Hacker News Reader

Comment by Arisaka1 | Hacker News Reader

I saw the writing on the wall the moment they could sloppily justify the TPM requirement.

Then I got into arguments with people proclaiming that it's just Microsoft enforcing it for the casual user's safety, and that I'm a Microsoft hater. Who? Me, whose first programming language was C#, who worked as an Windows server administrator for years, and my operating systems have been nothing than Windows for 2 decades. And I'm suddenly a hater for daring to raise an eyebrow and question their design motivation?

I'm very convinced that the desktop world is at its worse. You have the commonly owned yet absurdly powerful tool known as a desktop computer have its market dominated by a single company, with no competitors whatsoever. Even worse, Microsoft's deal with hardware vendors ensure that even if a competitor were to rise they'll have to earn their favor as well. The game is lost for any competitor before it even starts.

And with the PC dominance under their thumb they test the waters to see with how much they can get away with, an approach they cannot even afford to consider when it comes to their other products like Azure or even the C# programming language. They also did their best to make Visual Studio Code great, until you realize that this also follows the same pattern.

View on HN

I genuinely miss the days of playing with DOS, Windows 9x and then all the excitement of Windows XP. All on my own hardware, which was whatever I could scrape from parents, savings, neighbours. I could do what I wanted with these old PCs.

There was an openness that existed in the world of computing. Despite all that was said of Microsoft back then, and much of the complaints about proprietary software were true then also, it wasn't anywhere near as bad as this. Back then, new releases actually did improve my experience of computing.

Every time I use Windows 10 I feel like I'm constantly in battle with the PC. Every new piece of news I read, every new feature in software and now hardware I read and shudder, thinking, how much more of my privacy will it cost? What other aspect of my life is being invaded?

And because of the network effect, I'm trapped in their clutches. I have to use these services or I can't work, can't talk to friends. All well and good saying 'use Matrix' but a chat program with no friends is just a note taker.

Such a seismic shift and it was only two decades. I just want this hostility to end. A computer is a machine, which is an elaborate tool, for Pete's sake. I don't feel the same way towards my garden hose or washing machine.

(And I increasingly wonder, were we freer back then because there was still some empathy towards customer needs at Microsoft, or because they were simply stifled from their real intentions by technological limitations?)

I have a theory that this seismic shift is the result a demographic shift of PC users. It gradually went from engineers, businessmen and hackers to a much wider audience including younger people who have trouble grasping concepts such as folders[0]

This by itself is not bad, problems arise when companies use this to justify deny control even from those who can be responsible with it.

[0]: https://www.pcgamer.com/students-dont-know-what-files-and-fo...

The problem arises when there is no way to differentiate between the user classes. And while I enjoy computing freedom, I’m not exactly proclaiming its value when I have to deal with a DDoS or hear about people getting ransomwared. I know things like Mirai also exist, and that user error isn’t the only ransomware vector, but poor computing habits absolutely fuel such problems and they cause pain for society as a whole.

I have no idea what the answer is, other than having Linux et al be the place for free computing (protected by its various barriers to entry) while the consumer OS space eventually becomes increasingly locked down. The only other ideas I have are dumb ones like requiring regular examination/certification/licensure to be able to use the “developer” version of Windows or something.

Let's pretend there is no financial interest in restricting computer access. I think the best and safest option would be to manufacture all PCs with a similar mechanism to chromebooks write protect screw that you have to remove to unlock the bootloader. But instead of just unlocking the bootloader it also gives you TrustedInstaller privilege in windows.

And while I enjoy computing freedom, I’m not exactly proclaiming its value when I have to deal with a DDoS or hear about people getting ransomwared.

"We are not truly free if we don't have the freedom to make mistakes."

It's nice to hear about cyberattacks and such continuing, because it means freedom still exists.

That early era also included some controversy over Windows XP requiring online activation. It was a watershed moment, soon followed by their authenticity check to install certain updates.

We are firmly in a new era of increasing DRM within the OS. As a producer I can see the desire but am saddened as a consumer with fond memories of a freer time.

I completely agree with your points.

> I don't feel the same way towards my garden hose or washing machine.

We just built and furnished a remote vacation home from the ground up and the shiny new appliances and even some fixtures (mostly ordered or approved by my wife) default to stubbornly demanding cloud access, often before they will even perform their most basic functions. At the moment, internet is only via 4G hotspot as we await Starlink's rollout next year.

