Slashdot Mirror


UK Government Pushing For 'Trusted Computing'

Motor writes "As has long been expected — we are now beginning to see governments pushing for the use of so-called 'trusted computing' — chips installed in all computers that effectively remove control of the PC from its owner. While there may be security advantages to some of the ideas, few can doubt that it represents a fundamental shift in the IT world. A radical move away from an open technology landscape and towards a system that denies all access unless you have the right credentials. Governments will demand the right credentials to access their services — meaning approved software stacks (i.e Windows) with the right digital signatures. Vernor Vinge had it right ."

291 comments

  1. No, Thank You, Dear Government by koestrizer · · Score: 5, Insightful

    My Linux machine is well-protected and I don't need your meddling nor do I need Microsoft's.

    1. Re:No, Thank You, Dear Government by Gaygirlie · · Score: 5, Insightful

      My Linux machine is well-protected and I don't need your meddling nor do I need Microsoft's.

      That is indeed one of the reasons why this will not work: there are people using all kinds of different OSes, including all the mobile ones, desktop OSes and whatnot. If the UK government were to only allow devices with the trusted computing built-in both the hardware and software they'd be instantaneously removing access for everyone who is used to using mobile devices to access those services.

      Another case of government not understanding technology, yet still pushing everyone to adopt it.

    2. Re:No, Thank You, Dear Government by craigc05 · · Score: 1

      It's not about your security, it's about theirs. GNU has a nice article about treacherous computing on their site, if you're the type that can stomach RMS. Posting from phone, will find link in a sec.

    3. Re:No, Thank You, Dear Government by OeLeWaPpErKe · · Score: 2

      Actually TPM allows protection in both directions. It works a bit like banks' systems. With a TPM you can secure a laptop, give it out to anyone, and you can set it up so they won't be able to break the encryption even if they know the passwords.

      If you work for a company, you can give out VPN credentials to idiots that are uncopyable. If they get infected with a virus, the VPN won't come up.

      I've consulted for a bank, and here's the dream : full offline money. If you have a TPM they will manage your account in your laptop (or phone, or ...) and have full offline payments. Because the TPM will only give their program access to the data, they can still prevent you from simply adding money in your own account, while allowing fully disconnected payments to occur which the bank will only find out about weeks after the fact (and so can you on other's computers of course).

      In general TPM's allow fully disconnected trust relationships.

      Surely such features are worth something ? Several linux companies are already using them.

      All it does is simply making sure that if you tell some company you're going to take good care of their data, you have to actually do it (or delete the data, you're perfectly at liberty to do that). I mean what do you have against this ? Other than "I want to pirate stuff" (which will still be perfectly possible, just slightly more involved).

    4. Re:No, Thank You, Dear Government by craigc05 · · Score: 5, Informative
    5. Re:No, Thank You, Dear Government by Anonymous Coward · · Score: 0

      The modern phone platforms have been shipping with "TPM" for quite a while:
      http://www.arm.com/products/processors/technologies/trustzone.php

    6. Re:No, Thank You, Dear Government by pmontra · · Score: 4, Insightful

      Suppose you are a Linus Torvalds some years in the future. How do you create your own OS if your PC only boots existing OSes and you don't work for a company that can buy or create non TC hardware?

    7. Re:No, Thank You, Dear Government by maxwell+demon · · Score: 2

      If you work for a company, you can give out VPN credentials to idiots that are uncopyable.

      Are there copyable idiots, too? :-)

      --
      The Tao of math: The numbers you can count are not the real numbers.
    8. Re:No, Thank You, Dear Government by vadim_t · · Score: 2

      Surely such features are worth something ? Several linux companies are already using them.

      Not to me. Why would I want it? If the bank likes it, it's profitable for them, but that doesn't mean it's necessarily profitable for me.

      Offline payments also seem largely unnecessary given how the internet is increasingly available anywhere.

      Also there are a lot of potential pitalls. If you transfer money to me offline, can the money disappear if the computers are never synchronized?

      All it does is simply making sure that if you tell some company you're going to take good care of their data, you have to actually do it (or delete the data, you're perfectly at liberty to do that)

      That is a perversion. There's no such thing as me keeping "their data". It's my data, and I should have full control over it. If they really have "their data", then it just stays on their servers, where it's fully their problem. I don't see why I suddenly guarantee its security for no advantage to myself.

      I mean what do you have against this ? Other than "I want to pirate stuff" (which will still be perfectly possible, just slightly more involved).

      Loss of control. My stuff is mine, period, and I don't have to give lenghty explanations of that. But no, it's not piracy. On my hardware, which I paid for, I should have absolute access to every single bit of it.

      I will certainly not buy anything that implements such a scheme.

    9. Re:No, Thank You, Dear Government by chill · · Score: 4, Interesting

      Easily, if you hold the keys. The trick is the keys that sign the boot image need to be in your control.

      Google does this with their CR-48 Chromebook. It will only boot Google-signed images. But, there is a small switch in the battery compartment to put it into developer mode where it'll boot any image.

      I *LIKE* TPM, as long as I generate the signing keys for the images. Then it'll boot what *I* tell it, and not necessarily what MS or the gov't, or anyone else tell it to.

      It ensure that *I* can trust my computer. Screw what they want to trust.

      --
      Learning HOW to think is more important than learning WHAT to think.
    10. Re:No, Thank You, Dear Government by gman003 · · Score: 2

      Nothing is unbreakable. Intel's TPM works basically the same way game console lockout chips do, with some enhancements - and you'll notice that there's a thriving market in modchips and softmod hacks. Worst-case, Linus would've had to reverse-engineer and break the TPM. Best-case, you go to a jailbreakme.com-like site and disable it entirely from software.

    11. Re:No, Thank You, Dear Government by Coisiche · · Score: 1

      If the UK government were to only allow devices with the trusted computing built-in both the hardware and software they'd be instantaneously removing access for everyone who is used to using mobile devices to access those services.

      Other than the "bread and circuses" impact it would have I think that a government would perceive that at a good thing.

    12. Re:No, Thank You, Dear Government by Anonymous Coward · · Score: 0

      Linux supports TPM, so that shouldn't be a problem, really. And you could always just not use the government's services through your computer (go to a library or somewhere else with a public computer if you need to, for instance). Just sayin'.

    13. Re:No, Thank You, Dear Government by Anonymous Coward · · Score: 0

      no,fuck you

    14. Re:No, Thank You, Dear Government by Teun · · Score: 4, Insightful
      From the article:

      These are making the public safe online and ensuring the country is one of the best in the world for online business; making the UK more resilient in the face of cyber attack and better able to protect its interests; proving a more "open and vibrant" cyber security environment; and having the knowledge, skills and capability to underpin these.

      "Building the most resilient cyber defences in the world will not help if you are suffering from intellectual property theft," he said. "Trusted computing underpins security and can underpin growth, providing confidence in transactions, expanding markets and making them function more efficiently."

      The first quoted sentence is the usual self congratulating typical for British politicians, nothing to see here, move along.
      The second part of the quote starts with divulging who is sponsoring this 'action'.

      Bah!

      --
      "The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
    15. Re:No, Thank You, Dear Government by cyber-vandal · · Score: 1

      Yes they're called pop stars

    16. Re:No, Thank You, Dear Government by Anonymous Coward · · Score: 0

      I think this short sums up trusted computing pretty well.

    17. Re:No, Thank You, Dear Government by Anonymous Coward · · Score: 0

      Right, because the 0.7% Linux desktop market share matters, and because they WANT you running an OS you control.

      News flash: many mobile devices already include TPM modules, and this will be the norm shortly. Linux will be out though, because it's fundamentally designed to give control of the computer to the user, which is the antithesis of trusted computing. And nobody will notice or care: they aren't enough Linux users around. So a few nerds will make noise, they won't change anything, and life will go on.

      Mobile devices are not a problem. Looked how locked down the iPad and iPhone are. That fits right in with the spirit of trusted computing.

    18. Re:No, Thank You, Dear Government by Anonymous Coward · · Score: 0

      I would kind of love if I had protection for my Linux though.

      Seriously, some of these proposed technologies could protect also Linux from pre-boot attacks by ensuring only MY Linux can be started, and that my full-disk encryption keys are kept safe. Also these chips could in future scan every starting process for vulnerabilities, and for other nasty things.

    19. Re:No, Thank You, Dear Government by Dog-Cow · · Score: 2

      All idiots are copyable, and most have been.

    20. Re:No, Thank You, Dear Government by SuricouRaven · · Score: 1

      Linux supports TPM - but will the govenment agencies support linux?

    21. Re:No, Thank You, Dear Government by ScrewMaster · · Score: 1

      Yes they're called pop stars

      Technically, pop stars are just easily reproducible. We'd need more advanced cloning technology to actually copy them, and if we do make copies of Britney Spears, I'm leaving the country.

      --
      The higher the technology, the sharper that two-edged sword.
    22. Re:No, Thank You, Dear Government by Runaway1956 · · Score: 1

      No worries, Mate! Linux users will figure out a hack soon enough. In fact - the criminal element probably already has an angle on it. Criminal kingpins in Russia discussing this article with criminal kingpins in America:

      Russian: So, the UK thinks they can block us?
      American: No, I don't believe that they think that - they are just challenging us to get more creative.
      Russian: You mean, something like counterfeit chips?
      American: For starters, yes. We just get some knockoffs made in China, and program them ourselves.
      Russian: Then what? Fall back to Linux, which the government doesn't control?
      American: Of course. We already have things like OpenBios. We need to hack some way for all those nosy government agencies to talk with our chip, through Linux, which of course, will tell the government whatever we want it to tell them!

      --
      "Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
    23. Re:No, Thank You, Dear Government by mhelander · · Score: 1

      So that leaves...just linux? :P

    24. Re:No, Thank You, Dear Government by Rich0 · · Score: 1

      Well, the CR-48 doesn't quite do what you say you want.

      In secure mode it only boots their OS. In developer mode it will boot anything. There is no option to only boot "your" OS.

      I think that trusted computing is fine, as long as I control the keys in the computer. Oh, and if I get a copy of the private keys associated with any public keys that are pre-loaded in the thing (not a big deal from a security standpoint - they just need to assign a unique keypair to each PC).

    25. Re:No, Thank You, Dear Government by greenbird · · Score: 1

      In general TPM's allow fully disconnected trust relationships.

      The government drone quoted in the article clearly states this has nothing to do with security and everything to do with DRM and controlling what is on your system.

      From the fine article:

      Owen Pengelly, deputy director of policy at the Office for Cyber Security and Information Assurance in the Cabinet Office..."Building the most resilient cyber defences in the world will not help if you are suffering from intellectual property theft," he said.

      --
      Who is John Galt?
    26. Re:No, Thank You, Dear Government by chill · · Score: 1

      You are correct in that it doesn't suit my needs. However, several laptops do in that they have TPM chips included, but uninitialized. You can initialize them and create the keys. This is optimal.

      I really don't mind the government mandating having a lock -- so long as *I* and not *they* have the key.

      --
      Learning HOW to think is more important than learning WHAT to think.
    27. Re:No, Thank You, Dear Government by vadim_t · · Score: 1

      Ah, but why would the government mandate a lock and leave it up to you to do something with it?

      There's no point in that. If you really want a TPM you can go and buy a computer with one, there's no need to globally impose having it on the entire population (which won't come for free, btw).

      The only point in requiring it is that there's something for the government in it, and most likely not to your benefit. Even if you do want a TPM you should oppose the government's attempt to introduce it, because it will serve them, not you.

    28. Re:No, Thank You, Dear Government by westlake · · Score: 1

      My Linux machine is well-protected and I don't need your meddling nor do I need Microsoft's

      But is it your Linux machine or does it belong to your employer, your school, or your parents?

      If your employer and others allow external access to secured internal systems, services and data, can they insist on dealing only with known, trusted, machines?

      The Linux machine with no network access is, for all practical purposes, a doorstop.

    29. Re:No, Thank You, Dear Government by Arancaytar · · Score: 1

      My Linux machine is well-protected and I don't need your meddling nor do I need Microsoft's.

      That is indeed one of the reasons why this will not work: there are people using all kinds of different OSes, including all the mobile ones, desktop OSes and whatnot. If the UK government were to only allow devices with the trusted computing built-in both the hardware and software they'd be instantaneously removing access for everyone who is used to using mobile devices to access those services.

      Another case of government not understanding technology, yet still pushing everyone to adopt it.

      In politics "this will not work" is not the same thing as "this will not happen". More often, it is the opposite.

    30. Re:No, Thank You, Dear Government by blueg3 · · Score: 1

      You can certainly do that. I just don't think it's easy to set up. There have been security papers, even, where people have configured Linux servers where the TPM on the server could prove to a client that the server's boot chain and software stack are verified. (Efficient? No.)

    31. Re:No, Thank You, Dear Government by RCL · · Score: 2

      Mobile devices are not a problem. Looked how locked down the iPad and iPhone are. That fits right in with the spirit of trusted computing.

      You realize that according to figures that you can on the web jailbroken iPhones constitute from 10 to 30% of the market? And those are certainly "conservative" estimates, because judging from iOS piracy rate ([1] [2]) percentage of jailbroken iDevices should be much larger!

    32. Re:No, Thank You, Dear Government by Anonymous Coward · · Score: 0

      Actually, there is much more support for trusted computing in Linux than there is in Microsoft products. The notion that trusted computing is "not open" or "takes control of the computer away from the user" is complete paranoid delusion. Don't trust me? Try learning about the technology from something other than Wikipedia, and instead read the completely open specifications for the TPM and its software stack, available at trustedcomputinggroup.org. Also, have a look at the source code for Linux projects like TrouSerS (available at SourceForge) and Trusted GRUB.

      The notion that the TPM takes control away from the user seems to be based on the fact that the TPM has a processor and key store that remain locked in a smartcard-inspired chip on the motherboard. Although you might not trust the firmware on this chip, you know just as much, if not more, about it than you do about the firmware running on your hard drive controller, your processor, or any other system developed as a closed source system and needed for operating your open source software. The TPM stores private keys in it's private data store, and only two of those. What you do with those is up to you as a developer, using the completely open specifications mentioned above.

      Remote attestation got you paranoid? Once again, that probably means that you have not read anything about it. The TPM stores SHA-1 hashes of firmware and software made by other components of the system, and most of those hashes are taken by -- wait for it -- open source software. The remote attestation mechanism is all about taking those measurements, hashing them together into Program Control Registers, and then hashing those PCRs and a server-supplied nonce into a "quote," which is signed by a TPM-protected private key. The process of assembling this quote is done by software at the full discretion of the owner of the computer. It is not done in secret, it does not reveal any information about the computer that the owner does not wish to reveal, and it does not depend on any particular software. It is, in fact, a much more useful tool when the chain of transitive measurements can be extended further from a root of trust. This is something that Microsoft does very poorly (by some Bitlocker elements, which don't use any part of remote attestation for what its worth), but is done quite well by many open source tools developed for Linux.

      What can this do for you as a user? It can give you more insight into the code that is running underneath your open source operating system. When was the last checked to see if your BIOS (or EFI) was running unmanipulated? If you have done this without the assistance of a TPM, did that mean removing the firmware from the computer and examining it forensically offline, or just trusting what version the BIOS said that it was running? There has been plenty of research on BIOS rootkits, so perhaps this isn't a bad idea. By writing your own software (on an open source system), you can remotely attest measurements of the BIOS code in your computer to YOU (not to the MPAA or name-your-own-untrusted-entity-on-the-internet).

      Perhaps your Linux machine isn't as well protected as you think it is, and the use of trusted computing could help you make it much better protected. Of course, you could also just comment on Slashdot about a technology you know nothing about and make yourself look like a fool to anyone else that does. Whatever.

    33. Re:No, Thank You, Dear Government by Anonymous Coward · · Score: 0

      That's an argument against governments in general. Governments, by definition, exist to impose, force and use violence if you don't comply.

      "Building the most resilient cyber defences in the world will not help if you are suffering from intellectual property theft," he said. "Trusted computing underpins security and can underpin growth, providing confidence in transactions, expanding markets and making them function more efficiently."

      As you can plainly see, this sort of thing has nothing to do with what a TPM provides, and requires quite a bit more than merely a locked down computer. It requires full-on country-wide censorship-by-default (ie. something cannot be published or put on the internet without going through a verification step first).

