Slashdot Mirror
No More Internet Anonymity
inkhaton writes "This Article tells of an Orwellian chip that, once installed in your computer (and not by your choice), will allow any website you visit to "read" your identity. The article goes on to describe how many benefits there are for using this to facilitate online business and even suggests some negative points. It ends with "Ultimately the TPM itself isn't inherently evil or good. It will depend entirely on how it's used, and in that sphere, market and political forces will be more important than technology." ... ugh. Well we all know what that means."
Your real identity or someone who used your computer while they were over your house, or someone that borrowed your laptop?
Bradley Holt
Aren't we all Testuser from Beverly Hills, CA 90210 at test@aol.com?
Is any technology inherently good or evil?
Your computer may be broadcasting your IP address to the world as we speak! Or so I've heard.
My TPM will have the following information.
.. then I guess it's back to my C= 64...
Richard Cranium
9191919 Nunya Street
Overstock, MO 64999
901-555-5555
And if I can't do that
= Grow a brain...
This is a lot like the MP3 market -
We already have systems that work fine without this invasive technology - just like we already have MP3 technology for making nice MP3 files to listen to and download.
Why then would we pony up more cash or change the way we connect to the internet just for the sake of adopting this new technology?
These approaches for more DRM and more end-user-ownership by the corps is almost always stick and almost never carrot.
I am government man, come from the government. The government has sent me. -- G.I.R.
DEMOCARACY IS DEAD!
wheres the lineup to join the liberation front, its time for a revolution!!
/. is overrun by bed-wetting elitist nerds
let it be known, for anything other than servers, a *nix OS sucks
Ultimately the TPM itself isn't inherently evil or good.
I'd like to hear of any inanimate object that is inherently evil or good. Nuclear bombs aren't inherently evil or good, it's just how you use them. Otherwise they just sit there.
It's hard to believe that's how Micronians are made. Why don't we see it right now by having you both kiss one another?
How else will the Anti-Christ keep track of you, and keep you from buying or selling? However, the mark is supposed to be in your forehead or palm of your hand. OK implanted RFID chips then.
I'm so mad I can't type. The idea that something can be put into a tool that I buy weather I want it or not, and then we will see if my privacy invasion is good or evil latter makes me want to throttle someone.
The tone of the article gives me a good idea of who to start with.
San Francisco Photographers
Anyway, I'm not sure there will be any such thing as privacy in the near future. Right now it's already becoming a luxury good, and pretty soon only millionaires will be able to afford it.
There is a solution, but no guarantee we'll reach it. We need to define an individual's personal information as belonging to that individual, and any use or reference to that information should only be with permission, and based on some good reason. To put actual teeth in such a legal principle, I think it needs to be coupled with a right to store your own information (presumably on your own computer). Without such a basis for protecting privacy... Well, you'd better get use to appearing all over the Internet when you least expect it.
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
Tin Foil Router! Limited time! $99.99 with 802.11X! Stop those nasty data packets from going through to the websites you visit! www.x10.com
This will never fly, and not for the reasons we would hope for.
Here are the scenarios:
1) Chip reports stuff, but data stream is wide open, so middlemen can change whatever they want.
2) Chip reports stuff, but with shitty encryption so the gov't can still do its wiretaps and echelon won't break. System is hacked within a couple days and the whole 'chip' idea becomes worthless.
3) Chip reports stuff, but with robust encryption. The site you are talking to knows who you are, but people between you and them can't sniff your actions other than knowing that 'some sort of communication took place'.
Plus variations. This could actually make webs of trust (a la the direction that Freenet appears to be going) more secure, since you know that your neighbors haven't been man-in-the-middled.
But good to see the mainstream press catching up to it. This chip is part of a larger effort by major software developers and hardware manufacturers to mostly stop piracy in all forms and control what you can do with your computer and when.
Read the TCPA FAQ, and take a look at Against TCPA, an anti-TCPA site if you're interested. For an alternate perspective, you can also view the official Trusted Computing Group site.
Personally, I hate it, I don't think it will succeed, and I will *never* buy a computer with such a module installed.
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
Of course, all a hacker needs to do is keep an older model x86 or PPC system around. Obsolete computers are a dime a dozen, and you can keep them running for decades.
And we are moving closer and closer to disposable PC's, anyway. In less than ten years, I predict that brand new, complete systems will be selling for less than $50. Got my computer's ID? So what, I throw away my computer every month!
Sounds like the flopped unique ID that came on the P3 chips... we all know how successful that was.
Where there is a will there is an option.
If you don't like it then don't buy it.
