Hacker News Reader

Comment by abcd_f | Hacker News Reader

TPM is still clearly optional on Win 11.

Microsoft is just pulling the same trick they did with normalizing the telemetry. First it was opt-in, then it became opt-out and then, when the complacency settled in and everyone got used to their machines leaking like rusted buckets, the trap closed shut and it became always-on.

Same with the TPM, except the effect will be far more disasterous - a complete loss of admin control over your machine when it runs under Windows. Won’t happen in W11. Probably not in W12, but you will be locked out eventually. That’s their end goal. But for now the unwashed gray masses need to be made used to the TPM. Hence all this circus.

View on HN

Thing is OS is becoming so much less relevant with the browsers and mobile - what's the end goal here ? Even without admin access they can't gate keep you like iOS can because iOS mandates the browser engine and won't let it become powerful enough to circumvent the app store - Microsoft can't ever really do that with Windows and with things like WASM and better APIs I suspect web is going to keep growing as an app platform.

So what's the play behind this lockdown ?

remote attestation is a big one

netflix / online games / banking applications / ... will be able to check if your computer is tamperproof and will refuse to run if not

you already see this on android with safetynet: https://developer.android.com/training/safetynet/attestation

the other one is they'll be able to gatekeep the applications running on Windows (again like mobile phones)

Same thing happening on iOS right now. Banking app refuses to run if you jailbroke your phone

Probably mainly to make it impossible to disable “telemetry” spyware or other invasive “features” like treating torrent clients as if they were malware etc.

The TPM is used for various security features, see: https://docs.microsoft.com/en-us/windows/security/informatio.... Providing better security is the play.

Realistically, can anything be done from a regulation standpoint? I would love a law that requires those who sell operating systems to enable users to use their system without being forced to create a profile that registered them to an Apple/Microsoft/Google account and forces them to provide options to disable telemetry.

> Same with the TPM, except the effect will be far more disasterous - a complete loss of admin control over your machine when it runs under Windows.

You can just switch it all off in UEFI? What's the problem?

My guess is that they really want to do this because:

1. they're trying to push OEMs to care a little bit about security in their designs

2. it helps OEMs sell new devices and therefore new windows licenses

3. public opinion on windows security is bad

> You can just switch it all off in UEFI? What's the problem?

Until you can't...

Who is going to do that, and why?

Reply on news.ycombinator.com