      Btw: anyone who thinks google is a friend to the piracy movement is mad. Totally bonkers. Google is pushing hosted applications. Their security policies go quite a bit further than mere computer lockdown : they don't even let you have a computer at all. Your computer, in google's world, is a mere display and a keyboard. Nothing more. EVERY command you give is vetted through 5 layers of security policy that they, and they alone control. They lock out people (granted, it's "their" system, and if you threaten it it's logical they take this step. But think about this : your documents are *only* at google sites. You cannot guarantee your own access to your own environment with google software the way you can with linux or microsoft). Google is a more evolved, more polished form of mainframe computing. ALL control is centralized.

    34. Re:No, Thank You, Dear Government by epyT-R · · Score: 1

      damage from tpm hurts a free society because it allows unilateral control from authority without sufficient mitigating oversight. that's why an imperfect system is best if a free society is the end goal.

      control over your own hardware is only part of the issue.

    35. Re:No, Thank You, Dear Government by houghi · · Score: 1

      I will accept it the moment we have Trusted Government.

      --
      Don't fight for your country, if your country does not fight for you.
    36. Re:No, Thank You, Dear Government by Zontar+The+Mindless · · Score: 1

      Yeah, a friggin' QuickTime movie. Brilliant.

      --
      Il n'y a pas de Planet B.
    37. Re:No, Thank You, Dear Government by FridayBob · · Score: 1

      For the moment at least, I don't think they mean your machine, rather those owned and operated by the British government. Still, seeing as they are major customers, this is a significant boost for the Trusted Computing Group and does not bode well for home users (treacherous computing, here we come).

    38. Re:No, Thank You, Dear Government by rrohbeck · · Score: 1

      That would require a function to set the acceptable pubic key(s) through the BIOS. I have never seen such a feature. They are always hardcoded in ROM or stored in the TPM module.

    39. Re:No, Thank You, Dear Government by chill · · Score: 1

      ...or stored in the TPM module.

      Exactly. There are functions available to load the keys into the TPM module upon initialization. https://rhn.redhat.com/errata/RHEA-2008-0391.html

      --
      Learning HOW to think is more important than learning WHAT to think.
    40. Re:No, Thank You, Dear Government by kvezach · · Score: 1

      I've consulted for a bank, and here's the dream : full offline money. If you have a TPM they will manage your account in your laptop (or phone, or ...) and have full offline payments. Because the TPM will only give their program access to the data, they can still prevent you from simply adding money in your own account, while allowing fully disconnected payments to occur which the bank will only find out about weeks after the fact (and so can you on other's computers of course).

      That sounds like a pretty big incentive to find someone with an electron microscope, or if you're part of organized crime, getting your own. It's not like TPM hacks haven't been pulled off before.

    41. Re:No, Thank You, Dear Government by Anonymous Coward · · Score: 0

      No, this is exactly why this will work.
      This law is designed to prepare the way to making it a crime to own a jailbroken device, or for putting linux on a computer you own.

      This is the kind of thing that makes me regret that politicians can't go to jail for putting ideas that should be criminal into law, like the one that a device I own isn't really mine.

    42. Re:No, Thank You, Dear Government by kvezach · · Score: 1

      The process of assembling this quote is done by software at the full discretion of the owner of the computer.

      So if you want to play that movie or clip on mplayer instead of Windows Media Player, you're of course free not to divulge any information that you're using mplayer - but if the site doesn't get a signed "I'm using Windows Media Player" token, it won't play the video clip in question. That freedom, like the freedom to work or not to work, is worthless if there's an imbalance of power - if all the video sites only want WMP for instance, or if you want to leak evidence of illicit goings-on at your company and the company server will only serve the data to an MSOffice version that can be trusted to stick the document in sealed storage.

      How about this solution: put a switch somewhere on the computer. Switch up? Then you can't forge TPM keys. Switch down? Then you can do so at your discretion. If you want protection that is truly for your own good, you'll just leave the switch up (and no virus can forge anything). If the programs you're running start professing allegiance to their owners in preference to you, flip that switch down and bypass them. Sure, lusers may be socially engineered, but if they're that gullible, the malware could do a DoS by instructing them to stick pieces of metal into the closest outlet, too.
      If Trusted Computing is truly about empowering the user, then this switch solution should only empower the user more and so there should be no opposition to it beyond the social engineering complaint.

    43. Re:No, Thank You, Dear Government by Anonymous Coward · · Score: 0

      The obvious "implied answer" here is that the government wants:

      a) a copy of the key
      or
      b) a backdoor key

      Anything else just makes it a very very expensive way to require optional features in all computers.

    44. Re:No, Thank You, Dear Government by Anonymous Coward · · Score: 0

      My Linux machine is well-protected and I don't need your meddling nor do I need Microsoft's.

      That is indeed one of the reasons why this will not work: there are people using all kinds of different OSes, including all the mobile ones, desktop OSes and whatnot. If the UK government were to only allow devices with the trusted computing built-in both the hardware and software they'd be instantaneously removing access for everyone who is used to using mobile devices to access those services.

      Another case of government not understanding technology, yet still pushing everyone to adopt it.

      You clearly don't understand the technology yourself. Linux and the open source community are better suited to adopt the trusted computing technologies, which require no cooperation on behalf of an authority to use. Try reading about trusted computing yourself. http://www.trustedcomputinggroup.org

    45. Re:No, Thank You, Dear Government by Dr_Barnowl · · Score: 3, Interesting

      Linux can use TPM just fine.

      It's one of those double edged swords - you can indeed, create a trusted platform. The question is, where does the trust reside?

      Despite all the the hoo-haa about MS pushing Secure Boot for Windows 8 machines, part of me thinks it's a good thing - it will help to prevent a certain class of rootkit. The downside is that I don't trust MS not to abuse the feature to make it harder to load other operating systems on your machine. A colleague of mine was impressed enough with a certain LiveUSB this week that he intends to try it out on his ageing, ailing, overcrufted Windows machine at home. If Secure Boot was enabled on his machine, this would not have been possible.

      Given the amount of software on my Windows machine at work devoted to snooping on what software I run, what files I have on my drive, and what websites I visit, the attitude is that my employer does not trust ME. To be honest, I wouldn't trust the average user not to foul up their computer. I might even welcome a trusted platform, if it meant that all this cruft went away and I could devote the resources to actually doing my job... but as a software developer, I can't run in an completely trusted environment, by definition, I have to be able to run software that has not been approved by our IT department, because I'm writing it.

    46. Re:No, Thank You, Dear Government by Anonymous Coward · · Score: 0

      Yeah, right now you have to have the following:

      1. PC (probably a laptop) with TPM chip
      2. The TrustedGRUB bootloader (a customized version of GRUB 1)
      3. Signed boot chain images of your trusted boot steps

      It's really quite a pain. Conceivably this could be simplified greatly with FDE hard drives. If an FDE hard drive allowed you to encrypt a read-only partition, and the BIOS could accept the key for that partition, then the TPM chip would only have to verify the contents of BIOS instead of the whole boot chain.

    47. Re:No, Thank You, Dear Government by Anonymous Coward · · Score: 0

      Oh, and if I get [b]a copy[/b] of the private keys associated with any public keys that are pre-loaded in the thing (not a big deal from a security standpoint - they just need to assign a unique keypair to each PC).

      You should know and control all the copies of the private key; if you don't, it's not really "private" anymore.

    48. Re:No, Thank You, Dear Government by vikisonline · · Score: 1

      Actually since with Debian and other distros I am able to get by only installing signed code from the repo, yes lets do this. And when Winblows gets a similar project done they can join the party too.

    49. Re:No, Thank You, Dear Government by CptNerd · · Score: 0

      Yeah, a friggin' QuickTime movie. Brilliant.

      So, download it, transcode it to Ogg or whatever religion you subscribe to, and repost it. Either that or cry like a baby. Oh, wait...

      --
      By the taping of my glasses, something geeky this way passes
    50. Re:No, Thank You, Dear Government by cheekyjohnson · · Score: 1

      Or just don't download it at all. "I don't have a problem with it. Therefore, your criticism is invalid!"

      --
      Filthy, filthy copyrapists!
    51. Re:No, Thank You, Dear Government by Yoozer · · Score: 1

      What I want to see is Trusted Government, but apparently that's an NP-hard problem.

    52. Re:No, Thank You, Dear Government by Hatta · · Score: 1

      That is indeed one of the reasons why this will not work: there are people using all kinds of different OSes

      This is one of the reasons why it will be done anyway. It's an excuse for governments to supply more customers to their most valuable constituents. They don't know or care about open source or your freedom.

      --
      Give me Classic Slashdot or give me death!
    53. Re:No, Thank You, Dear Government by gtall · · Score: 1

      You miss the point. MS and friends don't care what a bunch of geeks do with their systems, they are interested in locking down the mass market who wouldn't have the faintest of fuzzies there is even a problem.

    54. Re:No, Thank You, Dear Government by nurb432 · · Score: 1

      Short answer: You don't.

      --
      ---- Booth was a patriot ----
    55. Re:No, Thank You, Dear Government by nurb432 · · Score: 1

      But, there is a small switch in the battery compartment to put it into developer mode where it'll boot any image.

      And you expect that to be available ( or even legal ) once this stuff passes?

      --
      ---- Booth was a patriot ----
    56. Re:No, Thank You, Dear Government by pmontra · · Score: 1

      I complete your answer: if the masses don't have an easy way to install the next open source OS, there won't be another open source OS. Bingo, if you are in the closed source business.

    57. Re:No, Thank You, Dear Government by kermidge · · Score: 5, Informative

      Thanks for the link.

      Okay, I read. I followed the included link http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html and read it, then spent another couple of hours reading more from a few of the links included in that article. At first blush there is some seriously horrifying stuff going on, much of it masquerading under the simplified banner of "think of the children"-style of emotional appeal but whose ultimate goal, and real appeal to the powers that be, is ultimately profit and control. Then it gets worse, IMO.

      To me the warning of the dictum latterly attributed to Lord Acton (?) of "Power corrupts; absolute power corrupts absolutely." applies. [I suspect that that thought precedes written language.] If the power exists, it will be used - similar to yet farther reaching than "The 400" effectively control the US economy concomitant with its realpolitik. (I came across an article yesterday about researchers using systems analysis to determine that 1381 multi-nationals effectively controlled the planet's economy, all sans benefit of conspiracy but rather merely efficiency, but cannot find the link just now - science 2.0, perhaps; it was interesting reading, and it doesn't require a tin-foil hat to accord it some credence.)

      So, if I have this a-rightly: TC does not, or will not, eventually, require more than a CPU and, at root, certain few government keys. It will be independent of OS, BIOS or UEFI, separate on-board chip, application code, what have you. Non-TC CPUs will be isolated to unconnected hobbyists; there will be no Internet functionality independent of approved TC CPUs. By extension, it will not even be possible to have private electronic-based communication amongst "ourselves" using PGP and such, because non-TC comms will not make it through any of various Internet intermediaries. And I suggest not counting on darknet.

      http://en.wikipedia.org/wiki/Trusted_Computing_Group gives a quick look at the initial industry players.

      At the moment, so far as I know, volume production of chips is not a trivial or easily hidden activity; further, absent genuine keys or imaginary effective counterfeits, independent and free electronic interaction will not be possible. If you think that's a gloomy overthink, it was worse before I read the comics section.

      What with proprietary formats and such, DRM, DMCA, etc. - tip of the iceberg and all that - I see this as a snowball rolling down an endless slope such that the only hope is that "the" singularity when it may happen might prove a more benign overlord or, perhaps, even companion of sorts. Meanwhile, let's continue to have fun. It's only cradle to grave, right?

      On the off-chance anyone got this far: sorry for the long post. I first read on some of this back in the early 90's, and found it to be sufficiently scary and depressing then after doing a bit of extrapolation.

      Any smart people with non-smart-ass ideas on how to deal with this? I'm a bit more than curious, even 'tho, at 64, it may not be personally relevant for long.

    58. Re:No, Thank You, Dear Government by OeLeWaPpErKe · · Score: 1

      The whole point of the TPM is that it has a private key which NOBODY controls. It is in the device exclusively. There is circuitry inside the TPM to run key generation and to export the public key. There is not circuitry to export the private key at all.

      Nobody has the key to this device. Not you. Not the manufacturer. Nobody.

      That is why they're used at banks. Banks can have a root private key they control, and no matter how idiotic/malicious their employees, the key cannot be compromised (it can be erased by nitwits though, which sadly frequently happens, which usually causes an outage on inter-bank payment traffic until a new TPM can be shipped to them (bank TPMs are 6 kg black boxes that have additional security, mainframe compatibility and cobol and java interface libraries - see "Night of the living dead 184" for how well it works in practice). But nobody has the keys at all, which means they cannot be stolen without someone wondering why their inter-bank traffic just started getting all sorts of "permission denied" errors.

    59. Re:No, Thank You, Dear Government by CptNerd · · Score: 0

      "I allow my format religion to determine what information is valid and can safely ignore anything that doesn't conform to my belief. Brilliant!"

      --
      By the taping of my glasses, something geeky this way passes
    60. Re:No, Thank You, Dear Government by OeLeWaPpErKe · · Score: 1

      I wonder how many times this has to be said, but a TPM does not allow unilateral control. It allows bidirectional trust. I can send you a program, ask you to run it, get results back, and then verify that you indeed produced those results using my program. (e.g. think of it this way : I could send you a program that "is" a credit card. You could buy and sell stuff with it, transfer money between different instances of the program over the internet without contacting any bank, and then sync this program, say, weekly, back with the bank. Right now such a program is utterly impossible because banks do not trust you not to tamper with the data. TPM would allows banks (and that program) to detect (NOT prevent) you've tampered with the data. You can delete the data without anyone's permission. You can tamper with the data without anyone's permission, but you cannot lie about the fact afterwards.

      If you could use trusted computing today, bitcoin would be no more complex than a program that can correctly execute transactions against an internal counter over tcp. Encryption would be implicit, and nobody would need to think about it.

      One application I'd consider very nice would be this : you send a vmware image to a provider. It puts a site online at https:/// something. You can make the setup such that if they try to read the disk or memory of the vmware image, the site will go offline and they'll be completely unable to bring it back up, or read the disk, because they lack the encryption key. You would be able to let external parties process highly sensitive information without having to fear for the safety of your data.

      I find the different applications possible with this technology to be both positive and negative from the government's point of view. It can partially prevent piracy (though no better than starcraft II's online only play can do so). It can just as well be used to create an online kiddy porn site that "customers" wouldn't be able to expose even if they wanted to. It could make a guaranteed 100% safe Tor network.

      A TPM isn't good or evil, it's just a technology to prevent idiots from exposing their private keys. The thinking is simple : given that out of 5 major american banks 3 managed to expose their root keys for the payment system, 2 of which found fraudulent transactions (due to dishonest employees), what makes you think you can do better ?

      But can we please stop the idiotic idea that some other party has access to TPM private keys ? This is not the case.

    61. Re:No, Thank You, Dear Government by shutdown+-p+now · · Score: 1

      The downside is that I don't trust MS not to abuse the feature to make it harder to load other operating systems on your machine.

      Microsoft doesn't make Secure Boot hardware, and Win8 requirements do not include "cannot be disabled by any means". It's perfectly valid to have the hardware manufacturer provide a hardware or firmware switch killing it. Whether they will do in practice is a different matter, but this issue should be raised with OEMs - as a law, if need be.

    62. Re:No, Thank You, Dear Government by shutdown+-p+now · · Score: 3, Interesting

      The right question to ask is: what proportion of people who bought iPhone or iPad would have still bought them if they were non-jailbreakable?

    63. Re:No, Thank You, Dear Government by shutdown+-p+now · · Score: 1

      I think his point is that TPM is not necessarily evil per se, not that the initiative described in TFA is not evil.

    64. Re:No, Thank You, Dear Government by Anonymous Coward · · Score: 1

      When my employer has a required e-course in "safe computing practices", that can only be viewed on a Windows PC running IE with Flash installed, I'm not sure I trust them, either.

    65. Re:No, Thank You, Dear Government by Anonymous Coward · · Score: 0

      Which defeats the whole purpose in the first place. If it can bed one in software then there is no point in a hardware solution.

    66. Re:No, Thank You, Dear Government by RCL · · Score: 2

      Hard to estimate, given that a lot of second-hand iPhones are sold jail-broken. Certainly less users would buy it if they couldn't run pirate apps or use it with their favourite telco.

    67. Re:No, Thank You, Dear Government by OeLeWaPpErKe · · Score: 1

      http://www.youtube.com/watch?v=DTXO7KGHtjI

      Virtual pop stars can't be that far off in America.