1) People likely won't know about it, and Joe Average will just buy it with his computer not realizing the problem and risks.
2) There are only so many hardware providers. What happens when they all carry it? Unless you like build your computers from scrap, you'd be stuck with it. And at some point, they'll just start carrying them on all processors or something. This was made by an alliance of AMD, Hewlett-Packard, IBM, Microsoft and Sun after all. If Intel joined the fray, the computing world would be sunk.
I can't look at porn anymore :(
I suggest we refer to this hardware cookie as a shit biscuit.
I've been thinking about this; the problem is the legal route to this is pretty much a nonstarter already. But maybe there is a loophole; I think we should all start a church. The Church of the Super Paranoid, or something like that. That way we could cry religious persecution if intrusive privacy-stealing measures are used against us. I'm certain I would have no problem convincing a sizeable chunk of the Slashdot population to swear and affirm (on a stack of punched cards) that their right to crypto and absolute mastery over who sees their porn stash is both vital and indispensable to the very core of their identity. I think it could work.
At the very least, the crazy fundies will lobby for laws that would help us... :0
If Jesus wants me it knows where to find me.
... selling desoldering stations, tin-foil hats and faraday-cage panic room kits ...
I fail to see how this is like Communism.
This relates to Fascism much more than Communism.
Intel is in on it (and has been for far longer than AMD). As are dozens of other companies. NBC simply didn't have room to list them all.
I've upped my standards, so up yours.
Why then would we pony up more cash or change the way we connect to the internet just for the sake of adopting this new technology?
Because there are only two companies that control the last mile in your area, and they have both made a working TPM a condition of obtaining residential Internet access through them.
But what is their purpose? We cannot simply evaluate things by their inert state. We also have to factor in their reason for being. A gun isn’t made just for the purpose of propelling an object at high velocity in a particular direction (there are superior devices for doing that), it is intended to destroy something as a result.
This type of thinking might be carelessly superficial in some circumstances. You are right to an extent, but that should not keep you from further consideration.
Join Tor today!
Intel quickly made the serial number disabled by default, and few web sites ever started using it. If people *really* have issues with such a system, they won't use it, and they won't buy products that require it. If they don't buy it, companies won't sell it. If it's an issue, media attention can get people to vote with their dollars and keep it from being a standard. The only thing that worries me, though, is the Microsoft comment. If somehow Windows requires this system, it'll become a de facto standard. But MS has tread pretty carefully so far - e.g., restrictions on how often you can activate a copy of Windows are pretty lenient. But we'll see if that holds. Even still, though, MS won't want to make consumers buy new PC's or accept something they don't like in order to buy the new Windows for fear of losing business. So it comes down to whether people really oppose this or not.
I produce electronic music and write little games. Have a look.
My vote is yes. The Internet will route around it by gradually dividing from what is currently called the Internet. Most people will use what used to be the Internet, and will consider it to still be the Internet. A minority of tech savvy people will be running on an alternative network, and will consider their network to be the Internet.
There will be one way links between the Internet and the former Internet (new can suck data from old, but not the other way around). The new Internet will be under the radar, but will be a hotbed of technical innovation. In time the new Internet will appear on the radar, as the majority hear of it and decide that they want to be able to do all the neat things Internetters can do as well. The majority join the Internet. The Internet gets 'tamed' as large companies join it. The Internet routes around the damage by breaking away over time. The cycle repeats...
Of course, all a hacker needs to do is keep an older model x86 or PPC system around.
And watch it not get an IP once all the major last-mile ISPs have switched to Trusted Network Connect, a framework that involves "trusted" dialer software that assesses the state of your computer using its TPM. Cisco has a similar competing framework called Network Admission Control.
What about the plathora of secuirty issues we are faced with today, combine that with a preempted identity management system and you spell disaster.
It would bring on a new level of phishing one that would be alot more difficult circumvent and alot easier to exploit once the phiser has what he needs from their victims.
Engineers and techs are very smart people but sometimes they lack the day-to-day vision around the issue.
Plus, im sure there'll be a bunch of eager hackers waiting patiently for this to come along, if they are able to stick linux on an ipod i'm sure they'll be able to get around this.
Speaking of avoiding hardware that prempts the need for spyware to be implemented in software, Does anyone know of a list of hardware that consumers should avoid?
If not, does anyone want to start a wiki entry or something similar?
(All I've found so far is http://www.againsttcpa.com/tcpa-hardware.html ) But I will be searching more in-depth later
Am I open minded towards open source, or closed minded towards closed source?
The Evil Bit is inherently evil! :-)
And your infallable source for this information is... a Slashdot comment.
