Slashdot Mirror
German Government Warns Windows 8 Is an Unacceptable Security Risk
An anonymous reader writes "Die Zeit has access to leaked documents from the German government warning that Windows 8 is an unacceptable security risk for sensitive workloads. The story is written in German here, but automatic translators (such as Google Translate) do a readable job. Particularly of concern is the inability to opt out of TPM 2.0 usage."
TPM is nothing more than a hardware keystore, I'm not sure how they'd see it as a security risk unless they're worried that the NSA has the MS signing key's private key (probable) but even then it doesn't exactly give you worse security than other OS's without access to a hardware keystore.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
It is insecure because you CAN'T use it for your purposes.
It is only there for MS and, by extension, the NSA.
You didn't think that secure boot crap was for YOUR benefit, did you?
If you actually had read the article, you would have seen that this is especially mentioned. Maybe the article is a little more insightful and balanced as you can imagine?
Where the BSI takes issue with their reporting.
Of course, with the extent now clear of the US government's use of US IT companies to maintain American political and economic advantages, if you were running a non-US-based company or a non-US-governmental organization, you'd want to do as much critical business with non-American hardware, software and services as possible.
If you don't trust the security of TPM, or that it doesn't have in-built stuff the NSA can use to spy on you ... then, yes, you have to consider it insecure.
It's a 'secure' system you don't control, which means if you need a secure environment, you need to trust a 3rd party.
If that 3rd party is Microsoft, who we know is beholden to the NSA -- then you betcherass it's considered insecure. Essentially, the German security people are saying "we don't trust Microsoft or the NSA/US government" -- therefore the entire platform is considered not secure.
One of the biggest complaints about TPM is that you have to explicitly trust whoever controls the keys and the like. And if you don't control it, and don't trust the 3rd party, the whole thing is garbage.
So, it makes perfect sense -- because TPM has never been about the users ability to define their own trust, it's about the manufacturer saying "you're going to have to trust us or not use our stuff". So, not using their stuff is the logical conclusion.
Lost at C:>. Found at C.
The license of Unix we use costs about $20,000 for the number of users we have.
Not practical for most people. Thank the people who make it practical. It's you who is wrong, not him.
Windows 8 runs on other platforms too. Go look at the linux tablet market share and compare that to windows 8 tablet share.
I have used linux for that long on the desktop. Works fine.
Marketing matters far more than you think. Bud is a very popular beer, and no one really thinks it is a good beer.
When you're a government, there's a difference between a product whose bugs can be mitigated with sufficient money thrown at security vendors, and a product that by design keeps control in the hands of a company whose government has a known history of spying on you. The TPM in Windows 8 is the latter.
I think the Microsoft Account and related stuff is also quite bad privacy and security risk. Apparently 8.1 will send your searches to Microsoft in a similar way to Unity's "Amazon shopping lens". When enabled, the IE SmartScreen filter will send your browser URLs to MS. All sorts of little things here and there -- "would you like to send information to company X to improve our services". I suppose you can get rid of most of it by carefully unticking each buried checkbox, but it's getting increasingly hard to opt out of this kind of junk. What if I just want to be alerted about Patch Tuesday updates?
Why is it that every smarmy little shit on Slashdot thinks everyone else is an idiot?
Yes, exactly. But in this case "don't run that software" applies to Windows.
It's the OS which is utilizing the TPM, and therefore it's the OS you can't trust. What part of that are you not understanding?
This was the whole point of TFA -- since Windows 8 uses this TPM shit, and you can't turn that off, you inherently can't trust the OS. The software you stop using because you don't trust the TPM isn't your own software, it's the fucking OS.
Lost at C:>. Found at C.
As a German I get regularly headaches when I'm watching Fox News or similar "news". The American news are like game shows, flashing light, CGI effects, running texts everywhere, cut screens, cut clips. It's like news for babies, like the assumed average concentration span is only 5 seconds of the viewers.
http://www.mueller-public.de - My site http://www.anr-institute.com/ - Advanced Natural Research Institute
....was essentially given away to Universities for free.
Actually it was licensed with the source code to Universities. This was still a proprietary license and the Univerities could not re-distribute except under certain conditions. This licensing was what lead to the lawsuit between Unix System Laboratories (USL) and the Univerity of California, Berkeley when the USL attempted to claim all the changes that UCB made to the source belonged to USL. There was a settlement behind closed doors, however as part of the SCO lawsuits I believe the terms of this agreement were made public.
Interesting read on this here.
Beware of he who would deny you access to information, for in his heart he dreams himself your master.
But would require CS majors to know how to work them, and was not available on normal PCs, which were too weak then to run Unix. So anyone who could afford PCs would then need DOS, and then on top of that, things like WordPerfect, Lotus or dBase. So it's indeed the explosion in the usage of Linux that's made this possible.
Linux has also lowered the usability bar. With Unix, one was stuck with Bourne Shell or C Shell, and could only enjoy GUIs like OpenLook or Motif if one was at a company or university that had installed workstations from Sun, DEC, SGI, et al. With Linux, GUIs like KDE had been the default from day 1, and now there's a bonanza of them - GNOME, LXDE/Razor-qt, XFCE, Unity, Cinnamon, et al.
My understanding was TPM became mandatory with Win 8, and in previous versions was optional.
It's the non-optional part that is the problem. Microsoft made it mandatory, and that changed quite a bit.
So, if you deem TPM isn't trustworthy, it makes Win 8 not trustworthy.
Lost at C:>. Found at C.