      May I advise Belgium ? The food is good, the beer is great and so is the social security.

    68. Re:No, Thank You, Dear Government by OeLeWaPpErKe · · Score: 1

      Offline payments also seem largely unnecessary given how the internet is increasingly available anywhere.

      I can attest to plenty of places where it isn't.

      Also there are a lot of potential pitalls. If you transfer money to me offline, can the money disappear if the computers are never synchronized?

      The money cannot disappear. There are 3 possible cases : Both people sync, there is no problem. Either one syncs, and the money's there. Both neglect to synchronize, and the money isn't transferred at all.

      Loss of control. My stuff is mine, period, and I don't have to give lenghty explanations of that. But no, it's not piracy. On my hardware, which I paid for, I should have absolute access to every single bit of it.

      You do, you just only have access to other people's data on your machine in encrypted form (this is not even necessarily so, but presumably this is how they'll want it).

      You can touch every last bit on your machine including those on the TPM, you just cannot read them (only erase + rewrite). You have full access on your machine and your say-so determines 100% if something happens or not. TPM simply means it'll be impossible/hard for you to lie about having done something.

      The basic application of the TPM is simply that. Send someone a program, receive back the signed output of that program. It is impossible for the owner of the computer to forge that signature, and that signature identifies exactly which series of machine instructions was used to arrive at that data. Everything else remains fully within his control.

      I will certainly not buy anything that implements such a scheme.

      1) you probably already have, do you have any American-made cpu produced in the last 2 years ?
      2) even if you don't care for it, the ability to offer trusted relationships with other entities is a very useful one

    69. Re:No, Thank You, Dear Government by OeLeWaPpErKe · · Score: 1

      I think the issue is much more about that this movie is made in a DRM'ed format that implements much more invasive stuff (in software) against you.

      Sadly, the movie is propaganda. A TPM cannot take over a computer, it never will be able to do that (Ironically, quicktime has implemented mechanisms in the past that *do* take over computers at the lowest levels).

      I don't get how someone who uses *anything* apple can seriously criticize trusted computing. Why criticize the danger of the needle in a mean and smiling kids' hand when you've already got harpooned in the ass ? Apple's DRM is the worst on the market, by far, and is 100% unilateral. Just try installing non-approved software on apple devices.

      Trusted computing allows anyone to participate in both ends of the trust relationship, unlike apple.

    70. Re:No, Thank You, Dear Government by OeLeWaPpErKe · · Score: 0

      Like many others he is an idiot.

      What he is referring to is "trusted execution" technology, which is a different beast entirely. It basically means that the OS will refuse to execute any non-signed binary. Currently the only use of this I know of is on linux systems. Redhat, for example, supports this.

      Sadly trusted execution security is as vulnerable to government morons, and others, as everything else : sign anything that loads code, from ld.so for the only slightly moronic types, to a perl or python binary for the truly gifted retard and it's all over.

      But let's get real here : microsoft will (eventually) implement trusted execution on corporate domains whether or not TPM gets implemented. If you buy a computer that boots in trusted execution mode, it's all over. This has nothing to do with TPM, except that TPM allows remote systems to verify if you run a trusted execution environment or not.

    71. Re:No, Thank You, Dear Government by OeLeWaPpErKe · · Score: 1

      The issue is not to make systems perfectly secure, but simply hard enough to crack to stop 99.99% of attackers.

      Bank cards have been cracked much more than TPM's, and they are much easier to fool too. Last crack I heard of what of VISA chip cards. Simply tell the bank the transaction is verified with the card, and tell the card the bank verified the transaction. *boom* Transaction passed, and you can pull this all but the very latest models of cards today. Morons. Yet they're still in use, and nobody's seriously discussing replacing them any time soon.

      Also, it's not like a cracked TPM would let you do anything at all to a bank. You would need to crack *someone else's* TPM, without him noticing, and before he has a chance to enroll another TPM with the bank, or warn them. Then you'd have to execute code with the cracked TPM still running, so you'd be able to get at the actual signature, to get the data to encrypt.

      While it's true that equipment capable of doing this exists, I'm pretty sure I will notice anyone bringing in chip slicing and electron microscope technology in my living room. Why, the boatloads of liquid nitrogen would probably not fit in Obama's largest living room. Also, you'll sure as hell not be able to give me back my laptop undamaged after that, so chances are you'll be noticed even if you have these resources.

      Security has long since given up the idea of making cracks impossible. We're making them unfeasible.

    72. Re:No, Thank You, Dear Government by stanlyb · · Score: 1

      That's why i DON'T buy Intel. Not Ever

    73. Re:No, Thank You, Dear Government by Anonymous Coward · · Score: 0

      If no one has the keys, no one can sign the code. This makes a system pretty useless, unless you want to encode things for the TPM chip (which again, makes little sense), ergo: you are wrong.

    74. Re:No, Thank You, Dear Government by amiga3D · · Score: 2

      I suppose you could work in a virtual environment.

    75. Re:No, Thank You, Dear Government by rrohbeck · · Score: 1

      But if tools are commonly available to store new keys, what's the point? Malware could use them.

    76. Re:No, Thank You, Dear Government by mug+funky · · Score: 1

      even before we get into legislation (this article is an example of my trusting legislators slightly less far than i could bat them with my dick), you might consider that the market might actually work in this case.

      if dell, lenovo, asus, et al don't allow an override, alienware might just do so out of respect for their customers.

      of course, if nobody allows an override, the market is ripe for a small upstart to fill the niche that would like to have one.

    77. Re:No, Thank You, Dear Government by Anonymous Coward · · Score: 0

      Really all of you dont understand shit about trusted computing. The TPM foes not have thr ability nor those Tc has The intent to restric what is loaded at boot.

      People are really dumb and paranoiac about trusted computing.

    78. Re:No, Thank You, Dear Government by shutdown+-p+now · · Score: 1

      That's why I wrote "if need be". If, in practice, it will not be hard to get hardware with a switch, then all's well and good, and keep regulation away. If not, that's when anti-competitive police comes in.

    79. Re:No, Thank You, Dear Government by cheekyjohnson · · Score: 1

      Yeah. It's called having preferences. People have different likes and dislikes. Odd.

      --
      Filthy, filthy copyrapists!
    80. Re:No, Thank You, Dear Government by cheekyjohnson · · Score: 1

      I don't get how someone who uses *anything* apple can seriously criticize trusted computing. Why criticize the danger of the needle in a mean and smiling kids' hand when you've already got harpooned in the ass ?

      Sounds like appeal to hypocrisy to me. Their criticism likely isn't invalid merely because you think they're hypocrites (or in the exact same situation as the ones they're criticizing).

      --
      Filthy, filthy copyrapists!
    81. Re:No, Thank You, Dear Government by Zontar+The+Mindless · · Score: 1

      Can you provide me a link to the QuickTime plugin for Firefox on Linux? Couldn't seem to find it on Apple's website.

      --
      Il n'y a pas de Planet B.
    82. Re:No, Thank You, Dear Government by exomondo · · Score: 1

      The downside is that I don't trust MS not to abuse the feature to make it harder to load other operating systems on your machine.

      MS only controls the operating system, not the UEFI options, that is controlled by the motherboard manufacturers and OEMs. If MS actually wanted to prevent other OSes from being loaded onto systems shipped by their OEM partners and could manage to convince those manufacturers to go along with it they would have done so long ago. UEFI doesn't change anything in that respect.

    83. Re:No, Thank You, Dear Government by NightWhistler · · Score: 1

      If you can include your own certificate to be trusted, a lot of the problems would disappear but it would still be a huge step backwards from where we are now: instead of being able to just download a Linux image you'd be back to compiling everything yourself.

      There's also the problem of small software companies or invidivuals that write software for a living. Software developers would need to become licenced to receive a key-pair that allows them to sign software so it will actually run. I can see how it would be attractive to governments to be able to trace back any piece of software to the author by means of the key with which it was signed, but it would be a huge blow to personal freedom.

      This defintely sounds like yet another attempt to force both the internet and computing in general back into a 20th century world-view with tighter government control. I know I'll be keeping an eye out with my next hardware purchase to make sure my hardware is still mine.

      --
      PageTurner Reader: open-source e-reader for Android with cloudsync. http://pageturner-reader.org
    84. Re:No, Thank You, Dear Government by knorthern+knight · · Score: 1

      > I've consulted for a bank, and here's the dream : full offline money.

      We've had "full offline money" for centuries. It's called "money", believe it or not. And it works. The "dreams" are peoples' worst nightmares...

      1) the bank can ding you for a fee everytime you buy anything, even a 1 dollar item.

      2) the TLA's (Three Latter Agencies) would have access to the data, and be able track everything you do

      --

      I'm not repeating myself
      I'm an X window user; I'm an ex-Windows user
    85. Re:No, Thank You, Dear Government by OeLeWaPpErKe · · Score: 1

      Since the site clearly embodies the fact that they find the apple situation acceptable, clearly they have no problem with draconian, completely one-sided DRM. They have no problem with their computer obeying someone else's wishes over their own.

      Yet this is supposedly what they're attacking.

      This is like Chavez' famous speech, you know, the one where he attacks the rich for wasting money for 30 minutes, and the first question from one of the journalists is "Isn't that an armani suit with italian shoes you're wearing ?". Or the picture of Al Gore's vacation getup : not just one huge trailer, but actually 2 wagons. Behind the end of wagon 2 there is a car with a boat mounted on it, and the trailer actually has a built-in garage, presumably containing a car. The same can be said about his garage : a big collection of gas guzzlers. It makes the statement "Al Gore cares about wasting CO2" completely untenable (well, he's a politician, of course).

      The same is true here. This person clearly doesn't mind proclaiming in public that he's in favor of DRM, or at least not willing to make sacrifices to prevent DRM. And yet he's attacking a very mild form of DRM that is reciprocal.

      And the second thing is that this video was clearly made with a budget. Which begs the question : who paid for this ? Hell, maybe it's Apple.

    86. Re:No, Thank You, Dear Government by OeLeWaPpErKe · · Score: 1

      Of course it makes sense. The TPM itself has they keys, and you can use them to encrypt and decrypt things, you just cannot read the keys. Here's how it works.

      The TPM makes a signature of the "trusted computing base". This is the code of the bootloader + operating system that's executing + the current program that's executing. Basically a checksum of all code that can influence the execution of the program. This checksum itself forms the basis of an encryption key.

      Then the program executes, and produces some output. The program sends this output to the TPM, which signs it using the checksum key, then signs the whole thing using it's private key.

      The manufacturer of TPM's makes a public key available (the manufacturer's private key is in a TPM, and is destroyed after a production run), and the TPM itself has it's public key signed with the manufacturer's key. This is not meant to be a 100% correct representation of the process, because there's a bunch of caveats, mainly to do with protecting the privacy of the TPM owner, but a general operating principle.

      Ok, so you make a deal. The remote party agrees to execute your program, and it makes a tcp connection to your server (or establishes another means of communication). Ok now you receive output from the program. You know the checksum from the execution environment of your program on the remote computer, and you can verify it's genuine by examining the certificate chain. You look up this checksum and see if you can agree with it (basically, if there's no VM or debugger or strange dll overrides or some such in the remote execution environment, you accept*). Otherwise, you refuse to communicate and ask for your money back.

      * you don't know the exact layout of the remote environment, only it's checksum. So you can verify that against the "expected" execution environment that the guy promised at contract time. E.g. VMWare on bare metal.

      One of the things this gives you is a secure communications channel with your program. You are 100% sure it's your program on the other end, and due to the encryption nobody can insert or delete stuff from the stream (unless you haven't done your homework). Now you use the program, secure in the knowledge that the parties that can fuck you over are very minimal :
      1) intel (or AMD, or Snapdragon, or ...)
      2) the memory manufacturer
      3) the hardware producer of the TPM
      4) VMware (in this example)
      Specifically, you have the same security environment you would have if the server was your own server. (think about it, just typing the response to this post into your computer requires a bigger set of trusts : your OS, browser and slashdot would be included, each of those could change your post in transit).

      That's trusted computing.

    87. Re:No, Thank You, Dear Government by pmontra · · Score: 1

      You're right, I didn't think of that. Anyway that doesn't solve the hardest part of the problem: how do you get traction for your OS if people can't install it as the host OS of their machines? We wouldn't have Linux even on the servers if all we could do was running it into virtual machines (not so common in the early '90s but you get the idea). TPM will lock us into the software a few companies want to sell us. Less choice and a more static world. Good for the incumbents, worse for anyone else.

    88. Re:No, Thank You, Dear Government by ozmanjusri · · Score: 1

      Microsoft doesn't make Secure Boot hardware, and Win8 requirements do not include "cannot be disabled by any means".

      There was a very good post over in Reddit on this:

      UEFI specifications do not mandate that OEMs provide options in their configuration screens to disable secure boot. Nor do the Windows 8 Logo requirements. This means that there can be hardware that will arbitrarily lock users out of alternative operating systems. We really can't tell when this will happen, or if it will happen, until some short-sighted OEM decides to do this. I can tell you why they will do this though:

      Microsoft's logo requirements only require UEFI secure boot, they do not specify how the signing happens. Yes, Microsoft will provide signed kernels and keys that OEMs can use. But they aren't required to use those keys. OEMs are perfectly allowed to take the Windows kernel, resign it with their own key, and ship the machine such that it only installs the OEM's Windows. So the OEMs will not be trying to lock us out of Linux, they will be trying to lock us out of Windows 9 so that they can make us buy new computers to upgrade.

      http://www.reddit.com/r/linux/comments/kmyt4/windows_8_certified_computers_may_not_be_able_to/c2lmpb7

      --
      "I've got more toys than Teruhisa Kitahara."
    89. Re:No, Thank You, Dear Government by shutdown+-p+now · · Score: 1

      UEFI specifications do not mandate that OEMs provide options in their configuration screens to disable secure boot. Nor do the Windows 8 Logo requirements.

      That's kinda obvious - why would they mandate a disable switch? It bears no relation to Win8, so it's between OEM and its customers.

      OEMs are perfectly allowed to take the Windows kernel, resign it with their own key, and ship the machine such that it only installs the OEM's Windows. So the OEMs will not be trying to lock us out of Linux, they will be trying to lock us out of Windows 9 so that they can make us buy new computers to upgrade.

      That part is pure BS. How do you think it'll work with Windows Update, when that needs to update the kernel? What about service packs?

    90. Re:No, Thank You, Dear Government by Anonymous Coward · · Score: 0

      Well that is about par for the course with them these days the last lot we had were crap this lot seem just as freakin bad what with Camergoon and Clogg head Clegg in control ( they think for now) no wonder it's SNAFU

    91. Re:No, Thank You, Dear Government by V!NCENT · · Score: 1

      You already have a TC chip. The only joke is that Linux hands the key ownership to... the user. Meaning you are in control.

      --
      Here be signatures
    92. Re:No, Thank You, Dear Government by vadim_t · · Score: 1

      I can attest to plenty of places where it isn't.

      I'm not seeing the examples

      The money cannot disappear. There are 3 possible cases : Both people sync, there is no problem. Either one syncs, and the money's there. Both neglect to synchronize, and the money isn't transferred at all.

      Then why have it in the first place, since you need to get online anyway?

      Also, potential problem: Alice sends expensive widget to Bob. Bob pays offline. Bob then just in case he manages to get away with it, has an incentive not to sync. Then it all depends on Alice, so if for whatever reason she's unable to sync the transaction, Bob gets the widget, Alice gets nothing, and Bob can't really be blamed for much.

      You do, you just only have access to other people's data on your machine in encrypted form (this is not even necessarily so, but presumably this is how they'll want it).

      I won't have a single bit of that on my hardware. Anything that requires such a scheme is automatically "no go". If you have DRM, I don't want your product, and if you require a transaction of this kind, you'll have to find another buyer.

      You can touch every last bit on your machine including those on the TPM, you just cannot read them (only erase + rewrite). You have full access on your machine and your say-so determines 100% if something happens or not. TPM simply means it'll be impossible/hard for you to lie about having done something.

      That's not to my advantage, so I refuse to participate in such a thing, and especially to pay for anything that implements it.

      1) you probably already have, do you have any American-made cpu produced in the last 2 years ?

      Actually no, and I've intentionally passed on laptops with a TPM chip. TPM == no sale.

      2) even if you don't care for it, the ability to offer trusted relationships with other entities is a very useful one

      Good for them, but I'm not buying into it, especially into government mandates.