It's not my only source, just one that's useful for introducing the ramifications of the concepts introduced in the Trusted Network Connect FAQ (PDF).
>ugh. Well we all know what that means.
Sigh. Yes. Everyone will just sit around slashdot whining about it, and not lift one finger to get control of it via their elected officials.
-- "In order to have power, I must be taken seriously." -Mojo Jojo
BWAHAHA! Dude, have you compiled a kernel recently? It does have support for this - only the kernel states it as a module that can be used in conjunction with the chip, to store "key data" seperate from the system, to increase security, or something. Mayby it will allow Linux to selectively use the TPM chip where required for authentication (i do my banking etc across 3 computers, identifying anything on a per-computer basis can be stupid). The TPM chip is far from just an identifier, its got memory and can be used for other general things.
Its more that, in Linux, the TPM chip will be used for security (good), and in winblows it will be used for ease-of-use/profit (evil). So, im guessing in Linux you'll be able to spoof ID's
People...please, stop and review your history. Does no one remember Intel doing this exact thing just 5-6 years ago with the first PIII chips? Do you see any chips with serial numbers embedded in them like that today? No...because it was a colossal FAILURE! That's when Intel began to slide and AMD began to rise to power. Why? Because AMD saw a need, and that need was to NOT have this kind of tech. So many people, including myself, started switching to AMD chips. And Intel eventually yanked it because of the market share they were losing. They never really recovered after that, especially when AMD started beating them on processing power-per-watt. So please...just take a deep breath, calm down, and look to your nearest underdog to fill the need...
Besides, when the revolution comes, your computer will be the last thing on your mind...
Just as soon as I can kill or maim someone by operating my computer recklessly, we can talk about mandating publicly visible identifiers for them.
I too have felt the cold finger of injustice.
Well I never really considered little yellow cloth stars or number tattoos "good" or "evil" in and of themselves... but you know while we are at it lets brand everyone's social security number on their arm... you know so you can't lie to women at bars about being Leonardo DiCaprio.
> Forcibly installing such chips into our computers is, well,
> illegal.
Nobody is (yet) proposing to forcibly install anything on your computer. They are proposing to make it nearly impossible to find a computer for sale without a TPM chip and impossible to get onto the Net with a computer without one. So far as I know that is not illegal.
I agree with the rest of your points.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
From TFA:
With a TPM onboard, each time your computer starts, you prove your identity to the machine using something as simple as a PIN number or, preferably, a more secure system such as a fingerprint readerHmmm fingerprint readers are more secure than PIN numbers? Certainly not yet.
Also from TFA:
(In fact, with TPM, your bank wouldn't even need to ask for your username and password -- it would know you simply by the identification on your machine.)Well what if it's a shared computer at home. How is my bank supposed to tell between me and my wife when I logon to their web-site?
Sounds to me like the unique serial number thing that was available in Intel P2/P3 chips....
Whatever happened to those?
Processor Serial Number Feature = Disabled
It was a BIOS option on *most* boards as I recall...
Optimist: The thumb drive is half empty! Pessimist: The thumb drive is half full...
I was poking around on my new AMD64 machine the other day, and I ran dmidecode. Can anyone explain this?
You went to McDonald's for lunch...did they record your license plate and/or VIN? Did you drive up to your bank to make a deposit, and if so, did they check your license plate and/or VIN before letting you access your account? Did the city government make record of your license plate and VIN as you traveled through various intersections? Did the park and recreation department take a record of your entrance and exit times when you visited city park?
Basically, just go back and look at all of the arguments that were made when Intel proposed the Processor Serial Number as a GUID. The arguments remain, and will always be, completely valid.
Jim
It's the year 2100. The "GEEKS" live underground, running LINUX 2.8, the last release without mandatory DRM implemented. The GEEK population makes money by trading their cache of the last MOBOs (Late quad-cores) that do not have DRM to the "surface people". These machines are populated with bootleg copies of "Gilligan's Island" - The most popular show of the surface people... Pathetic...
My wife doesn't listen to me either...
Wasn't this the original intention with the Serial ID on Pentium III microprocessors?
i just put in
What I won't do is install software that turns over the 'trust' it creates to an outside entity.
Unless all broadband Internet access providers that serve residences in your area start to require that you use a kernel and apps with a specific signature dictated by the ISP.
You are very wrong here. Google for "Altera NIOS Linux". Won't be as fast as Xeon, but there is no difference for Web browsing.
The new FPGA's will only be configurable with a TCP-compliant software, which will insist on the TCP verilog being put into it also
That won't happen. If you buy a device you are free to configure it with any bitstream you want. FPGAs are configured offline, so there is no room for any key exchange.
