will always be a market for open computers. The market always has ways around this.

Re:not a big deal really...

[kfg]

"The market always has ways around this."

Absolutely. Just bear in mind that the people with the badges and guns often call that way "crime."

KFG

This has nothing to do with protecting users!

[Anita Coney]

This does not "lock" a computer to make it free from viruses or spyware. It "locks" a computer to keep it from playing non-DRM content. Basically, it takes control of the PC away from the user and hands it over to the RIAA, BSA, and the MPAA

Balkanization

[Concern]

I don't know how thoroughly we've all digested it yet, but open source has arrived, and in addition to changing what people expect of their software, it has raised the bar considerably for corporations like Microsoft. It is already eating their breakfast in the server space, and it is growing to the point where in a few more years there is potential to threaten their client desktops as well, starting with businesses and other large, lucrative deployments. We as an industry are starting to recognize, and ultimatly demand, the benefits of freedom.

On the one hand I like Microsoft buying into the wild-eyed "Alamo" mentality of the content trust, trying to arm wrestle every customer for control, because the more aggressive they get with Digital Restrictions Management, the more it will drive everyone into the arms of competitors, including open and free software.

I wish I could say I thought trusted computing was doomed to fail, but frankly I think it can be considerably successful. If the end result is that your computer is not managed by you, and 3rd parties like Microsoft can take the XBox busines model (and probably, simplicity of interface) deeper into PC territory, this is probably a relief for a variety of consumers beleaguered with "general purpose" computing and all that it entails, viruses, spyware, etc. Better software architecture could solve their problems, but outside control can solve it almost as well.

I guess what will ultimately happen is balkanization, as more aggressive attempts at controlling the platform will split consumers into low and high ends. At the low end, the "game console" converges into a media system and a simple home computer, where every application is trusted and the vendor is the gatekeeper. They'll be happier because, like video consoles today, the hardware is cheap and the costs are deferred into the software and services. At the high end, the general purpose PC that is currently a staple in the home will fade into niche status - a tool for hobbyists and professionals. What fills the void in between, in the end, is hopefully a free-software-based system that is simple enough for all consumers to use, that provides them with an alternative to commercial products, perhaps marketed by a white knight corporation much as IBM has taken free software to the server world.

Yeah, Right

[PingXao]

Ever since I've been in this field the allure of computers for me has been that you have a general-purpose device that, with a little ingenuity, can be made to do just about anything. A computer does exactly what you tell it to do. Now your average PC buyer can't even appreciate the difference between not knowing and not caring about what's inside their shiny new computers. But I can and I'll be damned if I ever spend any of my hard-earned cash on a device that will do what someone else tells it to do and not what I tell it to do.

Can't say I'm surprised. We knew this was coming several years ago. I bought a new keyboard last week and was shocked at the number of MS keyboards on display featuring the little fingerprint reader built right in. Within a few years we'll probably have the gubmint mandating all new PCs be equipped with TC elements. To keep us safe from terrorists no doubt.

On the bright side this will be hacked from here to kingdom come. In that sense it's good they're showing their hand now so intrepid BIOS hackers and EEs can start peeling away the mystery. What's that? The latest software won't work without TC? TC-compliant apps will work better together? Yeah. Right.

Oh boy... a secure PC, at last!

[ka9dgx]

I can hardly wait. This will mean I don't have to run a virus scanner any more! I can get rid of that pesky firewall box, and save some power. I also can stop worring about spyware, worms, spam, phishing, or any other nasty things that happen to Windows PCs on the internet!

It's going to be so nice, knowing that my data in my PC can't be taken away, erased, trashed, or otherwise caused to be lost. This will keep my stuff secure, for me.

Finally, I'll be able to trust my computer.

The Right To Read

[roman_mir]

Make sure to read this:
The Right To Read by RMS.

Linux is irrelevant, err, untrusted.

[jabber01]

Bad geek, bad geek...
What'cha gonna do?
What'cha gonna do when your new hardware won't boot Linux for you?

Re:This is good for Linux.