    93. Re:No, Thank You, Dear Government by vadim_t · · Score: 1

      My point is that being content with having the government mandating anything like this is dangerous. They wouldn't be mandating it if they planned to give you full control of it. If that was the plan, there'd be no need for a mandate, you'd just buy it if you want the functionality.

    94. Re:No, Thank You, Dear Government by cheekyjohnson · · Score: 1

      Since the site clearly embodies the fact that they find the apple situation acceptable, clearly they have no problem with draconian, completely one-sided DRM. They have no problem with their computer obeying someone else's wishes over their own.

      Yet this is supposedly what they're attacking.

      That's rather irrelevant. They can attack draconian DRM while still using a product that has it.

      --
      Filthy, filthy copyrapists!
    95. Re:No, Thank You, Dear Government by ale2011 · · Score: 1

      An interesting exercise, aimed at sticking to the OP's concern, is to search for the word "government" in the links you mention. I only quote RMS':

      If Microsoft, or the US government, does not like what you said in a document you wrote, they could post new instructions telling all computers to refuse to let anyone read that document. Each computer would obey when it downloads the new instructions. Your writing would be subject to 1984-style retroactive erasure.

      However, this key-sharing conspiracy has not yet been committed by any specific government, has it?

    96. Re:No, Thank You, Dear Government by Anonymous Coward · · Score: 0

      WOW! Can it be true? All at once, the Libertarian side of /. emerges! NO government interference - except pay my student loan, pay my housing, pay my (fill in the blank).
       
      Pigs must be flying today.

    97. Re:No, Thank You, Dear Government by AmiMoJo · · Score: 1

      The downside is that I don't trust MS not to abuse the feature to make it harder to load other operating systems on your machine.

      The problem is providing a user interface to do that, or rather not providing one and therefore making it extremely difficult. To install a bootloader it needs to be signed which a private key, and the OEM will be the only one who has access to it. The BIOS will only have the public key which can't be used to sign code.

      None of that would be a problem is there was a way for the user to make their own keys, but I can't see the likes of Dell or HP bothering to ship software to do it or providing an option in the BIOS. Best we can hope for is the ability to turn the security check off. Desktop computers often have that sort of option in the BIOS, but laptops rarely do.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    98. Re:No, Thank You, Dear Government by AmiMoJo · · Score: 1

      I wouldn't like to bet that in the future we will still be able to jailbreak. Look at how long it took to get into the PS3, and whenever someone finds a new vulnerability efforts are made to prevent it in future.

      You can see how protection has evolved from simple analogue chips in the original NES to custom CPUs with integrated ROM and physical barriers that prevent them being studied by scraping away the top layer or using an electron microscope. In fact the Gameboy CPU took decades to crack its internal ROM, and the technique lead to the PS3 hack.

      Another issue with PCs are the relatively short lifespans. If it takes a year to crack a particular TPM system then the hardware it shipped on may already have been superseded. You don't see many year old laptops for sale at PC World.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    99. Re:No, Thank You, Dear Government by chill · · Score: 1

      No, it doesn't work that way. First initialization is sort of a manual process. It is actually a fairly secure process and not really open to malware circumvention. Possible, yes. Complicated, convoluted and highly unlikely, yes.

      --
      Learning HOW to think is more important than learning WHAT to think.
    100. Re:No, Thank You, Dear Government by gman003 · · Score: 1

      The PS3 did take a while from release to get hacked, I'll give you that. But it was not for technical reasons.

      For most of the PS3's lifespan, it supported Linux out-of-the-box. Since that's enough for most people, they didn't feel the need to break it just to boot, say, FreeBSD.

      Once Sony disabled it, it took less than a month for a jailbreak to be made. They managed to stop it by using a ton of lawsuits and threats, However, even with a truly massive legal campaign, it took less than a year for a jailbreak to be released.

    101. Re:No, Thank You, Dear Government by Anomalyst · · Score: 1

      Additionally, why would I trust applications written by Banks who have a well documented history of forcing their consumers to bend over and take what they give them. The probability of their marketdroids will create some horrendous steaming pile of code that will be shoved with no little proper design, QA or thought for collateral effects and completely bork your system approaches 100%.

      --
      There is no right to feel safe thru security vaudeville at the expense of everyone's freedom, privacy and tax money.
    102. Re:No, Thank You, Dear Government by AmiMoJo · · Score: 1

      I disagree, the technique used to crack the PS3 was unknown before. Well, unknown to the general public anyway. That Gameboy hack using clock glitching was the first published example and lead directly to the memory bus glitching attack on the PS3.

      Naturally there was a concerted effort since the day the PS3 launched to crack it in order to play pirated games. The first PS2 mod chips were created for that reason, rather than for homebrew.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    103. Re:No, Thank You, Dear Government by Anonymous Coward · · Score: 1

      The TPM most certainly does allow unilateral control. It does it by keeping its secrets from the owner of the machine. It's designed to solve the DRM problem - if I send you content, I also have to send you a key to decode it if you want to watch it.

      The TPM is the key - in many different sense of the word. It's a secure root of trust that allows software makers to be sure that you are running approved software only - that your machine is exactly as they expect it to be. The trusted companies crap on about how the parts need to be "open source" (digitally signed, unalterable except by the signer)... what they don't tell you is that nothing built on that "trust" has to be open at all. Your "trusted" Bluray player won't be fucking open source. The whole trusted computing idea also support execution of encrypted binaries - so you won't even be able to put a debugger on it to see what code is running.

      If you can't see the massive abuses that fall out of that... then you either a) don't understand software b) are a massive liar.

      So don't try burying this in bullshit. The TPM and trusted computing is massive power grab by the IT companies... nothing less.

    104. Re:No, Thank You, Dear Government by Anonymous Coward · · Score: 0

      Linus Torvalds is a communist terrorist, much like Julian Assange.

      Lock up everything and charge by the minute for access!

      Anything else is communist-nazi speak.

      You are either with us or against us!

    105. Re:No, Thank You, Dear Government by kermidge · · Score: 1

      Point taken. Nope, so far as I know. Well, apart from Narus/ATT/NSA and all that, but that's different tech.

      I read some of the stuff from the links given in Ross Anderson's piece. Trusted comms, great. Freedom from malware, great. Potential for abuse, also great.

      I started with the 1972 USAF pdf and went on from there, chronologically, for a few hours, then skipped around. The Congressional stuff strikes me as relevant, viz. government, but YMMV.

      To me, given history, the gap between what government does now and what it will have the [relatively near] potential to do is interesting.

      Is the question of what a government is doing at this instant of sole relevance?

    106. Re:No, Thank You, Dear Government by PoopCat · · Score: 1

      Why would the vendor not be able to sign the kernel update with their own key the way they do OEM Windows? Point OEM-Windows-Update at windows.update.oem.com and Bob's a monkey's uncle.

    107. Re:No, Thank You, Dear Government by PoopCat · · Score: 1

      One word: servers.

    108. Re:No, Thank You, Dear Government by amiga3D · · Score: 1

      I sort of agree. On the desktop it's a no go but take servers for example. You get a large powerful server running the State approved Big Brother OS, say "Windows People's Embraced Edition" or Win pee for short. You could load up multiple instances of Redhat Enterprise 25 or what have you and avoid paying the license fee for a hundred or so instances of win pee. Big brother gets to watch you through the host system and you get to save money on licensing fees. I like win-win situations.

    109. Re:No, Thank You, Dear Government by Rich0 · · Score: 1

      Nobody has the key to this device. Not you. Not the manufacturer. Nobody.

      True, but the key is signed by the manufacturer's key, which is how the whole chain of trust works. Otherwise there would be no way to do remote attestation.

      So, if the manufacturer loads their certificate in my laptop, then I'd like to have their private key, so that I can sign other keys of my choosing and defeat remote attestation. My computer works for me - not somebody else.

      That was my point. Sure, nobody would ever go for it, but the fact is that this can be done without giving anybody access to anybody else's machine. The manufacturer simply needs to generate one key per laptop, sign that key, give that key to the laptop owner and use it to sign the laptop's TPM key. Of course, it would be useless for DRM since the consumer can bypass it, but it is still perfectly fine for letting the computer owner protect their PC, or for companies to manage their PCs.

    110. Re:No, Thank You, Dear Government by OeLeWaPpErKe · · Score: 1

      Yeah but you have to admit it hurts their credibility pretty badly.

      If code pink co-rallied with the NRA, you wouldn't call that "rather irrelevant", yet it's the same thing essentially.

    111. Re:No, Thank You, Dear Government by cheekyjohnson · · Score: 1

      Yeah but you have to admit it hurts their credibility pretty badly.

      I don't think it does.

      --
      Filthy, filthy copyrapists!
    112. Re:No, Thank You, Dear Government by OeLeWaPpErKe · · Score: 1

      Mind if I ask why not ? Their argument boils down to "DRM for me, but not for you".

      At least microsoft makes it two-sided.

    113. Re:No, Thank You, Dear Government by cheekyjohnson · · Score: 1

      Because their character has nothing to do with the issue.

      --
      Filthy, filthy copyrapists!
    114. Re:No, Thank You, Dear Government by Anonymous Coward · · Score: 0

      You're an idiot. The key works just like a physical key in this case. It's inside a black box that handles encryption/decryption and signing. They key cannot be exported so it cannot be digitally stolen. It could only be physically stolen which would be immediately (within milliseconds) obvious to a great deal of people.

    115. Re:No, Thank You, Dear Government by Anonymous Coward · · Score: 0

      Of course it does. They're at the forefront of the movement, they're the ones most likely to negotiate actual deals.

      Only in an ideal world is that true. In our world, not so much.

    116. Re:No, Thank You, Dear Government by cheekyjohnson · · Score: 1

      They're not wrong just because they're hypocrites. That doesn't make sense.

      As I said, their character has nothing to do with it. You have to answer their individual arguments, not attack their character.

      --
      Filthy, filthy copyrapists!
    117. Re:No, Thank You, Dear Government by Dr_Barnowl · · Score: 1

      You only need to sign the bootloader - that then trusts the kernel that it loads.

      The OEM need only sign the bootloader, as the first step in the chain of trust. Then that will trust MS signed kernels, that will trust MS signed updates, etc.

    118. Re:No, Thank You, Dear Government by shutdown+-p+now · · Score: 1

      Then that will trust MS signed kernels, that will trust MS signed updates, etc.

      What you describe is how it actually works. But GP was talking about kernel being signed by OEM (and presumably customized by said OEM).

  2. This won't last. by mfh · · Score: 1, Interesting

    Here is what we'll do.

    We will create and use our own internet and if you have one of those chips on your computer, we'll disable your access to it. Thanks Government for giving us a way of checking if someone is controlled by you!!

    --
    The dangers of knowledge trigger emotional distress in human beings.
    1. Re:This won't last. by arth1 · · Score: 2

      This is the entirely wrong way to think. Like most technologies, this one has good uses and bad uses. To ban a technology because of bad uses is no different whether it's you doing it or a government doing it.
      Lack of TPM is a deal breaker for many businesses and individual - being able to encrypt a laptop in a way that the HD can't be used if removed from the machine, and can't be booted without verifying biometric data against the TPM signed data means that even with the machine, it's just a brick without the user.

      The first time around, privacy advocates were concerned that TPM would be used by the big corps to lock in the sofware more efficiently than any dongle, and create a DRM hell. But it didn't, because the vast majority of users aren't interested in paying extra for such a feature. But those who are haven't changed the playing field.

    2. Re:This won't last. by maxwell+demon · · Score: 1

      As soon as TPM is a government-mandated requirement on every computer, using TPM as a "superdongle" doesn't cause any additional direct cost for the customer of programs doing so.

      --
      The Tao of math: The numbers you can count are not the real numbers.
    3. Re:This won't last. by greenbird · · Score: 2

      The first time around, privacy advocates were concerned that TPM would be used by the big corps to lock in the sofware more efficiently than any dongle, and create a DRM hell. But it didn't, because the vast majority of users aren't interested in paying extra for such a feature. But those who are haven't changed the playing field.

      You, my friend, are either blindly naive or an idiot. The article blatantly and clearly states that primary purpose of this is to create DRM hell. The only reason it hasn't so far is that any products that use this are FAR less useful than products that don't use it and thus worth much less to the market. A nice government mandate will eliminate any ability of the market to make choices about such things. This has NOTHING to do with security. It has everything to do with control and the governments and established elite are finding that they are losing it. Wake up. Please.

      From the fine article:

      Owen Pengelly, deputy director of policy at the Office for Cyber Security..."Building the most resilient cyber defences in the world will not help if you are suffering from intellectual property theft,"

      --
      Who is John Galt?
    4. Re:This won't last. by westlake · · Score: 1

      We will create and use our own internet and if you have one of those chips on your computer, we'll disable your access to it.

      And no one will give a damn.

      The geek tends to spiral into ever-narrowing circles of influence.

      Windows 7 Sins. The Other OS on the PS3. The "Walled Garden" of the iOS. Dead-end protests every one of them

    5. Re:This won't last. by Anonymous Coward · · Score: 0

      F U

  3. Sad to see another country cutting its own throat by Crashmarik · · Score: 2

    The U.S. has been doing it to itself with an insane tax code, and product liability laws from the netherworld. Europe is going down the road of not trusting its people.

  4. Security? by colinrichardday · · Score: 1

    Will handing Microsoft that kind of power make the internet more secure?

    1. Re:Security? by arth1 · · Score: 1

      Will handing Microsoft that kind of power make the internet more secure?

      The first time industry handed them TPM, they provided BItlocker. So the answer is probably "yes".
      Even if you rightly hate Microsoft for other reasons, this doesn't seem to be one.

    2. Re:Security? by Anonymous Coward · · Score: 0

      Sure - isn't Windows 7 the most secure Windows ever?

      Like Windows Vista was...and Windows XP...and Windows 2000...

    3. Re:Security? by colinrichardday · · Score: 2

      Except that BitLocker, like other such programs, is susceptible to a cold-boot attack. http://en.wikipedia.org/wiki/BitLocker_Drive_Encryption

    4. Re:Security? by arth1 · · Score: 1

      Non sequitur. Your car and house's locks are susceptible to a lot of attacks, likely anything from picking to drilling out the lock, or breaking in through a window. That doesn't stop the locks from being useful.

      The point is that from track record, Microsoft seems to not take advantage of TPM to do DRM lock-in, but instead provide features that arguably can be of value to the end user. Much as I like bashing Microsoft, I won't prematurely bash them over this.

    5. Re:Security? by colinrichardday · · Score: 1

      Point taken. But if people can't install Linux on their PCs, what alternative will they to Windows?

    6. Re:Security? by Anonymous Coward · · Score: 0

      No... first they are using UEFI to do their DRM for them - THEN you tie it to a TPM.

    7. Re:Security? by Tomato42 · · Score: 1

      If you don't use TPM and encrypt everything past the bootloader with a password you need to provide every time you boot you're not susceptible to cold-boot attack. Linux dm-crypt and Truecrypt can do this.

  5. Windows? by Anonymous Coward · · Score: 0

    Sounds to me like someone is using the windows bogeyman to scare slashdot.

    1. Re:Windows? by Alex+Belits · · Score: 0

      Congratulations, you are an idiot.

      There never was any other goal of "Trusted Computing" but to force users to use Windows with DRM-ed media players.

      --
      Contrary to the popular belief, there indeed is no God.
  6. Two words... by Doctor_Jest · · Score: 5, Insightful

    Fuck. Off.

    I will be the final arbiter of what runs on MY computers. Not some nebulous "trusted computing" that is in the back pocket of proprietary software conglomerates. There's no point in it unless the real agenda is to wrest control from users' hands. (The recent "secureboot" crap for Windows 8 is a prime example.) It's my computer. It's my data. It's not yours. It won't ever be yours. And no amount of fearmongering will convince me you have my best interests in mind.

    Kiss my ass. No, really. Not on the left cheek, not on the right cheek, but RIIIIGHT in the MIDDLE.

    --
    It's the Stay-Puft Marshmallow Man.
    1. Re:Two words... by joocemann · · Score: 1

      You have the most appropriate response I've read so far. The notion of this is ridiculous!

      There is not enough *wrong* with our current tech to necessitate this bullshit.

      The best response is outrage, and th UK people should burn this idea to the ground and reprimand those pushing it!

    2. Re:Two words... by BSAtHome · · Score: 0

      I second that emotion.

