Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
The Internet Your Rights Online

No More Internet Anonymity 740

inkhaton writes "This Article tells of an Orwellian chip that, once installed in your computer (and not by your choice), will allow any website you visit to "read" your identity. The article goes on to describe how many benefits there are for using this to facilitate online business and even suggests some negative points. It ends with "Ultimately the TPM itself isn't inherently evil or good. It will depend entirely on how it's used, and in that sphere, market and political forces will be more important than technology." ... ugh. Well we all know what that means."
This discussion has been archived. No new comments can be posted.

No More Internet Anonymity

Comments Filter:
  • Real Identity? (Score:4, Insightful)

    by mysqlrocks ( 783488 ) on Wednesday December 14, 2005 @10:17PM (#14260908) Homepage Journal
    Your real identity or someone who used your computer while they were over your house, or someone that borrowed your laptop?
    • Re:Real Identity? (Score:5, Insightful)

      by ArchAngelQ ( 35053 ) on Wednesday December 14, 2005 @10:21PM (#14260934) Homepage Journal
      Or the 3117 haxor who used the latest TMP chip crack to change their TMP ID to be the same as yours, which they got from the worm that still can get installed on your machine...
      • by shoffsta ( 905698 ) <shoffsta@nOSpAM.gmail.com> on Wednesday December 14, 2005 @11:15PM (#14261280) Homepage

        Or the 3117 [sic] haxor who used the latest TMP chip crack to change their TMP ID to be the same as yours, which they got from the worm that still can get installed on your machine...

        Well I've heard of people misspelling words, but who'se heard of somebody misspelling a number? It's called 1337, dude.

        • I think he DID want to say ellt, in leet speech. Maybe I'm mistaken :P
      • Re:Real Identity? (Score:5, Insightful)

        by ArchAngelQ ( 35053 ) on Thursday December 15, 2005 @12:03AM (#14261653) Homepage Journal
        The real point of my above comment was: This system is effectively worthless until the fundimental security issues surrounding general use computers is resolved to a better state. It is likely an unsolveable problem as long as 'computers' remain general use computational tools, as general use includes all of the abilities needed to circomvent even the best security. Perhaps not in a timely fasion, which is what has generally been relied on.

        Implimenting this in hardware means that it's inherintly less adaptable than software. Which means software will be able to adapt around it. Perhaps not in the machine itself, but it's just data out. It should be trivially easy to man in the middle your own outgoing datastream to be able to incorporate any TMP data you want, likely possible even without additional hardware.
    • Re:Real Identity? (Score:2, Informative)

      by Dysproxia ( 584031 )
      According to the article, the identity of the person that last booted the PC. Unless someone else knows the password. Or can fool the fingerprint reader.
    • Re:Real Identity? (Score:2, Interesting)

      by 0olong ( 876791 )
      Not to mention: stolen hardware, secondhand hardware, rerouting/spoofing techniques, etc.

      Identity thieves will have a long field day..
    • Re:Real Identity? (Score:5, Insightful)

      by incubusnb ( 621572 ) on Wednesday December 14, 2005 @10:24PM (#14260967) Homepage Journal
      thats what the Library is for. Unless, of course, it becomes law that all public terminals require a fingerprint or retina scan before use to garantee that the user is known.

      if things keep going this way...

    • by StikyPad ( 445176 ) on Wednesday December 14, 2005 @11:51PM (#14261575) Homepage
      someone who used your computer while they were over your house

      Damn those wi-fliers!
    • Re:Real Identity? (Score:4, Interesting)

      by kamondelious ( 909897 ) on Thursday December 15, 2005 @12:09AM (#14261693)
      Or perhaps all the 1337 h4x0rz will just do what they already do, sniff the traffic, steal some ID's and used them. Why does it matter if this is a TPM or your username and password?

      SSL is pretty secure method for doing web-transactions. It's not perfect, but a TPM isn't going to make things any better. You can still hack around SSL if know how to use google effectively for research.