[LiquidCoooled]

What happens when you try to use your untrusted OS to go onto a website to download content?

How do you explain to your relatives that internet access is blocked because the ISP cannot confirm your trusted status?

At first glance, putting your head in the sand and running away from the problem is feasible, but if this plays out as far as people expect, then your machine is not your own, and the only way round it is total compliance.

Think of an x-box as 1st generation.

Without some VERY clever trickery, you cannot run uncertified software, and you can pretty much give up all hope of playing online.

free bios + the right to read

[Anonymous Coward]

It's time to push for an hard for a free bios. You can help if you
can figure out how to install a new bios on a computer, especially a
laptop. I don't know why we can put linux on an xbox but nobody can
get a free bios on a laptop.

Stick to AMD machines, avoid Intel and IBM. Heh, IBM. We talk like
they're our allies but they're pushing patents and treacherous
computing. They're a _much_ bigger threat than SCO ever was.

If you haven't yet read stallman's dystopian short story The Right To Read,
this might be a good time.

Treacherous computing is the reason I'm a GNU+linux user.

TC

[northcat]

Here is what the opponents of Trusted Computing have to say.

Re:TC

[northcat]

Apologies for the crappy URL; it seems I suck at them

No it's a bug in slashcode (I think) look at my other post.Now..

The IBM rebuttal first twists the words of the authors and takes it completely out of context, the authors were trying to tell things in layman's terms and everyone can see that. Then, in the security argument, it seems to ignore the fact that most security breaches occur due to software errors and the fact that once the "trusted" software itself is compromised, there's not much TC can do. And then it pushes of all the fears as mere speculation, whereas the fears are logical conclusions derived by careful analisys. Again, it takes things out of context and makes it appear as if the authors are trying to push speculation as fact. I've read the original documents, and this rebuttal doesn't hold up against them. If your fears were allayed to any extent by this rebuttal, then you must be very impressionable.

The computer is your friend...

[Walkiry]

Trust the computer!

This won't work...

[Zog The Undeniable]

Look how many people rejected region coding on DVDs. They just buy Far East-sourced players that ignore the region coding (or can easily be switched to do so) and someone will produce non-TC computers if there's the same demand.

I think MS and Intel have underestimated people's determination not to be shafted by The Man.

This won't make me popular around here...

[Skweetis]

...but I would like to see some sort of hardware-enforced secure context available on commodity computer systems. I would like the hardware to remain completely backward-compatible with all existing operating systems and software, and certainly not stop the owner of the system from doing anything they could previously do. I would like this as I'm working up a p2p MMOG protocol as a hobby project, with the goal of being able to host a world with tens or hundreds of thousands of users on minimal hardware by offloading most of the processing onto the network. Anyone who's played an MMOG for any length of time probably knows that this would be unworkable because of the potential for hacks that would give unscrupulous players an advantage. However, it could work if the networking code could be run in a sufficiently secure context, which I believe can only be provided at the hardware level. I would like to see something like this, as it could allow for MMOGs to be hosted with much smaller hardware and network resources, significantly reducing the cost to the player.

Of course, such a system would have undesirable uses as well, DRM and the like...

Don't do it, it's a trick......

[masterofhisdomain]

(holds up Jedi hand....)

This is a trusted computer....
..........nothing to see here.....
...............these aren't the droids you're looking for......
......you may pass.........

:(

You've gotta respect Stallman's power of PageRank:

[Hobart]

The Free Software Foundation's article entitled Can you trust your computer?

...is the first Google hit for "treacherous" :-)

And for those who are going "huh, what?" the short version is this: So called 'Trusted Computing' is the only way that companies that want to prevent you from accessing data on your own computer can make it happen -- DVDs that you can't screen capture or skip the ads in, music files you can't save to your old music player, text data that you can't export to your screen reader, etc.

Although unlikely, this could conceivably also be used to prevent you from running whatever OS or software you want on a particular PC.

As such, Richard Stallman, in his essay (which you should read, above), has chosen to refer to it as "Treacherous computing", kind of the geeks own version of the "Santorum" campaign.