    3. Re:Two words... by Anonymous Coward · · Score: 0

      "I will be the final arbiter of what runs on MY computers"

      No you won't, because in 15 or 20 years, you won't have any choice unless you want to be completely disconnected from the modern world. You won't be able to buy open systems any more.

      It'll happen step by step: first, just needed to do banking and shopping online, but eventually, even to connect to the internet in the first place. It'll be sold as for our own good, and people will eat it up. Just look at how eager people are to buy iPads and other locked down devices. You seriously think anybody outside of a few nerds gives a shit? They don't, and those few nerds are not enough to change the nature of the market.

      Now, if you could get 75% of everybody to care, sure, it'd matter. But not only don't they care, they don't even *understand*.

      Control over the internet is the ultimate dream of governments everywhere, it's just that the ones outside China have to go about it slowly and make sure it's to protect us. Excuses must be found. But it'll happen, and you won't be able to buy anything else. Want to make your own CPU? Go ahead, but don't expect to go online with it.

      Not this year, not next, maybe not even within a decade. But it WILL happen.

    4. Re:Two words... by Anonymous Coward · · Score: 0

      I will be the final arbiter of what runs on MY computers.

      and they will be the final arbiters to decide wether or not your computer can access thier services, it seems.

      now that I think of it... here in Italy lots of the computers you find in offices (even government's) are still stuck with the old and lame internet explorer 6, and when you develop something you *must* assure compatibility down to that.

      trusted computing and windows 3.1 won't blend well, so maybe retrocompatibility will save us here?

    5. Re:Two words... by Anonymous Coward · · Score: 0

      Want to make your own CPU? Go ahead, but don't expect to go online with it.

      Not this year, not next, maybe not even within a decade. But it WILL happen.

      Why stop at the CPU? If it comes to that, eventually there will be enough sufficiently pissed off and motivated individuals to make their own internet. It might take a long time if the 'old' internet becomes locked down and unusable for such subversive uses, but it too will happen eventually. The only way this could be stopped is if society itself goes into totalitarian lockdown and you can't even freely associate with people face to face. Not saying the above is impossible, but that's a few steps beyond only having absolute control over our toys.

    6. Re:Two words... by Anonymous Coward · · Score: 0

      "motivated individuals to make their own internet"

      Sure, go ahead, but don't expect 99.9% of everybody else to be on it. Don't expect your bank to be on it. Don't expect to do any online shopping on it. Don't expect gaming studios to support it. Don't expect any infrastructure, so you might not even get outside your own house with it. And so on. It will only be a little sandbox for you and a few others in your basement. That's about all.

      And making your own CPU? That's gonna rule out all but one in a few millions of people.

    7. Re:Two words... by kheldan · · Score: 1

      Hear, hear.

      But also this: I don't care WHAT bullshit controls they attempt to put on a motherboard, someone will have a hack to completely defeat it within a week of it's release. Suck it, fascist government assholes!

      --
      Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
    8. Re:Two words... by BlueStrat · · Score: 1

      Why stop at the CPU? If it comes to that, eventually there will be enough sufficiently pissed off and motivated individuals to make their own internet. It might take a long time if the 'old' internet becomes locked down and unusable for such subversive uses, but it too will happen eventually. The only way this could be stopped is if society itself goes into totalitarian lockdown and you can't even freely associate with people face to face. Not saying the above is impossible, but that's a few steps beyond only having absolute control over our toys.

      Governments won't allow a "dark internet" to exist in any significant size, manner, or form. What are you going to use to transfer the data with? Existing internet infrastructure? A key part of the whole "Trusted Computing" plan is to eventually deny the ability to connect *anything* to the existing 'net unless it has TPM running.

      Wireless mesh networks of some kind? The FCC and their equivalents in other countries will quash that right away. The key point of "Trusted Computing" is to deny access to alternatives, and the only way it can be truly effective. Anyone attempting to route around the TP-enslaved network will be labeled by governments as terrorists/kiddy-diddlers/criminals and thrown in prison or killed by a drone strike as a "threat to national security".

      No, once governments have decided that Trusted Computing is what will be, the only way out is to make major changes to those governments. The problem here is that revolutions throughout history have quite (most?) often ended with governments much worse than what they started with, with only a few exceptions.

      Frankly, I'm glad I'm older and may not live to experience what the next 20-30 years will bring. It's not going to be pretty. Keep in mind that through most all of human history, totalitarian and brutal rule has been the norm, and the recent experiments with governments respecting and enshrining individual freedom and the idea that men can rule themselves is quite a recent new phenomenon. One that a large proportion of the world doesn't believe in and is actively working to see that it goes the way of the dinosaurs.

      "Interesting times" indeed.

      Strat

      --
      Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
    9. Re:Two words... by Anonymous Coward · · Score: 0

      "motivated individuals to make their own internet"

      Sure, go ahead, but don't expect 99.9% of everybody else to be on it. Don't expect your bank to be on it. Don't expect to do any online shopping on it. Don't expect gaming studios to support it. Don't expect any infrastructure, so you might not even get outside your own house with it. And so on. It will only be a little sandbox for you and a few others in your basement. That's about all.

      And making your own CPU? That's gonna rule out all but one in a few millions of people.

      I remember when the internet didn't have banks, online shopping or online gaming. Wasn't so bad. I imagine those rebuilding it from scratch might prefer it that way, especially if it they get to implement uncensored, uncontrolled versions of the above. There are admittedly monumental technical challenges to coming up with global, usable infrastructure that is robust against the attempts of authorities to take it down. However, do not underestimate the will and the number of smart minds which even now thinking of countermeasures to the inevitable clampdown of governments and those controlling them (which has been obvious for a long, long time). It is no longer only a few geeks in a basement who worry about such things.

    10. Re:Two words... by Anonymous Coward · · Score: 0

      It sounds like you are indeed predicting the 'society goes into totalitarian lockdown' scenario. If that did come to pass, the side issue of ending up with an absolutely controlled and censored internet (enabled to technologies such as TPM) would no longer be worth worrying about.

    11. Re:Two words... by georgesdev · · Score: 1

      maybe, and only maybe, but saying this in a forum is helping Microsoft and others close future hardware.
      So let's focus on making Microsoft, Apple, etc ... not implement freedom restricting measures.
      We should not rely on hackers to work around limitations that should not be allowed in the first place.
      go to http://www.fsf.org/campaigns/secure-boot-vs-restricted-boot/statement to get your voice heard!

    12. Re:Two words... by Luckyo · · Score: 1

      As arab spring has proved, it's significantly more difficult to enforce totalitarian rule when internet is free. TPM is a key element in locking internet down from the client's side.

    13. Re:Two words... by BlueStrat · · Score: 1

      It sounds like you are indeed predicting the 'society goes into totalitarian lockdown' scenario. If that did come to pass, the side issue of ending up with an absolutely controlled and censored internet (enabled to technologies such as TPM) would no longer be worth worrying about.

      What I am saying is that eliminating the ability of people to freely and anonymously communicate is one of the necessary first steps toward governments enacting a non-free society.

      Once that goal of eliminating the freedom to anonymously communicate is accomplished, the other steps towards a totalitarian society will become like dominoes falling at an ever-increasing rate, with the death of free & anonymous communications as the first domino.

      This is more of a warning and a reminder of the lessons of history, as there may still be time stop this loss of a critical freedom to a modern free society and thus prevent, or at least cripple, the current progression towards totalitarianism and the loss of individual freedom, opportunity, & choice.

      Do men have the ability to rule themselves? *This* is the core question. I and most Americans believe they can, and it is the core premise upon which the Republic was founded.

      Most of the world does not think men can rule themselves, as well as many in America that want to hand over more and more of their freedom and the responsibilities & ownership of the results of their choices that are part of that freedom, to government in exchange for a false sense of security and "free government stuff" these days.

      Strat

      --
      Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
    14. Re:Two words... by Bob9113 · · Score: 1

      There's no point in it unless the real agenda is to wrest control from users' hands.

      I agree. From the article:

      "Building the most resilient cyber defences in the world will not help if you are suffering from intellectual property theft," he said. "Trusted computing underpins security and can underpin growth,..."

      The "he" in the above quote is Owen Pengelly, deputy director of policy at the Office for Cyber Security and Information Assurance in the Cabinet Office. They are actually being surprisingly forthright about it this time. "Trusted" means that the MAFIAA can trust your computer to not do what you want it to do.

    15. Re:Two words... by Pence128 · · Score: 1

      What are you going to use to transfer the data with? Existing internet infrastructure?

      As long as there's something you can use to send and receive data, you can tunnel. In the absolute extreme, you can build a physical robot that types packets into twitter messages on a keyboard.

      --
      404: sig not found.
    16. Re:Two words... by shutdown+-p+now · · Score: 1

      It's not necessary to have a "totalitarian lockdown" to have an effective end to anonymity, at least as far as governments are concerned. Well, you could argue that the former would eventually lead to the latter, but even if it does, it'll be a while, and in the meantime there will be that kind of gray area where you still have functioning democratic institutions and whatnot, but no online anonymity.

      Vinge described that pretty well in "Rainbows' End" - a society that is by and large pretty liberal, but where owning hardware that doesn't have TPM-kind functionality, or software that lets you work around it (like Linux) is a crime in and of itself, because it lets you dodge monitoring for law compliance.

    17. Re:Two words... by shutdown+-p+now · · Score: 1

      Do men have the ability to rule themselves? *This* is the core question. I and most Americans believe they can, and it is the core premise upon which the Republic was founded.

      The core premise upon which the USA was founded was that well-off white males could be trusted to elect the right kind of rich white males to rule them. "Rule themselves" is direct democracy, which was pretty much anathema to U.S. founders.

    18. Re:Two words... by BlueStrat · · Score: 1

      What are you going to use to transfer the data with? Existing internet infrastructure?

      As long as there's something you can use to send and receive data, you can tunnel. In the absolute extreme, you can build a physical robot that types packets into twitter messages on a keyboard.

      Controlling what can be used to send and receive data, *AND* what data can be sent and received (T.C. also has the ability to remotely & retroactively add, remove, or edit any data), are the central purposes of "Trusted Computing" and part of what it is designed to do.

      Once your ISP's network routers refuse to connect any computer to the internet that doesn't incorporate "Trusted Computing", that dog won't hunt. It's worrisome that many network routers in use by ISP's right now are already equipped with "Trusted Computing"...they just need a command to switch it on. Your PC likely already has "Trusted Computing" incorporated into the motherboard.

      Strat

      --
      Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
    19. Re:Two words... by Pence128 · · Score: 1

      I would have thought it would be obvious that the computer the robot is typing on is "trusted". Yes, my computer has a TPM. It's disabled by default, can only be initialized from the BIOS and can be cleared and reinitialized at any time.

      --
      404: sig not found.
    20. Re:Two words... by BlueStrat · · Score: 1

      I would have thought it would be obvious that the computer the robot is typing on is "trusted". Yes, my computer has a TPM. It's disabled by default, can only be initialized from the BIOS and can be cleared and reinitialized at any time.

      Why would a robot typing have any effect on what that computer is allowed or not allowed to do with T.C. enabled? If, for example, T.C. receives a blacklist that forbids the use of the word "democracy", it will not be transmitted or received whether the typist is human or robotic.

      I think you may have some basic misconceptions about "Trusted Computing". Try reading this: http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html

      HTH

      Strat

      --
      Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
    21. Re:Two words... by Anonymous Coward · · Score: 0

      I agree 1000000000%. Well said!!

      My name is Nonya F. Biznes
      Email: nonya@nonya.org
      Address: 123 Nostreet
      Notown, FU 77342-090

    22. Re:Two words... by Pence128 · · Score: 1
      --
      404: sig not found.
    23. Re:Two words... by Anonymous Coward · · Score: 0

      I think Pence128 was describing the use of steganography to hide forbidden information in approved channels such as twitter, the robot being necessary due to being impossible to run the encryption software on the TPM'd internet connected machine. A slightly contrived example, but I believe it was just to demonstrate how encryption can enable hiding in plain sight.

    24. Re:Two words... by Anonymous Coward · · Score: 0

      The core premise upon which the USA was founded was that well-off white males could be trusted to elect the right kind of rich white males to rule them. "Rule themselves" is direct democracy, which was pretty much anathema to U.S. founders.

      You're an ideologically-blinded, racist propaganda-sponge that was taught *what* to think, not *how* to think. You're being nothing but a tool for others that don't have your best interests in mind.

      Get a clue. Else, suffer your fate at the hands of those very ideologies and causes for which you rail.

      This is not a personal attack. It's a sincere but honest & no-nonsense warning in hopes you awaken before you seal your own fate. That is, if it's not already too late for you.

    25. Re:Two words... by kheldan · · Score: 1

      With everything that is going on in the world and in this country right now, do you really think that corporations give a damn what you and I want? They'll do whatever makes them the most profit. All I am saying is that they can try it if they like. It'll be damned stupid of them if they do, but when it comes right down to it there will be ways around it, and you can count on that.

      --
      Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
    26. Re:Two words... by master_p · · Score: 1

      Impressive armchair guerrilla speech, my friend.

      What will you do if you cannot participate in any economic activity without a TPM platform?

    27. Re:Two words... by Doctor_Jest · · Score: 1

      I've got enough stuff in my closet (PS2 RPGs etc.) so that if I can't participate in "new" media, I'll be dead before I finish the OLD media.

      Apple's "App Store" and "IOS-ification" of OSX has moved my solely to Linux... it was an easy transition, and now I run debian even... instead of Fedora (just a personal preference...)

      Suffice to say, the only people who will be "crushed" by the participation problem are people who don't know any better.

      --
      It's the Stay-Puft Marshmallow Man.
  7. Re:Sad to see another country cutting its own thro by Dondoet · · Score: 1

    Europe is not a country.

  8. But no trusted government... by Anonymous Coward · · Score: 1

    ....and no one pushing for it.

  9. Re:Sad to see another country cutting its own thro by Crashmarik · · Score: 1

    The union is for all intents and purposes

  10. Re:Sad to see another country cutting its own thro by joocemann · · Score: 1

    And the UK isn't europe!

  11. Funny by Grindalf · · Score: 0

    That's true of just about every computer designed in the US via MW link. The fact of the matter is that there is no sure way to protect users against “Alpha Male Syndrome” etc. when it occurs in government agents. You can't obtain enough employees to see the data of that military psi level. You will wind up with a room full of skitsing employees as soon as they find they super-stud revenge target. So it is technically incorrect to allow this, and always was ...

    --
    The purpose of existence is to make money.
  12. There is an intellectual property-security complex by 0xdeadbeef · · Score: 5, Interesting

    Actually, no, Richard Stallman had it right long before Vernor Vinge.

    DRM has never been about getting paid, it has always been about keeping control. And for all the shit Microsoft got about Palladium, the Apple zealots sure turned a 180 in 2007.

    But the zealots are right about one thing - the iPhone is the future of computing. And that future is a boot stamping on a human face, forever.

  13. Re:Sad to see another country cutting its own thro by Anonymous Coward · · Score: 1

    Since Europe is not a democracy (since the unelected commission holds final authority, overriding everyone else's), it's obvious that it will go down the path of every other oppressive government and lock down much more than just computers. Censorship laws are already in place protecting the feelings of politicians and certain minority groups (the justification being that muslims will kill lots of people if you tell people/publish that muhammad was a child-rapist, so you need to "keep the peace". Why is this censorship ? Because "this is the truth" is not an acceptable defense like in libel laws. If the truth "hurts" inter-ethnic-group relations, it's illegal)

  14. TPM by Ogun · · Score: 2

    Because the certificate authorities have a really proven track record.

    Also, it really helps against buffer overrun exploits which in now way is a common thing...

    The usual bollocks, in other words.

    --
    I found a fast warez site: http://warez.it.kth.se
    1. Re:TPM by ScrewMaster · · Score: 1

      Because the certificate authorities have a really proven track record.

      Also, it really helps against buffer overrun exploits which in now way is a common thing...

      The usual bollocks, in other words.

      Yes, and in fact they're probably the ones who will accidentally subvert the whole thing on a Biblical scale some day, with some drain-bamaged "revenue enhancement" scheme like their ill-fated 404 redirects.

      --
      The higher the technology, the sharper that two-edged sword.
    2. Re:TPM by blueg3 · · Score: 1

      Why would a trusted computing architecture use "has a code signing cert issued by a CA" as a rule? They're cheap and they only provide accountability, not security. That rule isn't even sufficient for Windows drivers -- you need a cert issued by one of the CAs that's been counter-signed by Microsoft.

