![Security Security](http://a.fsdn.com/sd/topics/security_64.png)
![Government Government](http://a.fsdn.com/sd/topics/government_64.png)
![The Courts The Courts](http://a.fsdn.com/sd/topics/court_64.png)
![Your Rights Online Your Rights Online](http://a.fsdn.com/sd/topics/yro_64.png)
![News News](http://a.fsdn.com/sd/topics/news_64.png)
EFF Position on Trusted Computing 183
Seth Schoen writes "EFF has just released our
analysis
of Trusted Computing. We find that the technology could benefit
computer security, but must be fixed to ensure that the computer owner
is always in control. We also propose a specific way of fixing it.
There's coverage
of our position at news.com. More articles should be up in
the near future at
the new EFF
Trusted Computing page. Thanks to all the people who helped us
understand this technology!"
In short (Score:2, Funny)
Re:In short (Score:1)
Bad assumption (Score:5, Insightful)
The real reason it exists is precisely to take control away from the computer owner and give it to the content owner. Given that, what is the point of the EFF proposing "fixes" to help keep the computer owner in control, when its primary design goal is the exact opposite?
Jason
ProfQuotes [profquotes.com]
Not with the current government... (Score:5, Insightful)
Our government responds to campaign finance, and the lion's share of that is done by large corporations and other aggregates that want to make sure that THEIR rights come first.
Most people don't understand enough about computers to understand how completely OUR rights in this realm have been trampled, already.
Re:Bad assumption (Score:5, Insightful)
Because it throws the ball back over the fence to those trying to force DRM on us.
In essence, the EFF has given these folks an ultimatum - "You want a trusted computing environment, but not the public backlash? You can fix it like this. Now put up or shut up".
Up to this point, the Palladium group et al could safely ignore most of us, since all of us opposed to DRM have basically just whined about it. Now that someone (and a respectable someone, at that) has offered them a way to get what they claim they want, choosing to ignore that will very tangibly clarify the real intent - If they ignore the EFF's recommendations completely, they all but publically admit they only care about stripping users of the right to use their own machines, rather than creating some fictional "safe" computing environment.
Re:Bad assumption (Score:4, Insightful)
It does not. It means being able to prove what processes run on your computer to someone else, if you want this - if you need some services from that someone one. If you can't, that someone else simply would not deal with you, but it would not be able to control what is run on your machine.
EFF proposal is stupidiest I've ever saw (from CNET):
This ability to lie breaks the whole idea - if somebody else does not trust you, he will not deal with you - no EFF will ever force him to.Re:Bad assumption (Score:2)
Let's say everyone who doesn't want authorization says "100% accurate copy of SpargleBlaster 9.64 on Baikal DOS 611.82" The person you're working with can either say:
"I won't deal with Spargleblaster users at all" (his loss)
or
"I will take them, but will require different terms" (you may need different account-establishment approach, or they can sell 'anonymous content' at a higher price"
or
"2/3 of our customers are calling themselves Spargleblasters now... perh
Re:Bad assumption (Score:4, Insightful)
It does not.
Actually it does when more and more websites and software simply refuse to run at all. It is essentially extortion. You are given a choice to "voluntarily" agree to give up all right to privacy and give up control over your own computer, or you are denied use of your computer.
That computer sitting on your desk is little more than a worthless lump of metal and plastic if you are denied access to most of the internet and you are denied use of virtually all new software.
This ability to lie breaks the whole idea - if somebody else does not trust you, he will not deal with you - no EFF will ever force him to.
Fine, if someone doesn't want to deal with the GERNERAL PUBLIC then they are perfectly free to go hide a hole in the ground. They have absolutely right to expect the GENERAL PUBLIC to be denied ordinary control over their own property.
You are essentially proposing to 'offer' everyone a chance to have a polygraph surgically implanted in their brain. Anyone who doesn't 'voluntarily' agree then gets locked out of all buildings, denied use of the phone, denied use of the roads, denied use of money. To quote you, "if somebody else does not trust you, he will not deal with you". You don't HAVE to vuluntarily have this device implanted in your brain, but if you decline you are effectively thrown in prison. Sure, you're free to walk around your own house, but your house is the prison cell.