No one is noticing this part....

[Artfldgr]

Ok... say all the other doomsday things somehow dont happen... there is one thing that WILL happen... note that in the description of how it works on microsofts site, that you control the parameters, and an agent oversees activities and such... people here keep thinking that it has to do with DRM, but actually it has to do with third party compatibility!!!! right now i can reverse engineer ms file formats for say Word.. i can then write an application that does something tha Word does not. if i pay microsoft then they will allow me access to the encrypted representation but if i am not then there will be no way for my new apps to work with the apps of microsoft. new software is seldomly a stand along affair. many companies exist by making addons, and all kinds of things, and they are not required to pay royalties to the original company because they are manipulating data that CAN be manipulated. worse than spying on you... it will kill interoperability by third party players with potentially disruptive technology... and since the main things in windows are embeded inthe operating system, almost all software will have to license some kind of access as the browser will lock up what it knows too. this has been a bug a boo of big companies for ages. they dont like that a small trim company can come along and expand their product down lucrative paths that they cant respond to given their size and internal cultures. so while general motors makes engines, you can buy add on and modifications from third parties, or make your own. general motors hates that it cant make ALL the money that is derivitive of their products. the same is true of tons of other products of which we have the FREEDOM to modify as we see fit to fit our needs.... another thing ms and the others hate are ms experts that dont pay to be part of the ms world to get their answers. i can see this locking out consultants that write or customize software unless they get permission through ms or another to have access to it. dont worry though.. the minute that something onerous does get in, you will see people making PC's that dont have it... they will run old operating systems and live with the problems or work around them like they do when they dont have a patch... the key here is that such technology is not legislated into place. so we as consumers do have a choice... 10 years ago things were changing faster than the lull we are in now, and capacity of the machines changed rapidly... but we now have approached the level where for 95% the machines that exist can do more than we can put them through!!! and thats the saving grace.. i will just boot up my p4 with win 98.. if software dont run, i will then just use something else that will.. software developers already have a hard time with such small margins and such high costs.. breaking them will not leave an open playing field as ms and the others think. its a reductionist view thats doomed to failure as they dont realize that maximum exploitation of their environment happens when there is a rich and varied ecosystem to support it... when it dries out there is less reason to innovate or move forward and your customers are not as happy.. which i guess is fine if you are running in telecom or banking.. information technology wants to have the same captive customers... all because everyone is so pinched that the only businesses that do real well any more are those with captive customers (usually through contracts that border and make excursions into usury). the move by companies to control their customers rather than service and please them is a scary trend that i fear will only get worse as time goes by.... we should never have granted companies entity status in the 1800's.. some of the seeds of our downfall was in that, and more have been planted along the way... and soon will bear fruit as the united states loses its preeminence to the companies it created that have left the nest of national level business and now are no longer beholding to the nest as they live in the global sphere. politicians are not too bright in the last few years... they dont realize that once a company goes global its no longer in its best interest to remain loyal to the country of origin!!!!!!!!!

American Innovation? Like The Lion King 2 1/2?

[Thud457]

Good thing those repressive commie Chineese support IP rights so strongly! People in other countries aren't so much stupid consumers as Americans. It'll take like 30 seconds for some manufacturer in Taiwan to come out with a DRM-free motherboard and own the market.

Its a trust thing...

[RagingChipmunk]

I think the general understanding of "trusted computing" is missing the mark. The idea of TC is that the CPU garuntees that the code it executes has been authenticated, and that its transport to/from RAM/IO is also authtenticated.

This prevents casual logic analyzers and other hardware hacktools from reverse engineering the component level interoperability. While its not a garuntee of securing the design, it sure elevates the level of effort required to manufacture alternative hardware components.

Sound familiar? Does the song "microchannel" dance in your mind? Sure Microchannel failed beacause it was an IBM-only idea. Now, there seems to be growing support for across major PC vendors. But wait, there's more...