      Once you know the method for how the server shakes hands with the TPM you can usually spoof it. Not to mention this would be a publicly available process so that all the webmonkeys of the world would know how to build a "secure" site with it. Even if it wasn't readily available to the public, it'd still be like trying to movie or software piracy. Where there's a will there's a way.

      And what this guy said too :
      http://yro.slashdot.org/comments.pl?sid=171227&thr eshold=1&commentsort=0&tid=95&mode=thread&cid=1426 1329 [slashdot.org]

    • Emulators (Score:3, Insightful)

      by mwvdlee ( 775178 )
      This chip is about the easiest security measure to work around of all time: Use a PC emulator which also emulates the TPM hardware.
      It might not make for a very fast computer, but it'll be fast and cheap enough for the average nigerian scammer to invalidate the entire case for the TPM chip.
  • So what (Score:2, Interesting)

    by pHatidic ( 163975 )
    If you don't like it then don't buy it.
    • Re:So what (Score:3, Insightful)

      If you don't like it then don't buy it.

      1) People likely won't know about it, and Joe Average will just buy it with his computer not realizing the problem and risks.
      2) There are only so many hardware providers. What happens when they all carry it? Unless you like build your computers from scrap, you'd be stuck with it. And at some point, they'll just start carrying them on all processors or something. This was made by an alliance of AMD, Hewlett-Packard, IBM, Microsoft and Sun after all. If Intel j
      • Re:So what (Score:3, Interesting)

        by The Warlock ( 701535 )
        Intel is in on it (and has been for far longer than AMD). As are dozens of other companies. NBC simply didn't have room to list them all.
  • My ID (Score:5, Funny)

    by superpulpsicle ( 533373 ) on Wednesday December 14, 2005 @10:19PM (#14260917)
    Aren't we all Testuser from Beverly Hills, CA 90210 at test@aol.com?

  • Good or evil? (Score:2, Insightful)

    Is any technology inherently good or evil?
    • Re:Good or evil? (Score:3, Interesting)

      by incubusnb ( 621572 )
      technology is nuetral, its the people controlling the technology that choose a side.

      i'll garantee you the biggest backing for this technology comes from the RIAA, MPAA and the CIA
  • by Anonymous Coward on Wednesday December 14, 2005 @10:19PM (#14260920)
    Your computer may be broadcasting your IP address to the world as we speak! Or so I've heard.
  • really (Score:5, Funny)

    by robpoe ( 578975 ) on Wednesday December 14, 2005 @10:20PM (#14260930)
    My TPM will have the following information.

    Richard Cranium
    9191919 Nunya Street
    Overstock, MO 64999
    901-555-5555

    And if I can't do that .. then I guess it's back to my C= 64...

  • Question is (Score:5, Insightful)

    by obeythefist ( 719316 ) on Wednesday December 14, 2005 @10:21PM (#14260933) Journal
    This is a lot like the MP3 market -

    We already have systems that work fine without this invasive technology - just like we already have MP3 technology for making nice MP3 files to listen to and download.

    Why then would we pony up more cash or change the way we connect to the internet just for the sake of adopting this new technology?

    These approaches for more DRM and more end-user-ownership by the corps is almost always stick and almost never carrot.
  • Privacy doesn't exist regardless of what "laws" are in place. the Constitution(U.S.A) and Charter of Rights and Freedoms(Canada) has been violated over and over again with little to no reprecussion. Polititians and other people with power use the most important documents in the "free" world to wipe their collective asses with. people aern't voiceing their rights anymore...

    DEMOCARACY IS DEAD!

    wheres the lineup to join the liberation front, its time for a revolution!!

  • duh (Score:5, Insightful)

    by stoolpigeon ( 454276 ) * <bittercode@gmail> on Wednesday December 14, 2005 @10:21PM (#14260941) Homepage Journal
    Ultimately the TPM itself isn't inherently evil or good.
     