This of course includes the Samsung TV but extends to the Denon amplifier, all the major appliances from washing machine, refrigerator etc all the way down to the light switches, thermostats and 'smart' toilets (which I view as 'input-only' devices). Fortunately, I intercepted the light switches before installation and hacked open source firmware on them but that required opening each one and temporarily soldering to reflash the firmware (I had to draw the line somewhere).

Most of the devices can be coaxed into functioning without permanent cloud access but it's a time-consuming escape-room adventure through dark UX patterns. The rest will require blocking at the router firewall level.

Well, when the story began I though this sounds like a pleasant getaway, and I was happy to read you've acquired such a place.

Then the rest of it was just a dour decline. Man, oh man. The worst of it is that all these devices could integrate genuine 'smart' functionality, but a user-respecting way would be locally run from a central box with open and interoperable protocols across devices. Exactly how a router and server works on a LAN. It isn't impossible to design this in a consumer-friendly way either. But the will and the demand just isn't there.

I wonder how these devices will be when the remote servers are inevitably switched off. I learnt this lesson very early on with online games (think GameSpy), the servers are not forever.

What has come over the population? It wasn't that long ago that they burnt identity cards in the UK (at the end of the second world war), the public were glad to see the back of them despite the touted 'benefits' by some politicians. My grandmother shuddered at the thought of giving any financial details online. In the early days, I never used my real name anywhere on the Internet. There is just so much passivity now.

It's still going to be a pleasant getaway, just one requiring much more effort during set up to configure it in a long-term sustainable way.

> There is just so much passivity now.

For anyone interested there is a large, active online community around the open-source Home Assistant platform. I'm using it and the community has been a terrific resource for finding those still too-rare devices which both work well and are willing to work sans-cloud. There are thousands of contributors and hundreds of thousands of HA users now and together we comprise a market large enough for even low-cost Asian manufacturers to notice and start targeting products toward.

And I increasingly wonder, were we freer back then because there was still some empathy towards customer needs at Microsoft, or because they were simply stifled from their real intentions by technological limitations?

They've been slowly cooking the frog in the background for a while now with the "trusted computing" stuff. It's over a decade old at this point. Back then the userbase was more technical and likely to smell BS, and DRM was definitely not liked even by the general public.

https://www.cl.cam.ac.uk/~rja14/tcpa

https://www.cl.cam.ac.uk/~rja14/tcpa-faq-1.0.html

...but then they eventually found out that people could be scared into doing anything by justifications of "security" (regardless of what's being secured, who it's being secured by, and who it's being secured from), and here we are today.

> ..but then they eventually found out that people could be scared into doing anything by justifications of "security" (regardless of what's being secured, who it's being secured by, and who it's being secured from), and here we are today.

Ah, so they took a page from the politicians' handbook. The same drivel that drives the public to concede privacy and freedom to their hands in the state also applies in private industry (I am thinking of the ominous UK Online Safety Bill). Like it is all the same zeitgeist.

>I saw the writing on the wall the moment they could sloppily justify the TPM requirement.

Microsoft doxed itself on the TPM limitation being purely arbitrary when Windows 11 compatibility checks passed on a Pentium 4 CPU and installed just fine due to a mistake from Microsoft where they forgot to blacklist that CPU family lol.

https://twitter.com/Carlos_SM1995/status/1448561898035851264...

>purely arbitrary

As if years of experience hasn't taught us that opt-in security is stupid. This would be arbitrary if the TPM was useless, but it isn't.

We have to disagree here. The threat models where the security that TPM offers are mostly applicable to the enterprise and business sectors where all devices on the network/AD/VPN have to be trusted and their storage encrypted. There TPM makes perfect sense.

You average consumer/home user does not benefit at all from the features of TPM since they're not subject to the same threat model. Here TPM, and also stuff of the UEFI security chain like Management Engine and Secure Boot in the past, act more like hostile wall-gardening that limit what a user can install on his system (remember how enabling secure boot originally meant you couldn't install any linux distro?) rather than add any meaningful security (will TPM and Secure Boot prevent grandma from getting her PC infected by malware off some shady phishing site? No? Then don't force those requirements for private users)

To give an example harm caused by the TPM / disk encryption feature in the consumer space: A recently-deceased friend's wife contacted me about getting personal data off from her late husband's computers. I ended up being able to get nothing for her.

My friend, no doubt influenced by dementia and paranoia he was feeling, changed the passwords, made no note of them, and subsequently died. The computers in question run Windows 10 using Bitlocker and key storage in the TPM.