  15. Re:There is an intellectual property-security comp by spottedkangaroo · · Score: 2

    I agree on all counts except for one thing ... If you click through to the article (Vinge had it right), she's talking about his idea that it rises slowly without any disaster to get people to go for it. Surely Vinge built on ideas from others, everyone does. But they're specifically talking about how accepting we all are (will be?) toward it. In his Rainbows End, a character specifically says that we traded freedom for safety, implying that it was a willing transition.

    --
    Imagine if you weren't allowed to use roads because a bus company complained about your driving 3 times. --skunkpussy
  16. How can anybody object? by Anonymous Coward · · Score: 0

    Government exists to make us all safe and secure and there's nothing that government can't do better than individual people. /sarcasm

  17. It al depends who holds the key by Teun · · Score: 1
    It all depends who holds the key, the owner/user or some bureaucratic institution.

    I would welcome a system with a strong wall against the installation of malicious software but ultimately the owner of the device should be in control.

    And just as much I realise the vast majority of (Windows/ OSX) computer users find it out of their league to decide what is safe or unsafe software, a devilish dilemma!

    Yet no more devilish than handing this over to the aforementioned bureaucrats.

    --
    "The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
    1. Re:It al depends who holds the key by ScrewMaster · · Score: 1

      And just as much I realise the vast majority of (Windows/ OSX) computer users find it out of their league to decide what is safe or unsafe software, a devilish dilemma!

      Not really. There's no particular reason that an operating system can't be reasonably safe on the Internet. The only "dilemma" here is whether or not you choose to use the mainstream operating system (Windows) or something else that's more secure. Yes, I know, Microsoft has come a long way with security, but they still have a ways to go, and as long as they're the dominant desktop OS they'll have a bull's eye painted on their backs. If you want security, and don't really need Microsoft compatibility (and in this age of ever more sophisticated Web-based applications, fewer and fewer people do) then skip Windows entirely and stop worrying about being part of a botnet.

      This talk of trusted computer is exactly what everyone here is saying it is: a power grab. And they'll play on Windows users' fears in order to rationalize it, just like they've played on our fears of terrorism to do all the other things they've done to us. Mark my words: government officials will play the T-card (and of, of course, the CP-card) when it comes to promoting "trusted computing". Ought to call it "busted computing" since it fundamentally breaks the concept of a "personal computer."

      --
      The higher the technology, the sharper that two-edged sword.
  18. RTFA by Anonymous Coward · · Score: 5, Informative

    The article quite clearly states that the government wants *its own* computers to have TPM installed, it doesn't mention anything about home users.

    1. Re:RTFA by ScrewMaster · · Score: 1

      The article quite clearly states that the government wants *its own* computers to have TPM installed, it doesn't mention anything about home users.

      Not yet.

      --
      The higher the technology, the sharper that two-edged sword.
    2. Re:RTFA by Anonymous Coward · · Score: 0

      The next step would be to insist on TPM in all new IT contracts. This condition would exclude IBM, Oracle(sun) and just about every Linux vendor from bidding.

      Thay my friends, is exactly what Microsoft wants. They will be the only company to be able to comply with the security conditions OOTB.

      Pah

    3. Re:RTFA by The+Askylist · · Score: 1

      Shhhh! You'll upset the children who want to believe that everything regarding TPM is bad! Having said that, the track record of the UK government when it comes to IT projects is lamentable - maybe a standardised framework with TPM as an element would be useful to constrain both the idiocy of the civil servants and the incompetence of the consultants. I remember one network / desktop upgrade project a few years ago where the mechanics of the final desktop replacement weren't considered until the deployment was a week away - and that's not atypical.

    4. Re:RTFA by Anonymous Coward · · Score: 1

      Sorry, where did you get the idea that this only applied to UK government hardware? I saw nothing specific on that point in the article, and the article closes with this:

      "Pengelly added that he is now working with a cyber security team in the Department of Business, Innovation and Skills to work out what incentives the government could provide to encourage the take-up of the relevant standards."

      If it's an arm of the government trying to change only government hardware, why do they need to work out "incentives" to encourage trusted computing standards? Can't they just change their own hardware purchasing policy?

    5. Re:RTFA by Tomato42 · · Score: 1

      As if this wasn't a idiotic requirement in itself. Computers are insecure because the software that's running on them is shit (and users are morons, but that's unfixable by Trusted Computing), not because it has been modified by a 3rd party!

    6. Re:RTFA by dkf · · Score: 1

      The article quite clearly states that the government wants *its own* computers to have TPM installed, it doesn't mention anything about home users.

      Not yet.

      But the government most certainly is allowed to secure the systems that it owns and uses. It's even good practice! Same for anyone else, of course. The problem comes at the point when one person tries to take control away from another, and that's without regard for whether the oppressor is government, corporate, or anything/one else. The only true distinguishing feature of a government in this regard is its size; evil is as evil does.

      In any case, I propose to worry about other things first. Like the economy...

      --
      "Little does he know, but there is no 'I' in 'Idiot'!"
    7. Re:RTFA by Bob9113 · · Score: 1

      The article quite clearly states that the government wants *its own* computers to have TPM installed, it doesn't mention anything about home users.

      I'm not sure which article you read. The original post links to the one at this address: http://www.guardian.co.uk/government-computing-network/2011/oct/21/cyber-security-strategy-trusted-computing

      That one says nothing about putting it on government computers, and has these points implying that they are talking about privately owned computers.

      These are making the public safe online and ensuring the country is one of the best in the world for online business;

      "Building the most resilient cyber defences in the world will not help if you are suffering from intellectual property theft," he said. "Trusted computing underpins security and can underpin growth,..."

      Pengelly added that he is now working with a cyber security team in the Department of Business, Innovation and Skills to work out what incentives the government could provide to encourage the take-up of the relevant standards.

  19. Re:Sad to see another country cutting its own thro by Anonymous Coward · · Score: 1

    Each constituent country can and does flout European Commission directives. New legislation requires ratification in each country, and almost every 'agreement' and policy has exception states and nations which have implemented the policy so badly it fails to meet the required legislation.

    Well shit I've fed the troll.

  20. Re:Sad to see another country cutting its own thro by NeutronCowboy · · Score: 2

    The European Union is specifically not a country, not for any intents or any purposes. What the EU has is a common foreign policy and a system of rules that minimizes the impact of national borders on commerce.That's it. And the common foreign policy is on top of the foreign policy of each member state, not a replacement for it. The EU is much more a loosely federated club with very lax rules and even laxer enforcement.

    Wanna know what a weak federal government looks like? Look at the EU.

    --
    Those who can, do. Those who can't, sue.
  21. Not for you by EdZ · · Score: 4, Informative

    This sounds less like requiring a TPM for access to, say, the jobcentreplus website (i.e. requiring TPM for the general public) and more an attempt to stem the tide of embarrassing governmental data breaches, i.e. requiring new government and MOD hardware to be a bit less rubbish in terms of data security. Requiring new hardware to access government services for eh general public won't happen, simply because there'd need to be a way to grandfather in all the non-protected devices in public libraries, distributed through government programs, etc.

  22. Re:Sad to see another country cutting its own thro by cyber-vandal · · Score: 1

    Unless you read the UK tabloids in which case the EU is akin to the USSR and has its evil tentacles interfering in all aspects of our lives.

  23. Appropriate Orwell quote by jools33 · · Score: 1

    "Nothing was your own except the few cubic centimetres inside your skull"
    George Orwell 1984.

    1. Re:Appropriate Orwell quote by E.I.A · · Score: 1

      Sorry, not anymore; even that last few centimeters is waning: http://yro.slashdot.org/story/11/10/07/151258/dhs-goes-ahead-with-pre-crime-detection-project - FAST

      --
      Laws are like sausages. It's better not to see them being made. - Otto von Bismarck
    2. Re:Appropriate Orwell quote by Anonymous Coward · · Score: 0

      This is exactly why DRM is 100% unacceptable. If we get computer brain implants, we do not want it there.

  24. Re:Sad to see another country cutting its own thro by ohnocitizen · · Score: 1

    Offtopic. The US tax code and product liability laws are completely unrelated to this story. You might make an interesting argument that governments world wide are moving further and further away from trusting their citizens, and this is yet another salvo in that battle. A relevant example from the US would be the Senators who are making noises about removing the ability to directly elect Congress.

  25. What services are these? by PPH · · Score: 1

    Governments will demand the right credentials to access their services

    When I want something from the government, I'll might be obliged to use their approved interface. But when the government wants something from me, they'll have to use mine. Paying my taxes, for example. If Windows crashing becomes a plausible excuse for not filing a return, the gov't is going to have a serious revenue problem on its hands.

    Realistically, the revenue department will always have to allow paper returns for this reason. And the staff required to process them. The only way to minimize this requirement (but never totally eliminate it) is to reduce the barriers to using their on-line interface. Not raise them.

    --
    Have gnu, will travel.
    1. Re:What services are these? by vadim_t · · Score: 1

      Paying my taxes, for example. If Windows crashing becomes a plausible excuse for not filing a return, the gov't is going to have a serious revenue problem on its hands.

      Yeah, right. What they'll do is to send you a certified letter saying you have a week to pay your taxes, or else. You might be able to convince them a bit longer, but the excuse won't work indefinitely. If you don't pay, they'll just give you a big fine, in addition to forcefully collecting the owed tax from your bank account.

    2. Re:What services are these? by Rich0 · · Score: 1

      Uh, more like they'll send you a certified letter saying that you're already past-due, and please file and don't forget to add the following fine to your payment.

      The next step will be a police officer knocking on your door.

      I doubt a tax agency is going to resort to polite reminders.

    3. Re:What services are these? by nurb432 · · Score: 1

      Paying my taxes, for example. If Windows crashing becomes a plausible excuse for not filing a return, the gov't is going to have a serious revenue problem on its hands.

      Good luck with that, let me know how it works out for you. They will just take it from your paycheck and destroy your credit rating. Your PC being incompatible or crashing isn't their problem.

      --
      ---- Booth was a patriot ----
    4. Re:What services are these? by Anonymous Coward · · Score: 0

      They'll get their returns. They'll be on paper and they'll need adequate staff to process all of them.

  26. "government's leading IT security officials" by newcastlejon · · Score: 1

    I.E. No-one who could actually present a bill before parliament.

    This has come up before and it'll come up again, but it's not gonna happen. If this was anything more than an unnamed bureaucrat saying "this would be handy" then it might pique my interest but otherwise it's no different from an MI5 spook saying that tracking everyone's browsing would be useful to the security services.

    By that I mean yes, it would be useful, but even if it was technically possible parliament wouldn't consent to such nakedly draconian measures. They may seem a bunch of fatuous blowhards but they're not total idiots and they do have some moral standards.

    --
    If God forks the Universe every time you roll a die, he'd better have a damned good memory.
    1. Re:"government's leading IT security officials" by Anonymous Coward · · Score: 0

      They may seem a bunch of fatuous blowhards but they're not total idiots and they do have some moral standards.

      I lost faith in their 'moral standards' when I heard the Mandybill aka the 'Digital Economy Act' became law.

  27. Friends of friends by biodata · · Score: 1

    I wonder if Owen Pengelly has friends with financial interest in 'trusted computing' firms. Someone must be feeding him this line I guess.

    --
    Korma: Good
  28. All a matter of $ by Mathinker · · Score: 1

    The problem isn't having a TPM module in your computer, it's having one without knowing its secret keys.

    Even if every computer would have such a module, because one needs such a module to run Windows, for example, that doesn't mean that the computer vendor wouldn't be willing to give you the keys to the module for some extra profit. Especially if, for example, your computer is manufactured in a somewhat less "Western" country than the UK, say, China? Last time I checked, at least a few computers were manufactured there, no? (nod, nod, wink, wink)

    Or possibly, for example, some of the Chinese companies who design/manufacture these TPMs might be less interested in investing (or rather, in their eyes, wasting) money to design them to be invincible against side channel attacks (like power consumption attacks)?

    Even if the computer does have a TPM, there's no way to check from your trusted OS that the TPM hardware is properly designed to be resistant to attack.

  29. Re:There is an intellectual property-security comp by ScrewMaster · · Score: 1

    I agree on all counts except for one thing ... If you click through to the article (Vinge had it right), she's talking about his idea that it rises slowly without any disaster to get people to go for it. Surely Vinge built on ideas from others, everyone does. But they're specifically talking about how accepting we all are (will be?) toward it. In his Rainbows End, a character specifically says that we traded freedom for safety, implying that it was a willing transition.

    I'm reminded of the main title sequence for that Babylon 5 spinoff "Excalibur", where the Technomage Galen intones, "Whom do you trust? Whom do you serve?"

    RIght now, I trust my computer systems because I know they serve me, and only me. If that changes, computing will be a very different place, although the bulk of humanity may never realize it.

    --
    The higher the technology, the sharper that two-edged sword.
  30. 10 years from now by Anonymous Coward · · Score: 0

    "One of the government's leading IT security officials has said trusted thinking will play a significant role within the forthcoming security strategy.

    The technology, is installed on a chip in people's brains and uses cryptography to authenticate actions and verify that only authorised thoughts run on it.

    Speaking at a seminar on the subject he said the security strategy, expected to be published in mid-November, will revolve around four key objectives. These are making the public safe and ensuring the country is one of the best in the world for businesses; making the country more resilient in the face of terrorist attack and better able to protect its government's interests;

    "Building the most effective police in the world will not help if you are suffering from intellectual property theft, like people telling others about a movie they have seen" he said. "Trusted thinking underpins security and can underpin growth, providing confidence in transactions, expanding markets and making them function more efficiently for corporations."

    Pengelly added that he is now working with a security team in the Department of Business to work out what enforcement methods the government could provide to encourage the take-up of the relevant standards.

  31. Re:So much British by digitig · · Score: 2

    The UK does not produce anything except some biscuits and cereals (biscuits = cookies).

    They are way down on the list of things we make; our pharmaceutical, engineering, chemical and booze industries are much bigger. Here's a moderately recent list of UK exports.

    --
    Quidnam Latine loqui modo coepi?
  32. Re:So much British by ScrewMaster · · Score: 1

    We have a saying "Count your fingers after you have shaken hands with a Britisher".

    Janis Ian once said something similar: "I always check my wallet when leaving a record company executive's office" or words to that effect.

    --
    The higher the technology, the sharper that two-edged sword.
  33. Re:Sad to see another country cutting its own thro by Anonymous Coward · · Score: 0

    Let's just assume that the EU is a superset of standard government models. It supersedes the levels below it, although has the anti-democratic bend that you call lack of a vote.

    Regardless, UK, EU, or W/E, it's going to have a potentially devastating impact on freedom of information and self-determination in my opinion - should it be allowed to go ahead. I'm not saying this as simply a geek either. I know people who honestly *prefer* a linux-based system for more than just it's freedom. They consider it *better* than Windows.

    Honest disclosure: I am a dedicated linux user.

  34. It's easy to improve security this way by Hentes · · Score: 1

    It's easy to imporve security by taking away most of the functionality, but in most cases it isn't worth it.

  35. Re:Sad to see another country cutting its own thro by Teun · · Score: 1

    Since Europe is not a democracy (since the unelected commission holds final authority, overriding everyone else's)

    You read too many British tabloids.

    The EU Commission answers to the governments that appointed the members.

    As a matter of fact, many European countries have a government that is not directly elected but governs in the name of the elected parliament.
    To make it clear to a UK audience, the members of such a government are appointed by the elected parliament, they are not members of the parliament.

    It is an unholy alliance of the French and Brits that veto's any attempts to give such powers to the democratically elected EU parliament.

    --
    "The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
  36. Re:Sad to see another country cutting its own thro by zippthorne · · Score: 1

    Capriciously enforcing unjust laws does NOT justify keeping around the mechanism by which bad laws are produced....

    --
    Can you be Even More Awesome?!
  37. 000000 xxxxxxxxx - 00x the movie by cosmas_c · · Score: 0

    hold your fire - 00x the "new" james bond come will !
      - at least queen Elizabeth so said !
    - Queen the king is tired :-) ...

  38. Okay UK government, you first! by erroneus · · Score: 1

    Before they start pushing out essentially untested technologies onto the public, shouldn't they test it on themselves first? If it does indeed offer "something better" let them test it on themselves and their own infrastructure first. Check to see that everything runs as it should and if not, what adjustments are needed to make it work. And most importantly, identify how it can be done fairly and without excluding various parties from participating in the marketplace.