If you are reasonably assured that the hardware is 'authenticated', now you can upstream that concept to the software. Now you can use various hardware level cryptography to ensure that the hard disk has only authenticly signed boot signatures, and if it does not, the device will simply fail at a *hardware* level. Makes it hard to install viruses, er, I mean alternate OS'es.

Sound like "wishful" thinking? Look at the design specs for the XBOX. This is the first cut at secure computing platform, with some level of hardware & software authentication. The idea being it will be very difficult to release non-licensed titles for the device. Look how long it took before some clever (ok, VERY clever) ppl got Linux to run on it.

Have you seen any non-MS licensed developers releasing titles for the XBOX ? No, of course not - because the hardware/software authentication scheme is sufficiently robust enough to prevent that.

In short, when you buy a DELL, IBM pc under the "trusted computing" design, you'll have a choice of OS. Once. Just once. Until some very clever ppl figure out how to install linux there too...

Not gonna happen,

[Anonymous Coward]

I don't know what country you live in, but in the USA our laws are made by corporations. If "pirate networks" gain in popularity, they will be outlawed and people who promote them or run them will be put in jail.

Whats the difference between this and

[whois]

hardware dongles? Or DVD CSS for that matter?

You might say "but but but but but but" this is going to be different, more secure, stronger.

Or something. But you're still going to be selling the public hardware, that they control. Hell, some of these computers will never be accessing the internet or any network at all. How will you control what they do after you turn them into the hands of the customer?

You made hardware dongles for expensive programs, they were broken. You made hardware copy protection for console game platforms, it was broken (even when games were shipped as a cartridge, eventually people made cloners)

You've made DVD players you thought were unbreakable, unleashed them on the masses, then they were broken, so to spite everyone you created new laws to try to stop people from doing it (DMCA)

You created directTV and dish network. They're hacked. And before that? Satallite TV was scrambled, but there were descramblers.

ANY hardware based "encryption" or "dongle" or "trusted computing initiative" is security through obscurity. Do you think every person who ever worked for all these conglomerate companies will be able to keep a secret?

The first person who finds out you use pins 1 and 6 on the chip to pass keying information will end up leaking it to the public. Said public will start watching those pins and find out what needs to be sent to "ok" a program running.

So you tell me your "dongle" is smack dab in the middle of the CPU, no sniffing possible?

Someone will just realease the keys then. It's only a matter of time. In the meantime, you're just blowing smoke up the asses of all the customers you have who want this product, and pissing off all the customers who don't want this product.

Give it a rest. PC's were pretty cool until you started breaking them. If you make them too hard to use, the world as a whole will find something new to play with.

HP is already on the fritz because they've merged too many times and found out they can't be the next IBM. Imagine if everyone stops buying from you and starts buying from a toaster company?

my paper on the subject

[woodforc]

A few years back, when I was a law student, I wrote my law review student note on trusted computing (published last year). I've made it available here if anyone is interested. Not sure I still agree with the thesis but hey, I was ensconced in academia when I wrote it.

http://actusre.us/cjam/woodford.pdf

Preying on fear

[EmbeddedJanitor]

Joe sixpack thinking which choosing a new PC: "Viruses, trojans, spam, phishing, hackers, crackers,..... Hey I think I'll get this one with Trusted Computing".

Th vendors are just preying on fear.

Luckily enough...

[dallaylaen]

No need to worry yet: AFAIUnderstand, the news is mostly about a chip that holds the private key and generates the key pair on demand.

An (external) device like this might come in handy if there is a break-in and hop... the public key is undamaged, the system alerts, the intruder is screwed (no log deletion etc.). However, I wonder how long will it take to make the chip obsolete (the criptography evolves, the chip does not!).

The chip is shipped for some time now with (some) IMB laptops, and has a GPL driver and Linux support.

And btw, IBM, one of the adopters, is not interested in "one OS to rule them all". Look: MS forcedly dominates, prices rize, IT budgets rise, no one buys IBM's Iron.

Moreover, IBM is interested in commodization of OS market. They've spent billions on Linux and OSS, and they are reaping the reward -- increased demand in servers and services.