Comment by walterbell | Hacker News Reader

Comment by walterbell | Hacker News Reader

For those considering a new machine for Windows 11, remember that upcoming Intel and AMD and Qualcomm-Nuvia-Mx CPUs will include the built-in Microsoft Pluton (inspired by XBox) hardware root of trust, which will play a role similar to Apple T2 or Google Titan.

Announcement: https://www.microsoft.com/security/blog/2020/11/17/meet-the-...

> The Pluton design removes the potential for that communication channel to be attacked by building security directly into the CPU. Windows PCs using the Pluton architecture will first emulate a TPM that works with the existing TPM specifications and APIs, which will allow customers to immediately benefit from enhanced security for Windows features that rely on TPMs like BitLocker and System Guard. Windows devices with Pluton will use the Pluton security processor to protect credentials, user identities, encryption keys, and personal data. None of this information can be removed from Pluton even if an attacker has installed malware or has complete physical possession of the PC.

Speculation: https://www.reddit.com/r/Windows11/comments/o5r2qz/speculati...

Background on secure boot: https://cacm.acm.org/magazines/2020/3/243026-securing-the-bo...

> None of this information can be removed from Pluton even if an attacker has installed malware or has complete physical possession of the PC.

Uh and how am I supposed to sell my used pc?

By "removed" they mean "stolen" or "copied"

Sad news, but I don't believe they are worried about that. It's good for their profit that hardware gets more and more commoditized and irreplaceable, just like phones. if it breaks, you buy a new all-in-one device which you can as each year passes customize LESS, and that's it.

I'm actually starting to worry about opensource approaches since the Year of the Linux Desktop (TM) is getting farther and farther.

Today I gave a go at XUbuntu 21.04 without a VM (which is how i have been consuming my linux fix recently) and it was okay, but even basic things like suspend didn't work and simply crashed the X window manager or other non-poweruser-ready shit.

It's getting more and more complicated.. sometimes i wonder if it's NOT and it's just me getting grumpier. But it really seems that consumer devices are getting more bundled and less customizable and tinkerable by the year.

Yeah, they are. The system boards with everything soldered on sometimes make me rage tbh. Is 3mm of thickness worth everything else?

You're supposed to take it to a recycler. Don't worry, they'll responsibly dump it in Africa or Asia for you.

I suppose that it could still be done by "unlocking" the device by logging into MS servers, similar to the Activation lock on Apple devices: Malware can't "remove" the information… but Apple.com can.

I think this is saying that the information can not be extracted and used outside of the processor, not that that the information can't be cleared and the device factory reset.

The biggest concern this presents is if your CPU dies and you want to recover your encrypted disk. All of this is the same situation with T2/M1 Macs or iOS devices today.

MS seems offers a few ways of back the decrypt key. One of them is uploading the bitlocker key to your account if you logged into ms account in that system. Or you could write it down (Which isn't very useful IRL, I haven't see anybody actually write down recover code or whatever to paper yet.)

I assume it would be similar to how you sell an old computer with an encrypted hard drive. You unlock it, format it, and then sell it. If you have the credentials to unlock the PC you should have the ability to remove your encrypted state.

Used PCs reduce new PC sales and are therefore an impediment on market growth. Please take them to the landfill and buy something new, thank you.

Great, we are step by step getting to a place where a government could actually ban software because these machines are no longer under our control.

All for the sake of "consumer safety" when in reality it has to do with control and preventing someone from committing the horrible crime of copying a Netflix show. /s

Great that it can't be removed, but can it be used by the malware on the system to perform the task on behalf of the user? In the days of always connected computers just remotely controlling the SW on the HW itself is enough to do pretty much all the interesting things you could do (as a criminal) if you were in physical possession of the computer itself.

> even if an attacker has installed malware or has complete physical possession of the PC.

The line between "attacker with physical possession" and "owner" keeps getting blurrier.

Reply on news.ycombinator.com