(inb4 "but Microsoft only provides a report that's interpreted by others" - yes, but ultimately it's up to whether Microsoft chooses to sign the content of a report you want to produce)
You're free to use your hardware as you wish, but if you want to disable the Secure Kernel et al, don't be surprised if the gameserver rejects your connection.
Riot would not let you use their servers to play League of Legends with others if you were not using the secure kernel.
You are still able to do whatever you want with your own PC, but you can't force others to let you play with them when they don't trust you.
And it will not be just game servers. We can already see that on other platforms.
>We can already see that on other platforms.
And it doesnt prevent you from using those devices how you want.
1. The third parties are not your device.
2. This only prevents their app from attesting in the insecure kernel. You can still use the app with it loaded in the secure kernel.
>Anyone who uses an Android device that doesn't pass the attestation know this well.
This is quite different because no Android operating system lets you transparently run those apps in a secure vm that would pass attestation. Needing to reflash your device is totally different than the OS transparently loading the app in a secure environment.
Nobody says they are, but that's a distinction without difference: https://news.ycombinator.com/item?id=46555963
The end result is that you're restricted from computing on your own device if you wish to participate in the society. Only pre-approved software gets a pass.
> You can still use the app with it loaded in the secure kernel.
That's not how it works. The secure kernel is the one that attests the report regardless of whether the user kernel has been modified or not, and the application itself does not run in the secure realm at all. It's quite similar to how it works on Android.
> This is quite different because no Android operating system lets you transparently run those apps in a secure vm that would pass attestation.
Sorry, I don't understand what you're talking about here. You're not going to pass this attestation process inside a VM, or to be more exact: you'll get a signed report that effectively signals "don't accept this client" to the server.
You are restricted from hiding that you tampered with apps from servers that ask for it. You can still do whatever computing you want on your device. The fact that an app required for society has to run in a secure vm, doesn't take away from all that you can do with the rest of your system.
>That's not how it works.
Please take a charitable interpretation. What you are saying is what I meant. The app is using the secure kernel instead of an unsecured one you may have for extra computing freedom.
>I don't understand what you're talking about here.
I'm talking about adopting the approach Windows is taking but on Android. Allowing both insecure and secure virtual machines running on the same host, seamlessly integrated so the user can't tell.
>You're not going to pass this attestation process inside a VM
Yes, you are. Android VMs are designed to be isolated which means that you could have one VM that is fully trusted, and one that isn't. So you can do all your crazy things in the insecure vm while simultaneously having another secure vm available for apps that need it. The hypervisor ensures that this would be secure.
Maybe there's some alternate reality where that's the case, but it's not this one.
> Please take a charitable interpretation. What you are saying is what I meant.
It's hard to figure out what you meant, you seem confused about how this works. Have you read the article? "Secure Kernel" is what Microsoft calls the piece of software that runs within the trusted context and is distinct from the NT kernel which state it inspects and attests.
Speaking of which, tangentially, what are the latest workaround for play integrity these days?
And then you're back to needing to load vgk.sys at boot time to play a Riot game. And that's dramatically worse as anticheats like Vanguard do PCIE & DMA screening, vulnerable driver blocklist enforcement, and other hardening at boot time.
The fence you're trying to maintain is already broken on both sides: media DRM (Widevine) does hardware attestation. TPM attestation already exists. Macs don't let you connect to some Apple services without a hardware-sourced ticket. Secure Boot enforcement and requirement by some apps is already a thing.
The only thing Microsoft is preventing you from doing on your own PC is having Microsoft lie to the other piece of software.