Hacker News Reader

Comment by PragmaticPulp | Hacker News Reader

Until VirtualBox implements TPM 2.0 pass through, which they've already started working on: https://www.virtualbox.org/changeset/90946/vbox

Qemu already supports TPM pass through and secure boot.

View on HN

As a QEMU user, why would I ever allow a Windows VM to talk to a real TPM? The entire point of a VM is to isolate Windows in a predictable and secure manner. Giving it access to a unmanageable coprocessor that has been designed to undermine my own interests completely destroys this goal. Hopefully this restriction will simply be cracked in the popular Windows torrents, or better yet some real TPM keys leak for use with emulators. But more likely by the time any application specifically requires Windows 11 to run, Windows will have faded even further into irrelevance.

I don’t understand the rationale here. You don’t want real tpm exposed to a vm because of security.. but you are okay with running unknown code (cracked software) to do who knows what to your runtime environment? o_O

It's all unknown code - pirated/cracked software just adds to the number of parties.

Backdoors only really became a pressing concern due to ubiquitous Internet access. When I first setup a Windows VM and install whatever application software and updates, its Internet access is through a public VPN only. And it contains no information to tie it back to me.

Before I put any sensitive information on it, I kill its Internet access and never reenable it. So there is no way to exfiltrate data that I care about. Any produced information leaves via a local Samba share.

Leaking fixed identifying information about my hardware, or forming a side channel to a new VM instance would violate this security. I doubt the TPM would store persistent personal application data, but I don't need to be the first one to find out.

I fear that might not be a good thing. Wouldn't it be better and safer to just emulate TPM in the VM?

Errr they want real TPM functionality. Emulation kinda nerfs the whole point of it. It's a hardware key. If you could just emulate it what would stop you spoofing it?

Edit: autocorrect TPM

Well, modules can be designed to protect my security, or to harm my security (e.g. to enforce DRM). I'm unclear on how "real TPM" functionality helps me. If it helps secure Microsoft, and hurts my security, that's a good reason to not use Windows.

I have not found good docs on what TPM exactly does in Windows 11, but people I trust tell me to distrust it, so I do.

It’s used to store BitLocker (Full Disk Encryption) keys so you don’t have to type a password for the system to boot. If you don’t use BitLocker, it’s not used for much else.

One could conclude that they are requiring TPM so they can eventually turn on BitLocker by default.

This is really stupid. So you can use your hard drive only in the first computer.

If VirtualBox takes the pass though approach, will we be able to migrate Windows 11 VMs between computers?

How would they detect the difference?

Probably built-in crypto keys signed by Intel/AMD keys.

That would be unfortunate for Infineon who create the majority of TPM chips. Who’s going to be the gatekeeper who decides who can create TPM chips and what’s going to happen when a new manufacturer wants to enter the stage?

I should have said TPM manufacturers, but it’s the same basic idea. Here’s Infineon’s key: https://www.infineon.com/cms/en/product/promopages/optiga_tp... I guess new manufacturers have to beg people to recognize their root key as legitimate.

Because that would break TPM or mean adding another chain of trust to the OS verifying TPM which also has problems.

It sounds like VMWare agrees with you.

> Unlike VMware, which creates a virtual TPM, VirtualBox's new driver will require a host to have a TPM 2.0 processor for this feature to work.

VMWare's is the right approach. I wouldn't want a Linux system's TPM polluted with MS keys.

Reply on news.ycombinator.com