    If it can't be done without fairness and equality in the market, then it shouldn't be done.

    I'm all for limiting the damage that infected Windows machines can do, but I get the feeling they aren't considering much beyond MS Windows. The wikipedia on the subject discusses some of the problems that would likely come from the use of TC. I won't go into those details but will recommend at least skimming over the page to see it. (Is a link really necessary? I guess so...) Will there be a list of requirements of how NOT to implement TC to ensure a fair and level marketplace?

    Before anyone says so, I know they aren't particularly interested in fairness or equality because they don't really know what it means.

  39. more big brother by Anonymous Coward · · Score: 0

    Great video about how we can break away from these "controls".

    http://www.youtube.com/watch?v=x1I3uiqeG-g

  40. Job Creation by sgt+scrub · · Score: 1

    This sounds like it will start an industry. Companies building devices capable of having ID codes changed, much like a MAC address, will find themselves a large customer base.

    --
    Having to work for a living is the root of all evil.
  41. Not a big deal by Anonymous Coward · · Score: 0

    As usual, the slashdot crowd gets it wrong.

    How is it an invasion of privacy if the government is using a secure identification system to validate who is connecting to government services? You wouldn't want some scam artist stealing your taxpayer dollars, so instead of authenticating with a username+password, the government can more securely identify you with username+pin+TPM/Smart Card and more readily provide you with the expected service (DMV, Social Security, Welfare, etc.).

    The government, if it is smart, does not need to mandate an entire software stack. It is much harder to exploit a box than it is to steal a password, so the use of secure hardware to authenticate would be a good step forward.

    1. Re:Not a big deal by colinrichardday · · Score: 1

      Can you access these services from a public terminal? If you can't, it might be inconvenient. If you can, then how does TPM protect you?

  42. Uh.. by Anonymous Coward · · Score: 0

    The article looks like it is talking about government computer systems. This sounds like something perfect for government (or even business) computer systems which need to be heavily locked down to prevent theft of sensitive data. Hardliners like rms may call this an attack on peoples rights but quite honestly if I found that someone had been doing a lot of the things that he calls freedom on our work systems they would be fired immediately.

  43. "Security advantages" hahahahaahah by unity100 · · Score: 3, Insightful

    A chip that allows utter control of a computer remotely, and security advantages ?

    underground crime networks wouldnt blink an eye and would not waste even a '0-day' before they hack them to their advantage.

    Politicians are stupid from an i.t. perspective. They shouldnt be allowed to talk on anything i.t.

    1. Re:"Security advantages" hahahahaahah by Pence128 · · Score: 1

      TPM doesn't allow remote control.

      --
      404: sig not found.
    2. Re:"Security advantages" hahahahaahah by unity100 · · Score: 1

      and instead identification, right .... well, that cant be exploited badly .... not. that would allow for spectacular forms of ddos, or intrusions.

    3. Re:"Security advantages" hahahahaahah by Pence128 · · Score: 1

      TPM enables you to prove your identity. It can't force anything.

      --
      404: sig not found.
    4. Re:"Security advantages" hahahahaahah by unity100 · · Score: 1

      cant ? what if someone enters a list of those identities into a no-allow list somewhere, or, enters 1 million identities into an allow list of a secure computer network ?

    5. Re:"Security advantages" hahahahaahah by Pence128 · · Score: 1

      Ok, this is how it works:

      (Eve represents some random website)
      Eve: Tell me who you are.
      Alice: Go fuck yourself.

      (Bob represents Alice's company's VPN)
      Bob: Tell me who you are.
      Alice: I'm Alice.
      Bob: Prove it.
      Alice: Hey, TPM: Who am I?
      Alice's TPM: Yeah, she's Alice.
      Bob: Cool beans.

      --
      404: sig not found.
    6. Re:"Security advantages" hahahahaahah by unity100 · · Score: 1

      yes. and what if i load the hashes or whatever to 1,000,000 computers to an authorization system in some sensitive government network, and then post a link to internet ?

    7. Re:"Security advantages" hahahahaahah by Pence128 · · Score: 1

      ...hashes or whatever...

      Whatever indeed. I have no idea what you're trying to say.

      --
      404: sig not found.
    8. Re:"Security advantages" hahahahaahah by unity100 · · Score: 1

      i dont think you are a security researcher, or would do anything in that field of note. your mind is not suitable for it.

      inevitably the information format contained in these chips will be cracked. it will probably not need to be cracked at all, but someone will leak it. and, it will be possible for anyone intending to do anything with them to manufacture identities, or, just acquire the already out identities and do whatever they want with them. hack and upload them to the authorization servers of any sensitive service, and you have hundreds of thousands of computers out there, which may just walk in to your network. go erase the authorization server database, and you have a concrete wall ddos. and i even can assure you if something like this out, the websites will use these instead of login/passwords, because it would be much easier to use for the masses. or, at least, reduce their security measures (which annoy a lot of users btw) because of it. there is infinite mischief possible.

      and im not even mentioning whatever indirect means that can be found to exploit these. from tracking and privacy violations by any party to anything you can imagine.

    9. Re:"Security advantages" hahahahaahah by Pence128 · · Score: 1

      You have no idea how this works do you? The "information format" doesn't need to be cracked. It's public knowledge. Each chip has an Endorsement Key. It is unique and random. It is also known by a sort of certificate authority. You can't "create" an identity without attacking the CA. EKs never leave the TPM, so the only way you can get an "already out" identity is to steal the TPM, decapsulate it and probe it. This is an extremely expensive endeavour for just one key. If you've hacked the authorization servers of a sensitive service, you already have the gold. That's like saying "if you have root, you can install a rootkit and get root."

      For privacy, Direct Anonymous Attestation is now used. When the TPM is initialized, it generates an Attestation Identity Key. A DAA issuer, which has a list of all issued EKs, verifies that you have an EK and therefore a valid TPM. It then gives you a credential. With the credential and a Zero Knowledge Proof, you can prove you have a valid EK to a DAA verifier without revealing the EK. The DAA verifier then signs your AIK. The DAA issuer knows your EK and the DAA verifier knows your AIK, but neither know who you are, so they can't match them together.

      --
      404: sig not found.
    10. Re:"Security advantages" hahahahaahah by letsief · · Score: 1

      I'd mod you up, but I've already posted on this article. unity100 clearly doesn't know how TPMs work. Actually, lots and lots of people commenting on this article don't understand TPMs. They think they do much, much more than they actually can. Basically, they can store hashes of things like the BIOS code or configuration data that are executed on boot, and they can perform digital signature operations (usually as either part of an authentication protocol or to sign hashes of BIOS code, etc.). The TPM can't enforce anything itself, because it never has control on the main CPU. The BIOS would have to do that. Things like UEFI Secure Boot are actually a lot closer to what people are afraid of than TPMs.

      In any event, unity100's complaints are invalid. As you said, the digital credentials on TPMs are unique, so "cracking" a TPM will just get you the credential off that TPM. That's not very exciting. There are no system-wide shared secrets on TPMs, unless you decide to put one on it for your organization (which would be a bad idea). There is a sort of certificate authority which has a secret signing key, but even getting a hold of that doesn't necessarily lead to dire situations. An attacker with a forged identity using a stolen CA signing key would still have to get that forged credential into a company's authentication system, at least in typical TPM deployments. And, whoever can modify the digital credentials in the authentication system has a huge amount of power- but that's always the case.

      One correction though- no one uses DAA. It's technically supported in the TPM specification, but I've had a really hard time figuring out which, if any, TPMs actually have DAA implemented on the chip. Seriously, to the best of my knowledge, no one is using DAA, and I don't think that's an exaggeration.

  44. wow by unity100 · · Score: 1

    youre so naive.

    1. Re:wow by unity100 · · Score: 1

      no. im tired of explaining stuff.

  45. Do not panic by Zoxed · · Score: 2

    No need to panic: this is a suggestion from an UK civil servant. Even if it did became policy one day the work would be farmed out to a least-cost supplier, the project would be 5 years overdue and 6 times over budget. If it ever made it into anyone's home it would be cracked by 12 year old in her lunch break :-)

  46. Re:Sad to see another country cutting its own thro by Anonymous Coward · · Score: 0

    the common foreign policy is on top of the foreign policy of each member state, not a replacement for it.

    While nice in theory, this is not true. Member states cannot override European policy, because any dispute will eventually be brought before the European court of justice, which overrides the national courts. The European policy sets a minimum. Members can go above and beyond European rule, but they cannot ignore it.

  47. Thank you, Governments, you corporate sled bitches by Predatory+QQmber · · Score: 2

    That is indeed one of the reasons why this will not work: there are people using all kinds of different OSes, including all the mobile ones, desktop OSes and whatnot. If the UK government were to only allow devices with the trusted computing built-in both the hardware and software they'd be instantaneously removing access for everyone who is used to using mobile devices to access those services.

    Another case of government not understanding technology, yet still pushing everyone to adopt it.

    oh, i think it understands that part alright. if you have TPM and signing keys to it you can run whatever you like. this is pretty cool feature for servers and workspace hardware. if you have the keys, that's it.

    BUT the whole point here is not about technology so much as about taking away people's access to the hardware they supposedly own (which, coincidently, would also nicely decrease number of "kinds of different OSes" people use and even number of their versions). and there are a looot of organizations besides the government that would benefit from such unethical and dirty move. and all of them don't give a damn about how people do and/or want use their hardware. it's about lockdown, it's about using your tech in a way someone else devised for you.

    and that "mobile devices" industry you speak of has been like that for years, maybe decades.
    ever heard about signed or even encrypted altogether OS kernels; bootloaders that check those signatures and deny boot; boards that modified in a slight, insufficient way to benefit its performance, but sufficient enough to make unfeasible hassle of bringing up its support in another OS without insider knowledge ? you should have, HTC recently made quite a news with graciously giving away keys to some of its customers. a rarity.
    all while Nokia's N900 allows you to run Maemo, MeeGo, Android, pure GNU/Linux (which means that pretty much any distribution is not a problem to get running) and this list is short only because:
    1) some core software components are still closed and spec-data is not available
    2) proprietary OSes vendors have no interest in allowing anyone to run their OSes without their explicit permission since its purchase by end-users is not in theirs business plans, only shoving down users throats by the middle-men is.
    it's short but for others it's nonexistent, an even bigger rarity in contrast to the majority where you, a customer, just fucked without an option (and no, being a forced luddite by not buying any tech is not a real option).
    a Portable PC, not just "phone" or "tablet", but even Nokia don't want you to have it and deliberately shutting down N-projects and providing shitty marketing and lousy distribution for N900, N9 and refuses to sell N950 altogether.

    it's just one small step for this shit coming to desktop, general computing, world. this kind of step.
    of course it can be easily mitigated by legislating a law obligating PC vendors giving away keys together with hardware. but who would want that ? not many enough people.

    so, "not understanding" that people "using all kinds of different OSes" is not the case here. they just don't give a fuck about people's needs. most people don't give much fuck about their needs even and prefer to lie to themselves that they take joy and happiness in unquestionably serving their abusers needs, bathing in willful ignorance until their very death.

    PS: i must say, Slashdot's comment-making page is ugly, awkward, unproductive, slow, as if it were WYSIWYG while actually being embarrassingly featureless, mess.
    like it were made to mostly write small, substance-less, inflammatory comments or nothing at all. or maybe i'm missing something.

    --
    who dares wins
  48. Re:Sad to see another country cutting its own thro by cyber-vandal · · Score: 1

    Yeh the EU so doesn't have any elections. Apart from the ones it does have every five years. You Europhobes need to come up with a new song.

  49. He was just preaching to the choir by arglebargle_xiv · · Score: 2

    Speaking at a seminar on the subject organised by Wave Systems,

    Wave Systems' entire business model is built around DRM-enforcement hardware, a business model they've been failing with for at least a decade (they also have backing with lots of venture capital from companies hoping it'll eventually pay off big, so they can afford to to continue to fail for years to come). Since he was speaking at an event they sponsored then of course he's going to endorse "trusted" computing. It was just a sound bite to keep the sponsors happy and make sure they covered his speaking fees and lunch bill, nothing more.

    1. Re:He was just preaching to the choir by letsief · · Score: 1

      What? I don't know of a single product that Wave sells that is DRM-related, at least using the copyright protection definition of the term. Most of Wave's products are related to managing full disk encryption systems, like Bitlocker or self-encrypting drives.

    2. Re:He was just preaching to the choir by arglebargle_xiv · · Score: 1

      What? I don't know of a single product that Wave sells that is DRM-related

      As I said, they haven't been very successful at it, but they've been trying really, really hard for more than a decade. Read their technical docs and business plans for the last ten years or so...

    3. Re:He was just preaching to the choir by letsief · · Score: 1

      I don't work in the DRM space, but I do work in the cryptography and computer security space, and I've had a number of dealings with Wave Systems. They may have been building their company around DRM technologies years ago, but that doesn't seem to be a strong area of interest for them currently.

      Also, this isn't the only place the British government has been pushing trusted computing. The government official may have been speaking to the choir, but I suspect he meant everything he said (although I also suspect the article is pulling the IP theft comment out of context, but I obviously wasn't there).

  50. Re:Sad to see another country cutting its own thro by HiThere · · Score: 1

    There are actually decent arguments that we should go back to having the Senators represent the states. I'm not aware of ANY decent arguments that this kind of thing should be mandated.

    (The primary argument that the Senators should represent the states is that the Senate has gotten in the habit of mandating that the states do something, but not providing any funding to implement the requirement. If you demand that something be done, you ought, at minimum, to be required to pay for it's being done.)

    --

    I think we've pushed this "anyone can grow up to be president" thing too far.
  51. It won't happen, I promise! by MindPrison · · Score: 0

    Because it really can't happen.

    Doing this, would essentially be as effective as blocking & filtering sites are today. Literally every ISP in Sweden (and most of Denmark) already does this, but it never worked for them, it never will. As long as software is SOFTware, it will be circumvented, rest assured.

    All that it does, is scaring the general public, the average Joe, those that have no clue, those that rush forward and purchase the most expensive Anti-Virus protection package they can get, the very same people.

    It's as hilarious as the Password control in Microsoft, Microsoft Denies all flaws, the government associates believes it blindly, so if a kid at school loses his password, and the Admin password is unknown - for every Windows Ever Made - the support people, Microsoft certified and all, master degree in science & engineering and whatever, are completely blind to the real world - every single password was broken in less than 10 minutes, on every system available.

    Same deal. It simply can't be done.

    Trusted computing my pale white butt.

    --
    What this world is coming to - is for you and me to decide.
  52. Re:There is an intellectual property-security comp by GrumpySteen · · Score: 1

    > I'm reminded of the main title sequence for that Babylon 5 spinoff "Excalibur", where the Technomage Galen intones, "Whom do you trust? Whom do you serve?"

    Wow... you mangled the quote and added bad grammar.

    "Who do you serve and who do you trust?"

    Choosing to use who and whom

  53. Re:Sad to see another country cutting its own thro by reasterling · · Score: 1

    EU is much more a loosely federated club

    Here in America the southern states thought that too. I wonder what would happen if a nation that was economical important to the EU were to try to withdraw.

    --
    "For I desired mercy, and not sacrifice" -- God
  54. It's a step towards TV by koan · · Score: 2

    Where you sit drooling and not involved, I mean come on... that was the ideal right? Stupid drooling and desiring to buy and be like those on TV.
    That declined with the Internet, and of course the loss of financial control and distribution of media.

    The powers that be don't like the Internet right wikileaks?

    --
    "If any question why we died, Tell them because our fathers lied."
  55. Too many issues by msobkow · · Score: 3, Insightful

    There are too many issues of lock-in and lock-out associated with so-called "Trusted Computing", in particular the potential to block users from installing their operating system of choice on the hardware they own.

    So far the TPM initiatives deployed by the vendors have failed one after the other. X-Box, PS3, smart phones -- every TPM system I know of to date has failed to provide the protection promised, while restricting freedom of choice by the general public.

    As a result, the only ones who really benefit from TPM are those who want to implement hardware DRM (digital restrictions management.) I'm not willing to give up my software freedoms to support the media companies.

    --
    I do not fail; I succeed at finding out what does not work.
  56. Re:There is an intellectual property-security comp by ScrewMaster · · Score: 1

    > I'm reminded of the main title sequence for that Babylon 5 spinoff "Excalibur", where the Technomage Galen intones, "Whom do you trust? Whom do you serve?"