And then, crypto will keep it from connecting to the internet anyway, unless you break that also.
Break - maybe. But it would be impossible to use the hack. It would be as [il]legal, and as hard, as hacking your digital cable box to see movies that you haven't paid for.
If this thing happens, then 99.9% of Internet users will not notice it, and the remaining 0.1% will abandon it - exactly as intended. Thinkers and freedom lovers will be denied the means of communication and rendered harmless. Mission accomplished!
You can get all of the proteins and amino acids you need from veggies if you really wanted to. You don't have to eat meat: infact, if you ate only meat, you would become VERY unhealthy. Though, I concur that living in the wilderness you are not exactly widely exposed to random batches of refined chick pea and soy bean, so... yeah. In a wilderness setting you would need meet.
But please don't try to pass it off like you need meat to live. I've been doing it (quite healthily, might I add) for three years, and I know people who have been going upwards of twenty. You just have to watch your protein intake.
Have a good one!
In order for any web site to "read" my identity (assuming the chip is installed), data from the chip would need to be sent over HTTP. So, if you are not using a browser capable of sending it, or your OS does not have a driver to access the device, the device is useless. Not to mention, there is nothing to prevent you from using a browser that supplies false information.
If this were done purely in hardware, the data would be encoded in the network layer, which means that the data would not leave the subnet (assuming current network technologies used on the internet).
"lol, this is not the mark of the beast!"
This chip is about the easiest security measure to work around of all time: Use a PC emulator which also emulates the TPM hardware.
It might not make for a very fast computer, but it'll be fast and cheap enough for the average nigerian scammer to invalidate the entire case for the TPM chip.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Not? No. Simply because I'll download a patch/update to my browser which will - given the query for the ID - return either any code I entered (for example the id of some damned politician, hehehe) or a new one every hour.
And these morons will waste a huge amount of time. And, as usual, all they'll catch are other morons.
Free PC version of ChipWits at http://www.breueronline.de/klaus/chipwits/
Users will still control how much of their identity they wish to reveal -- in fact, for complex technical reasons, the TPM will actually also make truly anonymous connections possible, if that's what both ends of the conversation agree on.
Yes, TPMs can be used to remove privacy, but only with your consent. They can also, with the consent of the parties involved, give you much stronger privacy than is possible without a TPM.
I've talked to people in many of the major companies that are behind the Trusted Computing Group, and they're well aware of this issue. I spent a bit of time talking to the head of the trusted computing project at AMD, and he understands very well the lessons of the Intel CPU serial number fiasco of a few years ago, and the TCG has include technological features to protect user's privacy. Is this because they are great privacy guardians? No, I don't think so -- I don't think this guy is going to be the next president of EPIC or anything. I think it's a strictly business decision: They see that people won't accept the technology unless it protects privacy (just see the tone of the article this Slashdot story is about), so they've put in measures in order to make it more acceptable.
Some technical details: The current TPM specification is version 1.2. Prior to 1.2 there was an "officially supported" pricacy mechanism based around the idea of a PrivacyCA -- basically, you got pseudonymous credentials (a certificate) from a PrivacyCA, and used that in transactions. You could get a different certificate for each person you interacted with, so transactions weren't linkable, or you could even get multiple certificates to use with the same person so that you had different identities to use with them. The problem being that you still had to show your unique ID to the PrivacyCA, so you had to trust them not to link all your transactions together. However, version 1.2 introduced a stronger notion into the standard: direct anonymous attestation. With this, your anonymity is protected with cryptographic means, without the need to trust any other party. Of course, when you authenticate, the site you are interacting with has to agree that it will accept such anonymous and untracable identities. Some sites will probably allow that (discussion boards, etc.) and some probably won't (banks, credit cards, etc.). But that's a market decision, not a technological one. You have the power, with the technology, of having even stronger anonymity than you have today, so the market needs to insist on merchants using that. As was seen with the serial number in the Pentium III, enough people care about privacy to make industry sit up an pay attention.
Imagine if you could create as many identities for yourself as you wanted. You could go so far as to create a separate identity for every single site you visit, even. Imagine that you can program your web browser to invent dummy identities automatically in order to accomplish this. There; privacy issues solved.
The nice part about this system is that you'd never have to enter a password or a credit card number again, and no one would be able to steal your identity without stealing your physical computer.
Digital rights, Patriot act, loss of privacy...screw it, I'm moving to Alaska and building a cabin.
It is by the juice of the coffee bean that thoughts acquire speed, the teeth acquire stains. The stains become a warning