Hacker News Reader

Comment by userbinator | Hacker News Reader

the device ID, which is a 128-bit unique number tied to the processor.

15 years ago Intel tried this, and there was enough opposition that they removed the feature in later models: http://en.wikipedia.org/wiki/Pentium_III#Controversy_about_p...

When SGX gets implemented in a future processor, will the users once again fight strongly against it, or will they submissively accept it without resistance, looking only at the claimed "security benefits"? I really hope it'll be the former.

Reading the rest of that article and the linked Intel documents just... gives me a very bad feeling about the direction things are heading.

View on HN

It's a double-edged sword.

I work for a company that has to deal with a fair number of online cheaters and fraud. It would be great if we could know who we were really dealing with for our financial transactions, or failing that, have a secure execution environment for our code so we'd have a solid place to stand on. Unfortunately the state of security on PCs is so miserable that they simply cannot be trusted.

Game consoles actually do this kind of thing; the security architecture is rooted in hardware, partly to maintain the paywalls for entry to the console's market, and partly to ensure that the environment is secure against bad guys.

Of course the moment you have system like this on a commodity PC you also enable a bunch of tracking, DRM and lockout stuff that is near trivially exploited by state-level actors and companies to whom you are just chattel to be sold or rented out. And that sucks really hard.

I don't expect the masses to make good choices about security systems; they can be mislead, outright fooled, or simply drawn into poor decisions by trinket-class rewards. It's depressing.

Devil is in the details, e.g. in all processors or optional? Can hardware owners set root keys? How will enclaves interact with client Hyper-v, Yosemite OS X hypervisor, html5 drm, open-source virtualization & crypto, etc.

Protecting content from users is a failed game. This kind of protection is useless. At the very least, they need to decrypt information before it passed through our eyes and ears - that's the weak link in the chain.

Useless or not, it could impact x86 operating systems and would benefit from developer feedback prior to shipment of microcode in new processors.

Oculus will make it more difficult to photograph the screen.

I think the weak link in the chain is only after decryption, but before uncompression (for lossy formats, so books excluded). See, for example, [1] and [2], where the authors look at randomness and entropy measures of I/O to find where the decrypted-but-compressed buffers are.

[1] http://moyix.blogspot.de/2014/07/breaking-spotify-drm-with-p...

[2] https://www.usenix.org/node/182951

It seems like virtualization is about to become useless in the future and CPU-emulating+jit compiling systems are the future, because SGX can't be virtualized.

More likely that hypervisors will be refactored to take advantage of the additional protection level.

See PrivateCore (now Facebook), http://en.wikipedia.org/wiki/PrivateCore & http://security.stackexchange.com/questions/53165/is-it-poss...

Reply on news.ycombinator.com