    I'd like to hear of any inanimate object that is inherently evil or good. Nuclear bombs aren't inherently evil or good, it's just how you use them. Otherwise they just sit there.
    • Re:duh (Score:3, Insightful)

      by metlin ( 258108 )
      But see, there is a difference.

      A nuke can be used for only one thing - cause destruction. The only positive use it might have is to threaten the other person with destruction. It has been created with the specific purpose and intent of causing mass destruction, and nothing else.

      On the other hand, a tool like this is genuinely built with the idea of being useful. Can it be misused? Yes. Can it be used to cause harm? Yes. But can it also cause good when used right? Yes.

      No matter which way you look at using a
      • by jcr ( 53032 )
        A nuke can be used for only one thing - cause destruction

        Not so. A nuke could also be used for nudging an asteroid off a collision course with the earth.

        Using a nuke is evil. Period.

        I'm glad it was Harry Truman and not you who made that decision in 1945.

        -jcr
        • Re:duh (Score:4, Insightful)

          by intnsred ( 199771 ) on Wednesday December 14, 2005 @11:13PM (#14261269)
          I'm glad it was Harry Truman and not you who made that decision in 1945.

          Why? We're not really going to trot out that rubbish about needing to use nukes against Japan, are we? A few points to consider:

          * Before the US dropped nukes, Japan was already sending out requests for peace through several countries. The sticking point was that the Japanese wanted to keep Hirohito as a figurehead emperor -- the exact same deal the US privately agreed to.

          * Before the US dropped nukes, Japan was so defeated that the US could park battleships off the Japanese coast and shell at will -- without response.

          * The much quoted figure of "1 million" US casualties in the event of a Japanese invasion is sheer fiction. The War Department put the figure at two hundred thousand casualties (horrific yes, but certainly not 1 million).

          * General Leslie Groves, military commander of the WWII Manhattan Project to build an atomic bomb, said bluntly, "There was never, from about two weeks from the time I took charge of this Project, any illusion on my part but that Russia was our enemy, and the Project was conducted on that basis."

          Nutshell summary:

          We dropped nukes on Japan in WWII for two reasons: to see them work in action and, more importantly, to show the USSR that we can and would use them.
          • Re:duh (Score:3, Insightful)

            by jcr ( 53032 )
            We're not really going to trot out that rubbish about needing to use nukes against Japan, are we?

            Depends on your definition of "need". Truman was faced with the choice between using the nukes, or mounting an invasion. His duty was to defeat Japan with the minimum number of Allied casualties. The fact that he saved a lot of Japanese lives as well was a bonus.

            Japan was so defeated that the US could park battleships off the Japanese coast and shell at will -- without response.

            That was the case in the invasi
      • Well, primarily I chose the comparison to make the point you are making. I just didn't spell it all out. This chip is something that would ultimately do more harm than good, as far as I am concerned. That is why I chose to compare it to a bomb.

        But the point still stands, that any inanimate device can do nothing until a human being employs it in some act. A gun, a pen, a car, a pool- you name it, they all just sit there and do nothing until someone interacts with them. Yes it is harder to use so
      • Re:duh (Score:3, Insightful)

        by Vellmont ( 569020 )
        Nice to see such black and white arguments like:

        Using a nuke is evil. Period.

        But then you say....

        unless you're blowing an asteroid out of orbit or something equally improbable

        So it's evil. Period. with the exception for times when it isn't. Either it's "evil. period" or it's not. You don't get to make exceptions. That's what that whole "period" business is about.

        Nuclear weapons aren't terribly usefull, it's true. At one time people were considering using them for mining operations. I believe that turn
    • Nuclear bombs aren't inherently evil or good, it's just how you use them. Otherwise they just sit there.

      But what is their purpose? We cannot simply evaluate things by their inert state. We also have to factor in their reason for being. A gun isn’t made just for the purpose of propelling an object at high velocity in a particular direction (there are superior devices for doing that), it is intended to destroy something as a result.