    Wow... you mangled the quote and added bad grammar.

    "Who do you serve and who do you trust?"

    Choosing to use who and whom

    {sigh} Grammar Nazis.

    I cut & paste it from somebody else that mangled it.

    --
    The higher the technology, the sharper that two-edged sword.
  57. If ( when? ) this takes place. by nurb432 · · Score: 1

    Then its the beginning of the end for most of us, and the computer world as we know it. I hope you like your 'appliances' ( like ipads and various locked down phones, and toasters ) as that is all we will have soon.

    --
    ---- Booth was a patriot ----
  58. Re:There is an intellectual property-security comp by Anonymous Coward · · Score: 0

    The iPhone is dead

    Long live Android

  59. Re:There is an intellectual property-security comp by GrumpySteen · · Score: 1

    Quotes are supposed to be accurate. Half-remembered paraphrased revisions shouldn't be presented as quotes.

  60. I don't trust the Government nor Microsoft by Anonymous Coward · · Score: 0

    So why would I trust anything either of them want to force to be in my computer? I'll just "opt-out" of that and if they want to force the issue, I'm sure there will be ways to disable it...

  61. even bad for security... by flohuels · · Score: 1

    thousands of software engineers, developers and coders would lose their job, because nobody is buying their "untrusted" software. So they get no money, become very poor as they have no other qualification, and then rob a bank or innocent passengers or do other criminal work. But of course the security of my computer is more important =)

  62. Things I don't trust: by Nyder · · Score: 1

    1. The Government.
    2. Corporations.

    So, I'd have to say, No. (for when the US tries to make this same move)

    --
    Be seeing you...
  63. TPM Vunerability? by Pence128 · · Score: 1

    The TPM is passive and can't do any checking on it's own. The first thing that does any verification is the Core Root of Trust Measurement, Which resides in the BIOS Boot Block. The CRTM is supposed to measure (verify) itself and the BIOS proper, then execute the BIOS. If you hack the CRTM, isn't the whole thing hosed? You can report any combination of hardware and software you like.

    --
    404: sig not found.
    1. Re:TPM Vunerability? by letsief · · Score: 1

      Sure, but you have to start somewhere. The first code that runs on the main CPU will pretty much always have to be implicitly trusted. Actually, in theory you could get Intel to sign the CRTM code using a private key corresponding to a public key that is stored on Intel CPUs. But, I suspect you'd need a combination of hardware and software changes to get the CPU to start up in a mode that would only run signed code. And, you'd probably always have a little bit of code somewhere that needs to be implicitly trusted, although you could put it in true ROM.

      You could also use tangential technologies, like Intel TXT, to reliably measure the state of a running system, and then just use the TPM to sign those measurements. It's hard to do that correctly, but it's a very powerful reporting mechanism.

  64. Re:There is an intellectual property-security comp by ScrewMaster · · Score: 1

    Quotes are supposed to be accurate. Half-remembered paraphrased revisions shouldn't be presented as quotes.

    {sigh}

    --
    The higher the technology, the sharper that two-edged sword.
  65. Re:Thank you, Governments, you corporate sled bitc by amiga3D · · Score: 1

    I...love big brother!

  66. Re:Sad to see another country cutting its own thro by Anonymous Coward · · Score: 0

    First you speak of a country. Then you talk of Europe. What is wrong with you?? It's NOT a country bit a continent

  67. Please READ Vinge by johnwerneken · · Score: 2

    http://www.guardian.co.uk/technology/2006/jun/29/guardianweeklytechnologysection5
    Vinge was an OPTIMIST. The "SHE" (secure hardware enviornment) is a dangerous and probable prosal but only one of five scenarios.

  68. Re:There is an intellectual property-security comp by colinrichardday · · Score: 1

    No, it is "whom" in both cases. John trusts him; Joan serves her. Note the case of the pronouns.

  69. Re:There is an intellectual property-security comp by Alsee · · Score: 1

    {sigh} Grammar Nazis.

    I cut & paste it from somebody else that mangled it.

    The Nazi defense. Don't blame me, I blame the guy I was listening to.

    Chuckle.

    -

    --
    - - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
  70. Re:Sad to see another country cutting its own thro by NeutronCowboy · · Score: 1

    The EU would fall apart. Which is why everyone is terrified of pissing off Germany in the current banking crisis.

    --
    Those who can, do. Those who can't, sue.
  71. It can't be!!.. Can it? by justforgetme · · Score: 1

    Have we finally arrived at an unescapable "Quis custodiet ipsos custodes?" moment?

    --
    -- no sig today
  72. £12 Billion wasted on failed NHS IT System by Anonymous Coward · · Score: 0

    Seriously if the government can waste £12 Billion on a failed NHS IT system, what makes them think they can even get this right, Those pricks in Whitehall don't have a clue about IT and 99% of the time; the people who are hired for such work are just interested in cashing in on taxpayers money and creating failures; then requesting more money.

    In theory, if you gave /. $150,000.00 to recruit a team of 20 people being paid $75,000.00 each to design a fully working system, it would be done in less than a year and all the government would have to do is pay for the hardware and infrastructure costs. Job done.

  73. One man's issues are other one's goals by Predatory+QQmber · · Score: 1

    for someone who gives a crap, such as yourself, this maybe look like issues but people who devise such things are not idiots either.

    don't you think that "blocking users from installing their operating system of choice on the hardware they own", "failing to provide the protection promised, while restricting freedom of choice by the general public" and "implementing hardware DRM" were actual goals ?
    well, i do. there is more than enough evidence for that.

    if they wanted to "provide protection" to their customers they would provide access to restricting hardware to them also. unless real TPM customers are not buyers of their tech but media conglomerates and wannabe police states.
    which they are.

    --
    who dares wins
    1. Re:One man's issues are other one's goals by msobkow · · Score: 1

      You misunderstand. Blocking alternate operating systems is a goal of TPM, but they've failed at it time and again. People with the know-how install whatever they want on their hardware despite their best efforts. Ergo, they have not benefitted from it.

      But they have blocked the naive mom & pop user from disabling the DRM, which serves the media companies just fine.

      --
      I do not fail; I succeed at finding out what does not work.
    2. Re:One man's issues are other one's goals by AdamThor · · Score: 1

      You misunderstand. Blocking alternate operating systems is a goal of TPM, but they've failed at it time and again. People with the know-how install whatever they want ... But they have blocked the naive mom & pop user...

      If they've blocked most of the population, I guess I wouldn't say they've failed...

      --
      -- "Oh. This guy again."
    3. Re:One man's issues are other one's goals by Predatory+QQmber · · Score: 1

      But they have blocked the naive mom & pop user from disabling the DRM, which serves the media companies just fine.

      exactly, they have made usage of "alternate operating systems" and disabling the DRM cumbersome enough for only a few hard-bitten tech maniacs to benefit and only in the extremely unhandy way.
      i'm pretty sure that's good enough for those bastards to consider whole ordeal as success, unfortunately.

      i'm no elitist, i want common folk to widely use all kinds of sophisticated tech and i want be able to profit from fiddling with it on their behalf. and for that, a wide variety of hardware and software should be available in all its unlocked glory as selection of tools.
      if someone makes it hard to come by or unfeasible to use then everyone stuck only with the shit that someone shoved down on tech market, locked down to be used only in ways devised by he/her/it even if, technically, you could workaround the problem in some non-efficient way.

      --
      who dares wins
  74. a good citizen here by Predatory+QQmber · · Score: 1

    i'm sure you are, as most people.
    and this is why we are all fucked.

    --
    who dares wins
    1. Re:a good citizen here by HungryHobo · · Score: 1

      He was referencing the books ending.

      "He gazed up at the enormous face. Forty years it had taken him to learn what kind of smile was hidden beneath the dark moustache. O cruel, needless misunderstanding! O stubborn, self-willed exile from the loving breast! Two gin-scented tears trickled down the sides of his nose. But it was all right, everything was all right, the struggle was finished. He had won the victory over himself. He loved Big Brother."

    2. Re:a good citizen here by Predatory+QQmber · · Score: 1

      oh, to my shame i've never read it :(

      but soon we all, probably, will witness something alike and it will be even gloomier. i myself used to watch "news" TV programs as entertainment instead of usual cartoons in school years, then i got back to cartoons after realizing that those weren't parodies, that all this pretty damn creepy and unsettling stuff is how someone wants masses to see the world. and violence and atrocities are nowhere as ugly as omissions, innuendos and hypocrisy.
      no way i'm buying another brainscrewing box in my life. better to watch some cartoons on PC's big monitor with my wife beside.

      --
      who dares wins
  75. Re:£12 Billion wasted on failed NHS IT Syste by sa1lnr · · Score: 1

    "what makes them think they can even get this right"

    Lobbyists.

  76. I used to support TPM by msobkow · · Score: 1

    I used to support TPM. I thought it was a great idea for enhancing system security.

    I changed my mind after seeing how it ended up being abused in practice. The vendors who've implemented it demonstrated that they don't care about security, they care about lock-in and lock-out.

    --
    I do not fail; I succeed at finding out what does not work.
  77. Government vs the people by Anonymous Coward · · Score: 0

    You speak as if government and the people are one and the same. How many acts of oppression will it take before the average individual realizes (or admits) that oppression requires a third party (i.e. one that isn't you)?

  78. misinformed by Anonymous Coward · · Score: 0

    The third paragraph of the article is spot on. The TPM doesn't control your computer. It merely reports measurements of what's been booted, in a secure way. It also governs access to decryption and signing keys. Your system will run just fine - but you may need to boot a "compliant stack" to gain access to certain government resources, banking data, and healthcare sites. PKI is sufficiently complex that this won't pervade every aspect of computing, if the government and industry even adopt the initiatives.and information. It is always your choice of what to boot. It's soon their choice on whether to let you in based on your decision.

  79. Re:£12 Billion wasted on failed NHS IT Syste by Teun · · Score: 1

    Maybe you should check your arithmetic...

    --
    "The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
  80. extreme naivete by unity100 · · Score: 1

    EKs never leave the TPM

    oh yea. just like how many other digital security technologies which were touted to be even more secure than this.

    learn the number one rule of information technology :

    if there is ANYthing in a digital format, it can be replicated/faked/reproduced/madeup/imitated/cracked . it doesnt matter what process/method you employ. whatever you do, is crackable/hackable.

    1. Re:extreme naivete by letsief · · Score: 1

      OK. So suppose you get an EK off a TPM. Then what? I agree you can do that- TPMs aren't designed to thwart advanced invasive hardware attacks. They probably wouldn't even do very well against some side channel attacks.

      But, it's not an attack that scales well. You need to get physical access to one machine, potentially put forth a fair amount of resources attacking that one machine, and then you get one stolen identity out of it.

      If only systems today did that well.

  81. New Technology makes this less worrisome by Gyorg_Lavode · · Score: 1

    To be honest, I think this bothered me before when it came up a few years ago. The idea, locking down code from boot through apps, is a good idea from a security standpoint. But, as pointed out elsewhere in this thread, thats not necessarily how it ends up being used (vendor lockin) and it ends up being compromised anyway (console rooting).

    Still, with the advent of dirt cheap computing, (rasberry pi), a plethora of cell phones, and virtualization, I think there is more than enough opportunity to run the OS and programs of your choice. Computing platforms are simply so readily available, no-one will be able to lock everyting out.

    Does that mean the next windows computer you buy may not be rootable to linux? Maybe. If you wanted linux on it, why'd you buy the non-rootable windows computer anyway? Alternately, why don't you just install vmware and virtualize. (Virtualization is a clear winner over dual booting now adays.)

    Ultimately, it's just another product differentiator to shop for. But there's no way it can restrict your access to capabilities. And that's how it should be. Trade security for flexibility at your discression.

    --
    I do security
    1. Re:New Technology makes this less worrisome by letsief · · Score: 1

      Well, we already know a secure boot process is coming to upcoming systems, because Microsoft is requiring UEFI Secure Boot on Windows 8 logo systems. That was discussed previously on slashdot, and its actually a little bit closer to what people seem to be afraid will happen with TPMs. TPMs can really only measure the boot process (letting anything run, but being able to say later what ran at boot), but UEFI secure boot is intended to lock it down so only signed code runs at boot.

      As a side note, I'd actually say recent experiences with consoles and smart phones show that it is feasible to very tightly lock down the boot process. The Xbox 360 has withstood software-only rooting very well. The PS3 has done OK, although they certainly screwed up with the attack on the private key. Cell phones designed to prevent rooting (e.g., a lot of Motorola phones with signed bootloaders) actually do pretty well against full roots.

      But I find it interesting that you're saying that the availability of new computing platforms makes you less concerned. Besides virtualization (which I realize is your key example), I think new computing platforms will be locked down from the start, or at least lock-able down. Things like iPads, iPhones, and other tablets and phones are the key examples. I think we'll see at least some heavily locked down Windows 8 tablets, but time will tell. Most people don't like worrying about security, and locking down the device is one way to take some of that responsibility away from the user.

      In any case, I really think people would be more supportive of things like TPMs and trusted computing if they really understood what they do. For instance, I know there's a lot of interest in bring-your-device-to-work, that is, using your personal cell phone, tablet or laptop for work. You can't do that today because of security concerns and (probably more significantly) compliance with regulations. Your company only knows certain key protective measures are in place on your work laptop because they are the ones that set it up, and its set up so you can't change it. The paradigm could be very different with trusted computing and TPMs. With that technology, your company could scan your machine for compliance with their regulations, and grant you access to network resources if your system is found compliant. Perhaps many members of the Slashdot community wouldn't like the idea of their employers scanning their machines, but I think a lot of people would happily deal with that if it meant they could use their iPhone or iPad at work.

  82. Mod Parent insightful by Anomalyst · · Score: 1

    Mod Parent insightful

    --
    There is no right to feel safe thru security vaudeville at the expense of everyone's freedom, privacy and tax money.
  83. It is courious by Anonymous Coward · · Score: 0

    It is courious and somewhat telling that the slashdot community mods down any resonable arguments about the tpm, instead promoting the privacy busting possibilities.

  84. Re:Sad to see the BS is believed even on Slashdot by Anonymous Coward · · Score: 0

    Wow. Nice. One of the first posts I saw that reflected an actual understanding of trusted computing, and its modded down to -1. Congratulations, Slashdot, on providing even more proof that you could care less about technology -- at least at the expense of paranoid drama. Is it that hard to read a specification? I guess so.

  85. "one machine" by unity100 · · Score: 1

    even now there are gated networks that are protected by few points of entry, which allow for you to cause much mischief if you break in.

    it seems you still havent perceived what im picturing. you can manufacture/fake identities with the proper algorithm or imitation of identification. and there will be computers somewhere, allowing/barring secure channels through those identification, and if not, at least logging that identification.

    breaking into such a server/gateway would allow much mischief, on either end of the spectrum.

    1. Re:"one machine" by letsief · · Score: 1

      You make it sound like authentication using a digital credential on a TPM is worse than other options. It's almost certainly better than any other option with a comparable cost. Sure, some high-end crypto modules have better protections against invasive or side channel attacks, but you're not going to put several thousand dollar crypto modules in laptops. You're certainly much better off using an RSA key pair stored on a TPM compared to a key pair stored on disk. And even that would be considered very strong compared to the more common authentication mechanisms, like passwords, one-time password devices, and one-time passwords sent via SMS.

      The kind of attack you're imagining would work on any cryptographic authentication scheme. To manufacture fake credentials that someone might actually trust you'd need to get a CA to sign the public key you create. You can't steal the signing key for the CA by just taking something off the TPM, because the CA signing key is not on the TPM.

      And, to make things even harder for an attacker, you probably can't just get any CA to sign your credential. If you want access to NASA's network, you probably need to get a NASA CA to sign the public key. This is because the deployment model for TPMs is very different than that of something like SSL web sites. With typical SSL deployments you'd just need to get one out of a relatively large number of trusted CAs to sign your public key.

    2. Re:"one machine" by unity100 · · Score: 1

      it is worse than other options. because it will exclusively and universally be available without any exceptions. it would be impossible not to use it, due to the widespread availability.

      and that is the main problem. it will create one universally available identifier for all devices, which will inevitably reduce the variety of and the need for any other security mechanism. it will be much cheaper to just use that.

  86. Thank you by Anonymous Coward · · Score: 0

    Congratulations on the contents of your blog, which incidentally is very interesting to read, go on, bravo. Voyance gratuite