Oh, and that "polygraph device" they are implanting in your brain? When you 'voluntarily' use it, it has TOTAL REMOTE CONTROL power. It can force you to do anything, it can prevent you from doing anything, it can erase or modify anything. Of course you are perfectly free to chose to live in a prison cell for the rest of your life instead.
The EFF is simply saying that your computer is your property. They are simply saying that it should not be designed as a weapon against it's owner.
As I have been saying for months, the only problem with TCPA and Palladium/NGSCB is that the design specifications require that the owner of the machine is FORBIDDEN to know his own keys (passwords). The sole purpose for that design requirement is "secure" the computer against it's rightful owner. The owner of the computer has absolutely every right to rip the hardware open and dig those passwords out with a microscope if he feels like it. And once he does that he does have full control over the system and is capable of doing exactly what the EFF proposes. The EFF isn't proposing anything that people don't already have every right and ability to do. They are just saying that there is no reason that people should need a microscope and other equipment to do it.
-
Re:Bad assumption (Score:3, Insightful)
Because most people know absolutely nothing about this, and will go out and buy the new much-hyped "Pentium 5 FX Palladium! with patented Ultra TCPA technology! To make your web experience faster over even a 300 baud packet radio modem!".
Those of us who have a clue will avoid this as long as possible, and might even make it a few years without ugrading (hey, my current desktop has lived a few years, and it still runs well), but when e
It's a game -- flush out the rats of hidden agenda (Score:5, Insightful)
You see, the problem is not so much that big business is doing this, but that it is doing so by subterfuge rather than out in the open.
The EFF is just flushing out the rats here. If business were trying to take control of people's property openly then the EFF wouldn't need to put on an act of innocence and merely be "identifying dangers" as the proposed solutions as if business wasn't aware of them.
It's a good strategy. Big business can only respond by saying either "Oh yeah, we hadn't realized" (LOL), or else it can reply that this was indeed the intention. In both cases, the user wins.
My bet though is that the EFF will be met by total silence.
Re:Bad assumption (Score:1)
Sad to see EFF legitimizing this (Score:5, Insightful)
Even the proposed "Owner Override" seems to me a "how are you going to do that" issue. How are you going to assure that a change was made by you and not by some software pretending to be you?
There are other oversights too:
Re:Sad to see EFF legitimizing this (Score:2)
That question is the machine owner's problem to deal with, and "Trusted Computing" spec and app developers need not concern themselves with it. It doesn't matter how it gets done (or even if it really gets done). The owner takes responsibility.
Re:Sad to see EFF legitimizing this (Score:2)
It's the computer equivalent of fluffy kittens and kissing babies, of "won't someone please thi
Re:Sad to see EFF legitimizing this (Score:3, Informative)
The idea would be to use the secure I/O capabilities to make sure the user approves the change/override at the keyboard, which can't be spoofed by software in a TC system.
"Identity" of software is determined by submitting a hash value, but how can you be sure someone's not sending a canned hash value?
The hash val
Re:Sad to see EFF legitimizing this (Score:5, Informative)
Actually that is pretty easy, you press a special button/switch. Malicious software is incapable of faking actual physical control. I proposed exactly such a modification to TCPA months ago.
I e-mailed this one of the main TCPA proponents about this back in January. It was David Safford, author of Why_TCPA [ibm.com] and TCPA_Rebuttal. [ibm.com] I explained this system and pointed out that there every single claimed benefit of Why_TCPA works just as well with actual and full owner control like my (and the EFF's) proposed modification grants. He did not dispute this.
His only reply was to suggest this change would no longer keep laptops secure against a thief. This suggestion fails on two grounds. First of all it directly contradicts TCPA_Rebuttal where he claims TCPA is not designed to be secure against physical access and that this supposedly 'proves' that TCPA is not designed for DRM. If TCPA is not supposed to be secure against physical access then it is disingenuous to claim it is supposed to protect a laptop against theft. The second reason his 'theft' argument fails is that it is simple to combine a physical button-press with an owner ID code or password before full control is given. A theif cannot get this owner password, and software can neither get the password nor press the button.
Granting the owner of the machine to his own keys (passwords) that are locked in the TCPA chip gives the owner full control over the system. There is absolutely no justification for denying the owner access to his own keys. The only purpose for this design requirement is to use it as a weapon against the owner and for various varients of DRM.