      This type of thinking might be carelessly superficial in some c

    • I submit to you, in an objective light, you could argue both sides of the question, even for nuclear bombs.

      Obviously one can ruin your whole day, if set off in the wrong place. But bear in mind that a couple of thousand of them have been set off on this planet, to date, and have not destroyed it.

      One could argue that there are "good" engineering uses of nukes (none, to date), and there are bad uses (random atmospheric testing scatting dust around). The one use in wartime (two incidents, one war) is hones

  • by Anonymous Coward on Wednesday December 14, 2005 @10:22PM (#14260942)
    How else will the Anti-Christ keep track of you, and keep you from buying or selling? However, the mark is supposed to be in your forehead or palm of your hand. OK implanted RFID chips then.
  • i like it (Score:5, Insightful)

    by antiaktiv ( 848995 ) on Wednesday December 14, 2005 @10:22PM (#14260943)
    (In fact, with TPM, your bank wouldn't even need to ask for your username and password -- it would know you simply by the identification on your machine.)
    Now the people who break into homes don't have to sift through dirty underwear to maybe find a few crumpled up dollar bills, they can just turn on the pc and transfera couple of bucks into their bank account. Aaah, the modern age.
    • "With a TPM onboard, each time your computer starts, you prove your identity to the machine using something as simple as a PIN number or, preferably, a more secure system such as a fingerprint reader." They'd have to get past this part first (unless people leave their computers on 24/7... which I guess is possible).
  • Pansy article (Score:3, Interesting)

    by alex_guy_CA ( 748887 ) <alex@schoenfTOKYOeldt.com minus city> on Wednesday December 14, 2005 @10:22PM (#14260944) Homepage
    How blandly can someone describe something evil? Well, lets see!

    I'm so mad I can't type. The idea that something can be put into a tool that I buy weather I want it or not, and then we will see if my privacy invasion is good or evil latter makes me want to throttle someone.

    The tone of the article gives me a good idea of who to start with.

    • I think if something like this got forced down our throats, I would not have a problem with every warez, porn and illicit site on the web just constantly making little jabs at the user...

      Having 'bad' sites constantly reminding you that they KNOW that you are who they think you are, I'm sure people would start to object.

      Or are people going to just accept it as the next thing in the line of forever more popups, spyware and trojans??
  • by shanen ( 462549 ) on Wednesday December 14, 2005 @10:22PM (#14260950) Homepage Journal
    Not just this post, but the thread. Actually, I think this is already a 'design feature' of IPv6, and that's coming, too.

    Anyway, I'm not sure there will be any such thing as privacy in the near future. Right now it's already becoming a luxury good, and pretty soon only millionaires will be able to afford it.

    There is a solution, but no guarantee we'll reach it. We need to define an individual's personal information as belonging to that individual, and any use or reference to that information should only be with permission, and based on some good reason. To put actual teeth in such a legal principle, I think it needs to be coupled with a right to store your own information (presumably on your own computer). Without such a basis for protecting privacy... Well, you'd better get use to appearing all over the Internet when you least expect it.

    • by thatguywhoiam ( 524290 ) on Wednesday December 14, 2005 @10:35PM (#14261043)
      There is a solution, but no guarantee we'll reach it. We need to define an individual's personal information as belonging to that individual, and any use or reference to that information should only be with permission, and based on some good reason. To put actual teeth in such a legal principle, I think it needs to be coupled with a right to store your own information (presumably on your own computer). Without such a basis for protecting privacy... Well, you'd better get use to appearing all over the Internet when you least expect it.

      I've been thinking about this; the problem is the legal route to this is pretty much a nonstarter already. But maybe there is a loophole; I think we should all start a church. The Church of the Super Paranoid, or something like that. That way we could cry religious persecution if intrusive privacy-stealing measures are used against us. I'm certain I would have no problem convincing a sizeable chunk of the Slashdot population to swear and affirm (on a stack of punched cards) that their right to crypto and absolute mastery over who sees their porn stash is both vital and indispensable to the very core of their identity. I think it could work.