The data is effectively gone. I believe he was using encrypted backups to a "cloud" storage provider, too, but I'm also fairly certain the key is only on these computers. (The Windows accounts on these machines are local accounts so the Bitlocker recovery keys weren't saved on Microsoft's servers either.)

Matters were arguably handled poorly on my friend's part prior to his becoming of unsound mind. He wasn't terribly technically savvy and I'm not sure he considered the "losing my own mind" threat model. Nonetheless, it adds insult to injury that Bitlocker, which added no security for his day-to-day use, effectively caused the loss of his data.

If you can log into his microsoft account on the internet, you can recover the bitlocker key from there if his account on his machine was a microsoft one

> (The Windows accounts on these machines are local accounts so the Bitlocker recovery keys weren't saved on Microsoft's servers either.)

Reading the comments, before posting, helps.

I'm sorry for your loss, but did your friend not have a right to privacy just because he had dementia? Should we be building dementia backdoors into all our platforms' encryption systems? What about cases where people are estranged from their spouses?

As I said, it wasn't handled well. I don't think we should be building backdoors into secruity systems. I also don't think my friend explicitly requested the functionality or would have understood the ramifications even if he did.

Bitlocker is, apparently, enabled-by-default on consumer machines that, I'd argue, don't suffer from a threat model that necessitate its use.

There is a huge problem with technical and legal constructs associated with the rights to accounts and data after death. I don't have the answers for everybody. I've done what I can for myself and my immediate family.

The "I've lost my mind and undermine efforts I made, while still in my right mind, for successors-in-right to access my data" is one that I'm not sure how to defend against, and one that scares the willies out of me. I can document my last wishes but if I, in a fit or paranoia, change keys / passwords / remove recovery mechanisms, then those last wishes might be irrelevant.

This is similar to why enabling 2FA actually scared the heck out of me! I use a password manager to generate strong unique passwords, so I think the chances of someone getting in that way are incredibly low. But I can absolutely see myself loosing all of my 2FA keys some day in a freak accident.

Nowadays the password managers can store the 2fa secrets and generate the codes as needed.

It kind of defeats the purpose of the second factor -- the password manager becomes it -- but at least it makes the services that insist on it happy.

Nowadays 2FA are always about something you know and somebody that vouches for you (SMS, email, whatever). Nobody seems to do any version of it that relies on you alone. So a password manager won't improve its reliability.

You are supposed to store the recovery key(s) in a secure location. Then if you lose your 2FA device, you can reset your 2FA from those recovery keys.

What secure location? My sock drawer? Or am I expected to go buy a safety deposit box? I'm really not that organized and I loose slips of paper all the time, it's a major reason I was drawn to computers growing up.

I keep mine in a file in a drawer. My threat model doesn't cover people breaking in and finding them as well as knowing my password managers master password.

Sock drawer, wallet, locally on your computer, wherever. If the recovery keys are compromised, that really just downgrades your 2FA back to 1FA.

I’m not concerned about the keys being compromised, I’m concerned about loosing them, since the idea is they’re unneeded for many years and then suddenly become essential.

Did he enable a boot pin or are the drives just encrypted?

The drives are encrypted without a boot PIN. If I could exploit a vulnerability in the OS I could get the data. There will probably be a vulnerability discovered, at some point, that will allow access. I'd advised my friend's widow to hold onto the computers for the time being.

Please also advise her to power it on every 2 or 3 months or so (and leave it running for a bit), so that SSDs continue keeping the data, and HDDs don't get "stuck".

Just as long as she can keep it from connecting to the internet.

This seems like a plus not a problem.

What about the scenario where your laptop is stolen and the attacker reads your data off the disk? All modern mobile devices protect against this scenario by default, but Windows devices required additional configuration to be protected.

And in fact Secure Boot does protect against Grandma being infected by boot-time malware. And when has it ever been the case that it prevented you from installing Linux?

>And in fact Secure Boot does protect against Grandma being infected by boot-time malware.

And how can grandma get boot time malware at Home? IIRC those were common back in the days when people were plugging in infected floppy disks or thumb drives everywhere and you'd try to boot off them. Can't remember last time I saw this type of malware in the wild as phishing and ransomware is a lot more profitable for malicious actors than boot time malware.

>And when has it ever been the case that it prevented you from installing Linux?

This was always the case ever since secure boot launched and any OS that didn't have it's first stage bootloader signed by Microsoft could not boot. Even To this day, to install arch or puppy on my XPS i had to disable secure boot. Ubuntu and other major distros are fine here though but this gate keeping doesn't make it ok in my book.