Of course Microsoft and the TCPA proponents will never accept my proposal (and the EFF's proposal) because the only real motivation for this hardware change is for DRM-type purposes. If owners maintain actual control over their machines and it can't be used for DRM systems then the entire project is a waste of time. Everything else is just a smoke-screen. TCPA will not prevent your computer from being infected with a virus, and it will not prevent that virus from slagging your entire hard drive and everything on it. The only thing it will do is prevent the virus from distributing copies of your 'secure' music files.
-
Re:Sad to see EFF legitimizing this (Score:2)
Actually, it only takes some owners. Let them implement remote attestation, but make sure it remains legal to build hardware with the EFF's owner override feature. If it's legal then there'l
Re:Sad to see EFF legitimizing this (Score:2)
Won't work. The remote attestation involves checking a sort of serial number (key) hidden in the chip without ever actually revealing the number to anyone. Part of attestation verifies that you have an approved key number.
If someone else makes hardware with an owner override feature it will fail all attestation requests because it doesn't have an approved key number. And the key n
Re:Sad to see EFF legitimizing this (Score:2)
If they try doing key per user (chip) I bet it blows u
Re:Sad to see EFF legitimizing this (Score:2)
That is the TCPA and Palladium/NGSCB plan. I certainly HOPE it does blow up in their faces. But they have every intention of making sure that every new computer sold comes with this locked chip inside and a unique code for each computer. I've been reading the TCPA design documents. Detailed specs on Palladium/NGSCB aren't really available, but the capabilities are fundamentally the same as for TCPA and the hardware would need the same
DRM is small potatoes (Score:2, Interesting)
That said, something absolutely must be done to protect end-user computers better; the current state of affairs is intolerable. I thought the EFF did a nice job not just crying Chicken Little, but making a specific suggestion on how to prevent the abuse of this
Re:DRM is small potatoes (Score:2)
This is actually an important question - what exactly do you want to protect them from?
Despite all of the propaganda, Palladium/TCPA are not designed to secure the computer against outside attack and intruders. They are designed to secure the computer against the owner. Despite the fact that they both use the word "secure" those two goals actually have almost nothing in common. Despite the claims to the contrary, Palladium/TCPA are nea
Re:Bad assumption (Score:2)
I don't necessarily expect there to be end users on the machines I intend to run Palladium on. I want an effective means of hardening a server against compromise.
Slashweeniedom might want to take a look at the people who have worked on Palladium before claiming that Microsoft employees know nothing about security. Butler Lampson won the Turing award for his work on computer security.
There are only two applications I can think
Re:Bad assumption (Score:2)
This seems to be assuming "Trusted Computing" is intended to benefit users.
I don't necessarily expect there to be end users on the machines I intend to run Palladium on. I want an effective means of hardening a server against compromise.
Yeah, but DRM is being proposed in the hardware and OS for *ALL* computers, not just servers.
Re:Bad assumption (Score:2)
For example, Outlook has access (intentionally) to y
Re:Bad assumption (Score:2, Insightful)
In this case trusted computers is being billed as a way to allows owners to control their content. The opportunity for deception is provided by the interpretation of the word 'owners.'
But then they will argue (Score:2, Interesting)
Re:But then they will argue (Score:2)
Then I will argue that Microsoft knows nothing (or does nothing) about security and I really do think I'd be better holding the controls. Of course, that assumes that I still use Windows.......
Security in Fortune 500 companies (Score:2, Insightful)
I think that any corporation that invests at least 10% of their budget wisely should be on the track to provide their clients and staff a secure environment in which to deliver their products. I have to deal with a lot of intrusions on a daily basis while overhauling the infrastructure. Cu
Re:Security in Fortune 500 companies (Score:2, Insightful)
Re:Security in Fortune 500 companies (Score:2)
Which is nice.
Good, if you have succeeded, you are safe from Microsoft worms and viruses running unpatched software.
If the systems aren't safe, then you're just fooling yourself and your clients.
Re:Security in Fortune 500 companies (Score:2)
So long as all DRM applications are knocked out and actively prevented. And there is some sort of guarantee no VENDER can use this technology, that it can only be used at the private level... then it would be a good thing. I could control what software runs on my home systems, but no vendor could generate a key and require ME to verify to THEM
Fear (Score:3, Insightful)
However, by intuition, this would mean that your computer system would know and monitor your system and thus the user more and more.