      At the very least, the crazy fundies will lobby for laws that would help us... :0

      • I'm unclear why you think the "legal route" in particular is a "nonstarter already". In fact, this is actually an extension of several items in the Bill of Rights, and corresponding rights are included in the constitutions and charters of various other governments. If you start with rights against unjustified search and against self-incrimination, then you have to consider the legal ramifications if all of the incriminating information has already been found and placed outside of your control.

        No, I'm not

      • err.. what information would you require for me to jin this chuirch? Are a false name and a false social security nu,ber acceptable? Otherwise I ain't joining!

  • by blueadept1 ( 844312 ) on Wednesday December 14, 2005 @10:23PM (#14260954)
    Tin Foil Router! Limited time! $99.99 with 802.11X! Stop those nasty data packets from going through to the websites you visit! www.x10.com
  • by republican gourd ( 879711 ) on Wednesday December 14, 2005 @10:23PM (#14260956)
    This will never fly, and not for the reasons we would hope for.

    Here are the scenarios:

    1) Chip reports stuff, but data stream is wide open, so middlemen can change whatever they want.

    2) Chip reports stuff, but with shitty encryption so the gov't can still do its wiretaps and echelon won't break. System is hacked within a couple days and the whole 'chip' idea becomes worthless.

    3) Chip reports stuff, but with robust encryption. The site you are talking to knows who you are, but people between you and them can't sniff your actions other than knowing that 'some sort of communication took place'.

    Plus variations. This could actually make webs of trust (a la the direction that Freenet appears to be going) more secure, since you know that your neighbors haven't been man-in-the-middled.
  • Never fear, says the article! The tool of evil is not inherently evil! *Whew* Ok!
  • Old News (Score:5, Informative)

    by TheSpoom ( 715771 ) * <<slashdot> <at> <uberm00.net>> on Wednesday December 14, 2005 @10:24PM (#14260968) Homepage Journal
    But good to see the mainstream press catching up to it. This chip is part of a larger effort by major software developers and hardware manufacturers to mostly stop piracy in all forms and control what you can do with your computer and when.

    Read the TCPA FAQ [cam.ac.uk], and take a look at Against TCPA [againsttcpa.com], an anti-TCPA site if you're interested. For an alternate perspective, you can also view the official Trusted Computing Group site [trustedcom...ggroup.org].

    Personally, I hate it, I don't think it will succeed, and I will *never* buy a computer with such a module installed.
  • by artemis67 ( 93453 ) on Wednesday December 14, 2005 @10:27PM (#14260979)
    Of course, all a hacker needs to do is keep an older model x86 or PPC system around. Obsolete computers are a dime a dozen, and you can keep them running for decades.

    And we are moving closer and closer to disposable PC's, anyway. In less than ten years, I predict that brand new, complete systems will be selling for less than $50. Got my computer's ID? So what, I throw away my computer every month!
    • by Skreems ( 598317 ) on Wednesday December 14, 2005 @10:41PM (#14261074) Homepage
      You could basically even do this today. Most pieces of your system will not be labeled. Presumably it's just the CPU and/or Motherboard that have this ID crap in them. If it's just the motherboard, you can swap that out for $70 every couple months, and anything but top-shelf CPUs aren't that much more expensive.

      The truly ridiculous thing about this is, it doesn't even put a dent in the cybercrime it's supposed to prevent. If you can get your system without giving up your identity (steal it or buy it through someone who "loses" records), and don't report your identity truthfully to anybody while using it, you're still just as anonymous as now. And if they come to get you, you just have to thermite one specific spot on the mainboard as well as the hard drive like you would today. Bam, all evidence gone. And until that day, you're free to molest six year olds and use stolen credit cards to your heart's content.