> Can't remember last time I saw this type of malware in the wild.

That's exactly because widespread secure boot has made it impractical!

As for niche Linux distros, it's been mandated since the beginning that you can install your own Secure Boot keys on Microsoft certified desktop platforms.

That branch of malware was already rare when uefi secure boot was introduced.

> it's been mandated since the beginning that you can install your own Secure Boot keys on Microsoft certified desktop platforms.

...on x86; on ARM they mandated that the user couldn't install their own keys, which shows that they will lock users out as much as they think they can get away with.

It hasn't been mandated at all. A number of years ago, Microsoft made headlines by changing their policy to get rid of that mandate. See https://arstechnica.com/information-technology/2015/03/windo... . Microsoft's page at https://docs.microsoft.com/en-us/windows-hardware/manufactur... says that you can "usually" disable it, so I don't think they've changed their policy since then.

> This was always the case ever since secure boot launched and any OS that didn't have it's first stage bootloader signed by Microsoft could not boot. Even To this day, to install arch or puppy on my XPS i had to disable secure boot. Ubuntu and other major distros are fine here though but this gate keeping doesn't make it ok in my book.

But this is kind of a circular problem, isn't it?

If everyone's bootloader is signed and recognized by every Secure Boot implementation, then signing is useless since it doesn't afford discrimination between "known good" and "dubious" bootloaders.

I'm not familiar with XPS computers, but to me what's important, as another sibling says, is that the user be able to load their custom keys with which they sign their own bootloader. This is how I run Arch on my HP computers.

This way, I can be reasonably sure that when I boot my arch linux, it's actually mine, and not some random live medium based of arch's (or whoever's) install disk that will sniff my passwords or whatever.

To me, this is what SecureBoot is supposed to offer, and I don't see how you would implement this if you could easily get anything signed and accepted by most PCs.

>to me what's important, as another sibling says, is that the user be able to load their custom keys with which they sign their own bootloader. This is how I run Arch on my HP computers.

Like I said above, this and stuff like management engine and TPM makes perfect sense in the enterprise environment where the owner of the device (the employer) is different than the user (the employee), so IT needs to strictly control what's running on the devices they trust on their infrastructure, but why should we expect home users to have to sign bootloders to use whatever software they want as they're both the users and the owners of the devices and the network infrastructure in their homes?

I agree that the process could be more straight-forward, especially as, from what I read, some computers may need some coaxing into changing the keys.

But the thing is that, like it or not, most people simply don't care enough, so they'll just use Windows. I remember a while ago, when there were many live CD-based distros and there was no such thing as SecureBoot, people wouldn't even be curious to give Linux a spin. All it would have taken was to pop a CD in the drive and boot up. To paraphrase another commenter, I think many people feel the same way about their PC as their washing machine: just another appliance. Of course, lock-down platforms don't help instill curiosity in people...

So you get, roughly-speaking, two populations: those who care and those who don't. And usually, those who do care are curious enough to follow a few simple steps to disable SecureBoot for the installation and then set up their own signing process.

But I stand by what I said earlier: the process cannot be fully automatic, or it defeats the purpose. But I do think that willingly making it a pain is wrong.

> And how can grandma get boot time malware at Home?

Depending on the demographic, they can: get caught up in during some (possibly unrelated, likely automated) attack, click the wrong ad, or load the wrong common page with JS.

Can you please provide some sources for JS ad-based boot time malware you mentioned that one can get off the web?

Usually JS part it's just exploit that is just a first step. After there is compiled and native "loader" malware that required to setup actual trojan / rootkit.

> And when has it ever been the case that it prevented you from installing Linux?

There was a window, when shim.efi was not signed.

> And in fact Secure Boot does protect against Grandma being infected by boot-time malware.

When it was the case that grandma was infected by boot-time malware? One-half-like malware happened decades ago, and under windows they need administrator rights anyway.

This assumes that home users don't have any data worth protecting. I think that's a ridiculous thing to assume.

IME does not affect your average user at all, so I'm not sure why you'd bring that up.

>remember how enabling secure boot originally meant you couldn't install any linux distro?

A lot of people were spreading this FUD back when secure boot was being introduced. It was a lie back then, it is a lie now.

> rather than add any meaningful security (will TPM and Secure Boot prevent grandma from getting her PC infected by malware off some shady phishing site? No? Then don't force those requirements for private users)

Secure Boot essentially killed off bootkits, that's a significant achievement. Perhaps you should learn what these technologies are actually used for before attacking them?