Misconceptions about this design abound. The most common misconception denies that the trusted computing PCs would really be backwards-compatible or able to run existing software.
Well, crap... of course there is going to be compatibility problems... I am much more concerned that my system and my massaging of that system is going to be tracked and recorded at higher and higher resolution of detail.
Davak
Re:Fear (Score:3)
The EFF's point is that this is perfectly fine, so long as it is done strictly for the benefit of the owner and that the owner have actual control over it. If would be a good thing if it were a tool for the owner.
The problem is that the current design is not doing this for the owner, and that the owner does not have actual control. The only control the owner has is to kill the system entirely. This will kill much of
Great timing (Score:2, Interesting)
EFF's position is outrageous (Score:2, Insightful)
Re:EFF's position is outrageous (Score:3, Interesting)
Re:EFF's position is outrageous (Score:2, Interesting)
Re:EFF's position is outrageous (Score:2)
Content providers do not have a God-given right to complete control of their content. They have a government given right to partial control. As history has shown, content providers are completely against fair use. (I'm talking a
Re:EFF's position is outrageous (Score:2)
Those advocating TCPA and Palladium are doing everything they can to deny that very fact. Forcing them to admit it is actually designed as a DRM system is a good step in defeating them.
It's pretty stupid to say you have a god-given right to see every bit in every memory location.
I'm not about to start on "god-given rights", but the fact is that my computer is MY PROPERTY and I have absolutely every LEGAL right to disect my computer and analise every s
Re:EFF's position is outrageous (Score:1)
To wit, Seth points out in the article that Trusted Computing still allows you to do with your computer what you want; there is nothing that prevents you from just turning off the trust mode outright and running it like a normal PC.
It is a misconception that the trusted PC hardware will be unable to run your custom code. I have been guilty of propagating this misconception as well.
More significantly, the trusted PC now enables a set of security primitives with implicit security policies that you can
The trouble is... (Score:4, Insightful)
If a content provider wants to "trust" a device, then they should buy it for me.
My cell phone providers wants a trusted device. Great. They give me a phone, and I pay to use it.
Ask yourself this... is watching an HDTV version of Star Wars so compelling that you're willing to compromise yout ability to control your PC? If you answered "yes", then you and I simply have a completely different viewpoint on the subject that I suspect we'll never agree on.
Incidentally... (Score:2)
Thanks.
Re:EFF's position is outrageous (Score:5, Insightful)
Re:EFF's position is outrageous (Score:4, Insightful)
Re:EFF's position is outrageous (Score:2)
The other uses like DRM are not legitimate and your right they'd be more or less useless with the EFF's changes. So what's your point?
Trusted Computing = IBM,INTEL,MICROsoft own you. (Score:1)
Next Tv's,Stereos
Doesn't that... (Score:3, Insightful)
*** END SARCASM ***
I think DRM is a *good* thing. Once people have to pay for music, movies, etc. the industry will realize exactly what they were losing to piracy -- almost nothing. If someone could wave a magic wand and people had to abide 100% by the rediculous license agreements, you'd find that instead of buying what they were sharing, they would go without.
Or does Microsoft, the BSA, MPAA and RIAA really think all those people in Asia are going to pay a few months worth of wages for software or entertainment?
Re:Doesn't that... (Score:2)
1. Disks cost too damn much. Why can I buy a movie for $19.95, including the soundtrack on the disk -- and if I want the soundtrack CD separately it is $15? Movie production costs oodles more than music production -- tens of millions of $$ more, yet the music industry tries to sell CDs for only a fraction less.
2. Production costs on music CDs are down. Pros can and do produce CDs using laptops and home studios for a small fracti
Re:Doesn't that... (Score:4, Interesting)
You underestimate the stupidity of our opponents. They have in fact not only proposed such a system, they have had congressmen advocating it.
And how could they conceivably accomplish this impossible goal? Simple, they want to make it illegal to make or buy an ordinary recording device without a "Fritz chip" inside that would shut down the device when it detected specially tagged sound. They even proposed requiring that every single analog to digital converter have such lock-out technology embedded.
You could be dictating a letter into an ordinary tape recorder, and if someone walked by on the other side of the street with a radio the "Fritz chip" would pick up the special tag in the music and the tape recorder would record dead silence until they walked out of range. You only discover later that there is a five minute dead zone in the middle of your recorded dictation. Your camcorder tape of your child's first birthday goes dead silent whenever it detects tagged music in the bacground, and the video goes dead black whenever it detects a tagged TV image anywhere in the background.