      There are so many easier ways of preventing these problems than to try to force an ID on everybody. Make one-time disposable credit card numbers a mandatory feature. Consumers will use it because it saves them the hassle of cleaning their credit report after fraud. Hey, look! We can cut down on fraud by creating MORE anonymity, rather than less. Or how about the banks making websites that enforce strong password standards? How about ANYthing except a system that's even MORE transparent to the end user, and thus easier to crack?
    • Of course, all a hacker needs to do is keep an older model x86 or PPC system around.

      And watch it not get an IP once all the major last-mile ISPs have switched to Trusted Network Connect, a framework that involves "trusted" dialer software that assesses the state of your computer using its TPM. Cisco has a similar competing framework called Network Admission Control.


    • The way they plan to force this issue is that after X% of the market is DRM/TCPA-enabled, content providers will start only serving content to DRM/TCPA customers. The first day it'll be like, "Well, I can still use my old-school machine, just not to view CNN.com", and eventually a year or three down the road you won't be able to view any content from any major corporate providers. At least that's the plan. I suspect if they even get that far down the road, the anti-DRM/TCPA public community will largely
  • Pentium 3 (Score:3, Informative)

    by marshac ( 580242 ) on Wednesday December 14, 2005 @10:27PM (#14260981) Homepage
    Sounds like the flopped unique ID that came on the P3 chips... we all know how successful that was.
  • ...if you install Windows and use a bogus name. I did this when I installed WIN2K and my real name appears nowhere in the system, all my accounts are bogus names like Penfold Jackson.
  • by cparisi ( 136611 ) on Wednesday December 14, 2005 @10:31PM (#14261003) Homepage
    I can't look at porn anymore :(
  • by Groucho ( 1038 ) on Wednesday December 14, 2005 @10:32PM (#14261011)
    I suggest we refer to this hardware cookie as a shit biscuit.
  • This is where platform diversity comes into play. Any sane OS like MacOS, Linux, and BSD should never disclose your information without your pemission, period.

    And as for Big Brother taking over the internet, there should be a way to firewall it.
  • will allow any website you visit to "read" your identity

    The only use I could see for this might be in having the xxAA more able to track you down. I mean, it won't stop things like kiddy pr0n etc because (assumedly) the distributors are part of an "in" ring and wouldn't want your ID. Even if they did, most methods of getting them cash (Visa, etc) are pretty trackable.

    It isn't going to be much use to the gov't in tracking who uses slashdot... unless slashdot starts tracking ID. So really, what use is it
  • by OpenMacNews ( 934799 ) on Wednesday December 14, 2005 @10:38PM (#14261060)
    ... selling desoldering stations, tin-foil hats and faraday-cage panic room kits ...
  • Old News. TPM has been around for a few years.
    The site is https://www.trustedcomputinggroup.org/home [trustedcom...ggroup.org]
    For a discussion of some concerns check out EFF at http://www.eff.org/deeplinks/archives/003804.php [eff.org]

    I had an opportunity recently to ask questions of a Microsoft officer who works on strategy and works in Europe. When I described many of the unpleasant aspects of TPM and the like, he said that European privacy laws would prevent the adoption of such policies. I found that to be an interesting viewpoint.
  • I don't understand why there's no choice to having the chip or not, and not just because older computers don't have it. I'm sure there's enough CE and EE people out there who can design and build their own motherboards, without the TC chip, and maybe even sell or give away to others. And if these people are blocked from the internet, what's stopping everyone from going back to the BBS style of things? Phone calls aren't so expensive anymore (not even long distance) so accessing a BBS, or networking BBS' any
  • by femto ( 459605 ) on Wednesday December 14, 2005 @10:44PM (#14261107) Homepage
    So, does the TPM constitute damage, and will the Internet route around it?