>Microsoft doxed itself

Does "dox" mean "anything vaguely secret" now? I still remember the days when it meant "personal information".

The issue isn't the TPM, it's who owns the keys to the machine. If the user configures their own keys, it becomes an empowering technology that allows them to verify their boot process hasn't been tampered with. If Microsoft owns the keys, they own the computer and the technology becomes their means of control over the user. They will use this technology to oppressively deny the user their software freedom while simultaneously extracting rent out of any developer who wants to reach that person.

Those who own the keys own the machine. We must ensure we are the ones holding the keys at all times or suffer the consequences.

Insightful analysis, though "oppressively deny" sounds harsh to me. There is not a blatant malice in TCG per se, mainly a neutral desire for control and by proxy profit. The treacherous versus trusted computing debate really does boil down to control. Do we trust vendors to be stewards of control on our platforms? Do we even have a choice?

I do not recall giving the keys to anyone, and yet it feels like the person building your house is telling you that they can pop in for dinner and lock you out should the need arise (deny you the ability to run your choice of software and your control is forfeit).

There is something flagrant when the question is brought home to the personal computer. No user complains too much about not being able to replace the firmware for some faraway BGP router, yet that router is also part of the infrastructure like the PC and the OS installed on it. If a consumer thinks about the PC less as providing a personal computing service and more as an Internet terminal, then the problem goes away a little. Naturally, the PC does both, but since the two are at odds with one another, the PC has conflicting interests, serving two masters.

A similar issue exists with cell phone debug, where the carriers log into your phone to troubleshoot. Granted, debug is control for the sake of helping the user and does not deny the user the ability to run software (the OS and app store do that).

This just leaves the problem of where can a user actually go to do secure compute. An abacus works nicely, but is impractical. Free open source hardware (FOSH) is really the only option.

> A similar issue exists with cell phone debug, where the carriers log into your phone to troubleshoot.

You cannot be serious. How do I know if this can happen to me?

> Free open source hardware (FOSH) is really the only option.

Yes.

> No user complains too much about not being able to replace the firmware for some faraway BGP router

The network is a very clear line to me. The BGP router is not my computer. It's the ISP who should be demanding free software from their hardware manufacturers, so that they too could enjoy complete control and trust.

> If a consumer thinks about the PC less as providing a personal computing service and more as an Internet terminal, then the problem goes away a little.

In these cases, the user is not using a computer. They're using appliances that just happen to have computers inside. Modern consumer products make every effort to hide the computer. There is no computing freedom if there are no computers we can use.

We must oppose all "consumer" products, all "fully integrated and converged" solutions. Computing is about simple parts in the form of hardware and software; from these parts, powerful systems emerge. Consumer appliances are these whole things that have swallowed up the entire system. They are indivisible, non-interoperable, uncontrollable, they only do what was foreseen by the corporation that made them despite the perfectly capable computer inside. I can't interface directly with the computer controlling my air conditioner, I need an infrared controller for that.

This article is linked from Stallman's website, it covers this matter with a lot of depth:

http://contemporary-home-computing.org/RUE/

> We are giving up our last rights and freedoms for “experiences,” for the questionable comfort of “natural interaction.”

> But there is no natural interaction, and there are no invisible computers, there only hidden ones. Until the moment when, like in the episode with The Guardian, the guts of the personal computer are exposed.

> Every victory of experience design: a new product “telling the story,” or an interface meeting the “exact needs of the customer, without fuss or bother” widens the gap in between a person and a personal computer.

> The morning after “experience design:” interface-less, desposible hardware, personal hard disc shredders, primitive customization via mechanical means, rewiring, reassembling, making holes into hard disks, in order to to delete, to logout, to “view offline.”

There is not a blatant malice in TCG per se, mainly a neutral desire for control and by proxy profit.

The originators of the idea were thinking of DRM and came from the content industry. I don't think it's a neutral technology at all.

The logistical problem of key exchange hasn't been solved. Boot viruses are very real, but the most severe threats is information extraction which works fine in user space.

I doubt I will activate TPM on my home PC as it doesn't offer much security to me. You can already say that some services will use remote attestations and I think these services can do without me.

And they will get away with it. The generation that grew up with smartphones primarily, getting a computer only later on (if at all) will find this totally normal. Even Android is getting locked up more and more over the couple last releases too, even most Chinese vendors stopped letting you unlock the bootloader, and nobody complained.

Reply on news.ycombinator.com