Reporters might be able to get a special licence for a special video camera that doesn't go dead in this manner, but it would probably have to embed a special tracking code in everything it records.
I'm fairly certain that this proposal is far too extreme to ever get approved, but there ARE people demanding it.
-
Re:Doesn't that... (Score:2)
For one, A/D converters are literally selling for pennies in quantity. Adding public-key decryption and watermark scanning in realtime would mean we'd need the equivalent of a pentium in every A/D converter. Now the price has gone from pennies to tens of dollars, at a minimum. This would make nearly every electronic device that consumers
"[T]he computer owner is always in control." (Score:1)
That's simple enough to solve. The computer will just be both owned and "0wnz0red" by someone else, most likely by the entity that licensed the operating system to the user, and the hardware imprinted for that specific operating system and all others irrevocably locked out.
And it will all be done with the click on a seemingly innocuous little virtual button that reads sim
Trust. (Score:3, Insightful)
Re:Trust. (Score:2)
Companies (through this "Remote attestation" feature) checking to see if their software has been modified? What's wrong with that, my mom will ask? They own it. The subtleties of how this can run counter to users' interests will escape many.
And what's the EFF's solution? To LIE to these companies. That sounds wrong, doesn't
Re:Trust. (Score:2)
Companies can still lock down their computers by disabling boot from removable media and setting a BIOS password.
Re:Trust. (Score:2)
That's what police are for, when they have sufficient evidence to get a judge to sign a warrant, THEN they may come and examine my computer as provided for explicitly in the constitution of the united states of america to prevent EXACTLY this.
I've said it once and I'll say it again, the only LEGITIMATE use for the individual, company, gov entity, etc to keep unauthorized software from running on THEIR OWN computers. Is this good stuff for a f
Re:Trust. (Score:2)
You can buy a DVD and legally modify it however you wish, just as you can write in the margins of a book and black out the bad words. You may violate the DMCA doing this, but that's not a copyright issue (you're allowed to do it, the DMCA just forbids certain
Trusted ... or Trustworthy? (Score:1, Insightful)
Token Based Trusted Computing (Score:2)
Now WIBU is making something called "Codemeter" in which a user will be able to have licence information for hundreds of different software packages, that means if someone has MS word on their computer, and knows someone else that has it, they can use their licence on the Codemeter stick on their fri
Ahh, the return of dongles. (Score:2)
Re:Ahh, the return of dongles. (Score:2)
The dongle "SCREAMS" ease of use, you merely stick it into your computers easiest USB port and BAM you have a working dongle. USB is also pretty robust, and the place I interned at only had a few returned WIBU USB dongles returned, and that was mostly due to children stepping on them, or in one case a child breaking it in an attempt to get back at his/her par
I agree it's not as annoying as dongles were but.. (Score:2)
That's why if I buy a program that requires a CD key or something along those lines, I almost always download the cracked version or updater and use that instead.
Dongles != trusted computing (Score:2)
Dongles don't provide sealed storage (which is pretty much the only useful feature of trusted computing), so they are not an alternative to trusted computing.
Re:Dongles != trusted computing (Score:2)
Re:Dongles != trusted computing (Score:2)
This is Trusted computing, the only difference is the dongle is a small computer hooked to yours and you can carry it around. Instead of being forced to lug your machine around to listen to that copy of britaney spears, you
Re:Token Based Trusted Computing (Score:2)
Using the WIBU key you can actually force a program to encrypt parts of itself, and it wont decrypt without the key. Yes you can make a JUMP statement around the encrypted and compiled code, but if the programmer has done it properly, the code wont run.
You can, for example, encrypt several KEY subroutines with the key, that requires the key to run, the key then
Re:Token Based Trusted Computing (Score:2)
Everything is crackable.
I want a secure computer (Score:5, Insightful)
Just as I wish with my house. I want my house to protect me, my papers, possessions and privacy. I want it to be nobody's business what my house contains, even to the point of being able to protect myself against legitimate legal prossecution.
Oddly enough, that's what the Constitution was written to provide my house with.