    My vote is yes. The Internet will route around it by gradually dividing from what is currently called the Internet. Most people will use what used to be the Internet, and will consider it to still be the Internet. A minority of tech savvy people will be running on an alternative network, and will consider their network to be the Internet.

    There will be one way links between the Internet and the former Internet (new can suck data from old, but not the other way around). The new Internet will be under the radar, but will be a hotbed of technical innovation. In time the new Internet will appear on the radar, as the majority hear of it and decide that they want to be able to do all the neat things Internetters can do as well. The majority join the Internet. The Internet gets 'tamed' as large companies join it. The Internet routes around the damage by breaking away over time. The cycle repeats...

  • What about the plathora of secuirty issues we are faced with today, combine that with a preempted identity management system and you spell disaster.

    It would bring on a new level of phishing one that would be alot more difficult circumvent and alot easier to exploit once the phiser has what he needs from their victims.

    Engineers and techs are very smart people but sometimes they lack the day-to-day vision around the issue.

    Plus, im sure there'll be a bunch of eager hackers waiting patiently for this to come al
  • by humphrm ( 18130 ) on Wednesday December 14, 2005 @11:03PM (#14261201) Homepage
    >ugh. Well we all know what that means.

    Sigh. Yes. Everyone will just sit around slashdot whining about it, and not lift one finger to get control of it via their elected officials.
  • Evil vs. Good (Score:3, Insightful)

    by CupBeEmpty ( 720791 ) on Wednesday December 14, 2005 @11:15PM (#14261283)
    Well I never really considered little yellow cloth stars or number tattoos "good" or "evil" in and of themselves... but you know while we are at it lets brand everyone's social security number on their arm... you know so you can't lie to women at bars about being Leonardo DiCaprio.
  • AMD64 cpu UUID? (Score:5, Interesting)

    by cortana ( 588495 ) <sam&robots,org,uk> on Wednesday December 14, 2005 @11:36PM (#14261463) Homepage

    I was poking around on my new AMD64 machine the other day, and I ran dmidecode [nongnu.org]. Can anyone explain this?

    • Handle 0x0001
      • DMI type 1, 25 bytes.
      • System Information
        • Manufacturer: System manufacturer
        • Product Name: System Product Name
        • Version: System Version
        • Serial Number: System Serial Number
        • UUID: EC491BB3-BE1F-DA11-B1EB-7B871839F7B3
        • Wake-up Type: PCI PME#
    • Re:AMD64 cpu UUID? (Score:4, Informative)

      by stonedonkey ( 416096 ) on Thursday December 15, 2005 @04:03AM (#14262580)
      When in doubt ask Google. [dsps.net]

      Also a a Wiki [wikipedia.org].
      • Re:AMD64 cpu UUID? (Score:4, Informative)

        by Rich0 ( 548339 ) on Thursday December 15, 2005 @08:14AM (#14263219) Homepage
        I'm sure the poster knows what a UUID is in general - however I think his question was whether this was a single code already burned into the CPU/etc, or just a dynamically generated one which could change from time to time. The websites you link have no info relevant to determining this.

        For example, I just generated 3 UUIDs that are all appropriate for my machine using uuidgen - as suggested in the site you linked. Obviously these would not be suitable as unique, unmodifiable IDs for my PC. However, I could safely use them in databases, or to identify objects that I create.
  • by Eminor ( 455350 ) on Thursday December 15, 2005 @02:25AM (#14262347)
    In order for any web site to "read" my identity (assuming the chip is installed), data from the chip would need to be sent over HTTP. So, if you are not using a browser capable of sending it, or your OS does not have a driver to access the device, the device is useless. Not to mention, there is nothing to prevent you from using a browser that supplies false information.

    If this were done purely in hardware, the data would be encoded in the network layer, which means that the data would not leave the subnet (assuming current network technologies used on the internet).
    • by tftp ( 111690 ) on Thursday December 15, 2005 @02:52AM (#14262425) Homepage
      Not to mention, there is nothing to prevent you from using a browser that supplies false information.