It is up to me to secure my house with whatever technological measures are available to provide that security and understand how to use that technology. I'm perfectly willing to take the same responsibility for the security of my computer. Just provide me with the tools. Then go the hell away and leave me alone.
The second my house starts deciding for me what I may or may not keep in it or do inside it I get a new house.
The day my computer decides it doesn't "trust" me with what I'm storing in it or doing with it I pull the plug.
Fortunatly for me there are already hundreds of millions of "untrusted" computers already out there in the wild that do everything I might require my computer to do.
KFG
Re:I want a secure computer (Score:2)
I don't think you understand Trusted Computing. I suggest that you read the linked article.
TC will not allow anyone else to look into your computer and see what software you are running, without your permission. What it does is to allow you to SHOW other people wh
Re:I want a secure computer (Score:2)
Thank God. I'll do everything I can to keep it that way.
And if you feel the need to be "convinced" of what's in my house, get a warrant. I have no such need of demonstration.
My house has doors and windows. My computer has ports and file ownership. I can open them. I can close them. I can let people in. I can throw people out.
I don't have to "prove" a bloody thing. To anybody. Even if you have a warrant.
KFG
Re:I want a secure computer (Score:2)
Thank God. I'll do everything I can to keep it that way.
And if you feel the need to be "convinced" of what's in my house, get a warrant. I have no such need of demonstration.
My house has doors and windows. My computer has ports and file ownership. I can open them. I can close them. I can let people in. I can throw people out.
I don't have to "prove" a bloody thing. To anybody. Even if you have a warrant.
The point i
Re:I want a secure computer (Score:3, Interesting)
It has everything to do with warrants.
I can let you look in my house window, but that doesn't mean you can see in my file cabinet or dresser drawers. You cannot be sure of what is in those dresser drawers without coming into my house and looking into them. Even then you cannot be sure I didn't remove what you were looking for before you came in or falsely placed something there which is not mine.
If I wish to prove to
Re:I want a secure computer (Score:2)
And when that "something that you value" expands to include virtually every new peice of software and even basic access to the internet? Yeah, yeah, I'm skipping to the end. I'm discussed this exact expansion process at length elsewhere.
You say it's like giving people the ability to put a window on their house. But it's more like imprisoning them in their house unless they "voluntarily" live in a glass ho
Re:I want a secure computer (Score:2)
Fixing it (Score:1)
Namely, removing it.
Microsoft may be changing course (Score:1)
Re:Microsoft may be changing course (Score:2)
Although, to be fair, the more they attack some of the applications they claim are problems that TC is supposed to solve, the fewer remaining reasons other than DRM can be given.
Trusted
Re:Microsoft may be changing course (Score:3, Insightful)
Don't forget consumers (Score:2)
Bent over, taking it in the poop chute.
The (Score:3, Interesting)
What would happen if we let people drive their own cars? They would repair their own cars, "upgrade" them too! But if they are in control, they may not make repairs as needed and then their cars would fall apart on a public super highway and cause other people to die and stuff.
Oh wait... we have a "license" to help ensure that the public has a bare minimum amount of knowledge and skill to operate a vehicle safely on public roads.
Now let's return to cyber-reality again. Instead of "trusted computing" how about "trusted users."?
Let's say that the price of admission to the information super highway should be controlled in the same or similar way to the way we control access to the roads. What a fabulous world we'd live in! "License to SPAM" wouldn't exist. Maybe there are a lot of bad things I haven't considered but is it much worse than requiring a driver's license write a check?
Wow... imagine getting a ticket and your license revoked for SPAMing... or for operating a computer with a virus...
"The Responsible Computing Initiative" is born!
Re:The (Score:2)
Trusted Computing, but who is the trusted party? (Score:2)
Trusted computing benefits content producers and service providers more than it benefits users. The reason is that producers and providers are usually the ones whose systems are being acessed, while the users are the ones accessing these well-known systems. It is the nature of the transaction that truste
Re:Trusted Computing, but who is the trusted party (Score:2)
Re:Trusted Computing, but who is the trusted party (Score:2)
The point I'm making is that it's usually the user/client who must show that the software he is running on his computer may be trusted by third parties. I'm suggesting that establishing such trust relationships is the primary purpose of the trusted computing initiative, more so than users establishing trust relationships with their own software (it's easier to fool the user than it is to fool a third party's computer).
Think People Think..... (Score:2)
Whats the difference between hardware and software when it comes to bit flipping?
to put something in hardware gains the advantage of speed but the inflexability of change.
Related News (Score:3, Informative)
Microsoft's chief security strategist made the surprising statement that the company is about one-third of the way to its goals for Trustworthy Computing. I guess there's a lot more going on internally than we're aware of.
The article also says, "Microsoft's short-term strategy will shift from patch management to what the company calls 'securing the perimeter.'" What this means is that they're working more closely with firewall companies.
Attestation (Score:2, Insightful)
With Microsoft, IBM, and other major players involved in this process, the EFF doesn't have much of a choice but to work with what they've got. I don't think that the EFF agrees with the Trusted Computing initiative; as they say in the article, most of the changes described by the initiative can be implemented at the software level. I agree that that is where the changes should take place.
I agree with some of the other posters here and I don't really see anything useful about the attestation process (see
Other Problems with Trusted Computing (Score:3, Informative)
One is the difficulty of dealing with upgrades, failures and replacement of computers, if your data is locked to the old machine. TCPA had a hugely complicated process you would have to go through to migrate any of your "secure" data to the new machine. It involved going back to the manufacturer, getting a special transfer key, moving the data over and having it get re-encrypted. Microsoft hasn't said what they're going to do, but it's an extremely difficult technical problem to solve while retaining the security.
Another problem is the PKI (public key infrastructure) issue. For remote attestation to work, it's necessary that the TC chips have some kind of crypto certificate that says that they are legitimate. Microsoft has said nothing about who will issue these certificates and who will revoke them if a machine gets broken into. Setting up a successful, global PKI is a prerequisite for DRM type applications and will be an enormous job.
The article also overlooks that the sealed storage feature, which the EFF mostly views favorably, can also be used to achieve lock-in and secure closed formats. Microsoft Word could store data encrypted using the TC hardware, such that only Microsoft-signed applications can access the data. This kind of lock-in does not depend on the remote attestation features that the EFF is so concerned about, and would not be addressed by their Owner Overrides.
Re:Other Problems with Trusted Computing (Score:2)
More importantly, the embeddded certificates used for the remote attestation (T
Competition will make trusted computing OK (Score:2)
The main point that the EFF analysis overlooks is the role of competition in the marketplace. Yes, TC could allow web sites to require you to run particular software; yes, TC could allow vendors to encrypt their data formats making it impossible for you to switch to a new software package; yes, TC could be the foundation for DRM and restrictive licensing.
But the poi
Give them just enough to hang themselves. (Score:2)
The EFF warns that Microsoft's IIS web-server could block web-browsers other than Microsoft's IE. Well,
Re:Give them just enough to hang themselves. (Score:2)
Otherwise, you're full of shit
Neuromancer here we come! (Score:2)
It will only take one vendor doing it, and I'd pay a few extra bucks for my Linux owner override feature to work.
Ice, ice baby.
Trusted computing isn't about your trust. (Score:2)
Whether the content provider is a network admin rightfully protecting the company owned computers on his network. Or microsoft/riaa wrongfully protecting the computer YOU own from copy infringing materials and from things they just don't like even though you have every legal right to do them.
Return to the Dark Ages (Score:2)
1. Make sure that the user is typing at the keyboard, and not another program is doing it. That means, no remote access, no automation, no pretty much any feature that allows users to use interactive software unless it's sitting on the box behind his desk. Yes, one can try to send locally encrypted data blindly ove
Re:EFF (Score:3, Insightful)
Libertarians don't believe in handouts funded by individuals who didn't explicitly and personally agree to provide those handouts. So, say, if money that was taken from me via taxes is being given to the League of Gay Midget Eskimos without my consent, that's a bad thing. I may be more than happy to donate to said League if it were my choice -- but being forced to do it at the risk of men with guns coming and p
If that's what you want... (Score:2)
The problem with the hardware solution that you propose is that it would make free-as-in-
Re:The real problem (Score:2)
Re:The real problem (Score:2)
See, right now... users have lots of authority, but no accountability for what happens on their machines. Send a virus to 50 million people? Got Zombied last month and *still* haven't fixed it? It's a nightmare.
TCP will change that, a lot. Once TCP is implemented, users will have little or no authority over their system's behavior, but all of the accountability for what it does.
Think about it.
Re:Er, Does this work (Score:2)