      Unfortunately the Universe may grow old and die before you manage to compute a valid data packet without having access to the private key (which is burned into the chip and can't be read back, ever.)

      For example:

      1. Computer says: "My public key is 0x1234...89"
      2. Remote site says: "Ok, dude, mine is 0x9876...01. Do XOR on this data that I encrypted just for you: ... ciphertext follows."
      3. Computer says: "Ok, I decoded the ciphertext using my private key. The data is this, encrypted for you: ... ciphertext follows."
      4. Remote site says: "Ok, you got it right, I reckon you do have access to that private key, and so your public key is also yours, and so you are who you say you are. I trust your data now."

      If you break this sequence then the authentication fails.

  • by KlausBreuer ( 105581 ) on Thursday December 15, 2005 @10:04AM (#14263655) Homepage
    Not? No. Simply because I'll download a patch/update to my browser which will - given the query for the ID - return either any code I entered (for example the id of some damned politician, hehehe) or a new one every hour.

    And these morons will waste a huge amount of time. And, as usual, all they'll catch are other morons.
  • by Dr. Blue ( 63477 ) on Thursday December 15, 2005 @10:17AM (#14263728)
    While the bulk of the article makes it sound like TPMs will destroy all privacy (which isn't true), here's an important sentence:

    Users will still control how much of their identity they wish to reveal -- in fact, for complex technical reasons, the TPM will actually also make truly anonymous connections possible, if that's what both ends of the conversation agree on.

    Yes, TPMs can be used to remove privacy, but only with your consent. They can also, with the consent of the parties involved, give you much stronger privacy than is possible without a TPM.

    I've talked to people in many of the major companies that are behind the Trusted Computing Group, and they're well aware of this issue. I spent a bit of time talking to the head of the trusted computing project at AMD, and he understands very well the lessons of the Intel CPU serial number fiasco of a few years ago, and the TCG has include technological features to protect user's privacy. Is this because they are great privacy guardians? No, I don't think so -- I don't think this guy is going to be the next president of EPIC or anything. I think it's a strictly business decision: They see that people won't accept the technology unless it protects privacy (just see the tone of the article this Slashdot story is about), so they've put in measures in order to make it more acceptable.

    Some technical details: The current TPM specification is version 1.2. Prior to 1.2 there was an "officially supported" pricacy mechanism based around the idea of a PrivacyCA -- basically, you got pseudonymous credentials (a certificate) from a PrivacyCA, and used that in transactions. You could get a different certificate for each person you interacted with, so transactions weren't linkable, or you could even get multiple certificates to use with the same person so that you had different identities to use with them. The problem being that you still had to show your unique ID to the PrivacyCA, so you had to trust them not to link all your transactions together. However, version 1.2 introduced a stronger notion into the standard: direct anonymous attestation. With this, your anonymity is protected with cryptographic means, without the need to trust any other party. Of course, when you authenticate, the site you are interacting with has to agree that it will accept such anonymous and untracable identities. Some sites will probably allow that (discussion boards, etc.) and some probably won't (banks, credit cards, etc.). But that's a market decision, not a technological one. You have the power, with the technology, of having even stronger anonymity than you have today, so the market needs to insist on merchants using that. As was seen with the serial number in the Pentium III, enough people care about privacy to make industry sit up an pay attention.

  • by Temporal ( 96070 ) on Thursday December 15, 2005 @10:27AM (#14263783) Journal
    Imagine if you could create as many identities for yourself as you wanted. You could go so far as to create a separate identity for every single site you visit, even. Imagine that you can program your web browser to invent dummy identities automatically in order to accomplish this. There; privacy issues solved.

    The nice part about this system is that you'd never have to enter a password or a credit card number again, and no one would be able to steal your identity without stealing your physical computer.

Top Ten Things Overheard At The ANSI C Draft Committee Meetings: (9) Dammit, little-endian systems *are* more consistent!

Working...