Ask Slashdot: Best/Newest Hardware Without "Trusted Computing"? 290
An anonymous reader writes "What is the best/newest hardware without trusted computing (TC) / Trusted Platform Module(TPM)? I am currently running ancient 32-bit hardware and thinking about an upgrade to something x64 with USB3, SATA3 and >1 core on the CPU ... but don't want TC/TPM. I have no need to run anything like Blu Ray movie disks or Microsoft Windows that requires TC/TPM or the UEFI boot process. Is anybody else still trying to avoid TC/TPM? What have your experiences been? Any pointers?" Worth reading on this front, too: Richard Stallman on so-called Trusted Computing,.
What? (Score:4, Informative)
Don't buy a TPM module? Just because a motherboard supports it doesn't mean you have to turn it on... or am I missing something?
Re:What? (Score:4, Interesting)
Even if you do turn it on, it only goes about doing what you ask it to do. You can use it to pull some random numbers from, for instance, and completely ignore the cryptographic functions. And neither UEFI or secure boot has nothing to do with TPM. That's completely separate and, on every x86/x86_64 machine I know of, able to be easily run in custom mode with your own keys (and noone else's keys), or disabled entirely.
So if you're being paranoid about this because of fears about spying or remotely taking over your computer... Well, you're being paranoid. If you're scared of that because of TPM, you should be much more scared of that because of not having the complete specifications to rebuild the computer from a hunk of silicon..
Re: (Score:2, Funny)
Let me go scare him some more. Hey check this out: http://en.wikipedia.org/wiki/Intel_Active_Management_Technology#Using_Intel_AMT
*gets popcorn* ;)
Re: (Score:2)
Funny thing, I actually have that enabled on a few of my machines that I use for file storage, etc. Makes it easier to monitor/control them (with a few other tools) than what Microsoft offers on the consumer level.
Re: (Score:2, Informative)
No you're not missing anything. Even UEFI can be turned off on nearly every motherboard out there, my mobo from my new build early this year has UEFI and I could turn it off if I want. Right there in the menu selections. Though most good consumer boards also support TPM as an option. As you said, just don't buy the module. Even the mid-range MSI board I recently picked up supports it.
Re:What? (Score:5, Informative)
Turn off... UEFI...
The fuck? UEFI is a replacement for BIOS; "disabling" it would entail disabling your system's ability to boot at all. Likely what you mean is Secure Boot, which is an optional feature for newer UEFI systems that caused a bunch of stink with Windows 8.
Re: (Score:2)
They still have BIOS. If you turn off UEFI, you use the BIOS.
Re:What? (Score:5, Informative)
No, you don't turn UEFI off. What you do is activate the CSM, which emulates older BIOS calls and maps them to UEFI functionality.
Re: (Score:3)
What you do is activate the CSM, which emulates older BIOS calls and maps them to UEFI functionality.
Kind of, sort of. I have a server with UEFI running a recent Xen and its Dom0 can't access more than 2GB of RAM due to a lack of native UEFI support and the way that BIOS emulation is usually done.
It's a bit of a rough patch right now.
Re:What? (Score:5, Informative)
Exactly.
And it's been a long while since you could get a native BIOS motherboard - it's been (U)EFI since the Core series of processors were first released by Intel. Prior to this, Intel released both BIOS and EFI code for the processors. Since then, it's been (U)EFI only. It's just that since 2006 or so, by default the EFI boots into a BIOS emulator that gives you the BIOS you know and love.
It's only in the past 2 years or so has the actual UEFI interface been accessible to users (other than through an Apple Mac, that is). Intel has provided EFI code since the turn of the millennium, as well, so it's actually older than you think.
Initially, Apple's Boot Camp utility installed the BIOS emulator on early Macs because they shipped without it and thus couldn't boot Windows. Later Macs have it baked into the firmware and you can just boot it directly. Hell, Apple even slipstreams the drivers into the OS image now so you don't have to install afterwards.
Linux has supported EFI boot since I don't know when. IA-64 (Itanium) definitely, but it got ported to x86 a long while back too. Of course, you could really only use it on a Mac until recently...
Re:What? (Score:4, Insightful)
I must be getting old. I actually remember a time when /. had at least somewhat technically savvy people.
Re:What? (Score:5, Insightful)
No, it's you missing something.
just don't buy the module.
THAT IS EXACTLY WHAT HE'S TRYING TO DO.
A lot of computers are now being shipped with TPM's SOLDERED onto the motherboard, and they are making progressing on packaging the TPM inside the CPU chip.
He doesn't want to buy that crap, I don't want to buy that crap, and the problem is that a lot of people are buying that crap without knowing it. The Trusted Computing Group has stated that part of their strategy for forcing everyone to buy into their Trusted Computing crap is to ensure that TPMs are already built in to all new computers being sold.
-
Re: (Score:2)
In what ways does it matter for me?
Software calling home?
Well, except I guess someone earns money on me buying something with support for it.
Re: (Score:2)
Every motherboard I've bought in the last 4 years has had a TPM space on it.
It still didn't come with one. Just a slot to plug one in. I didn't buy a TPM, my computers don't have them....
Re: (Score:3)
A lot of computers are now being shipped with TPM's SOLDERED onto the motherboard
Well no. You're going to be pretty hard pressed to find any consumer level, even business level machines with a soldered in TPM module. They're meant to be replaceable if they fail.
Re:What? (Score:4, Informative)
I wanted a TPM too and I ended up with the HP8560w laptop. A bit pricey for a hardware encryption chip, but not as expensive as a few years ago.
Re: (Score:2, Informative)
Even UEFI can be turned off on nearly every motherboard out there, my mobo from my new build early this year has UEFI and I could turn it off if I want. Right there in the menu selections. Though most good consumer boards also support TPM as an option.
This is only half-true. I have disabled UEFI boot on my ASRock Z68 Extreme3 Gen3, but when attaching a USB mass storage device, there is still a substantial delay if it is a mechanical drive while it searches for bootable partitions. This behavior shouldn't happen if UEFI is truly disabled -- and this behavior is unique to UEFI motherboards. If boot from USB is disabled on pre-UEFI motherboards, this does not happen.
As well, I cannot prevent UEFI firmware from being loaded from devices; I can only set a pre
Re: (Score:3)
As well, the TPM module in most motherboards cannot be disabled.
The TPM in most motherboards cannot be disabled because it was never installed in the first place. If you built the machine yourself, read the fine print on your motherboard box, there's about a 99.9% chance you have "TPM support" in the form of an unpopulated header, not an actual TPM.
Re: (Score:3, Informative)
1) "girlintraining" is a "dude"
2) GPS usage in every cellphone I've seen drains battery fast. I don't care what can be designed--the reality is GPS receivers in phones do drain battery fast
3) girlintraining has plenty of good constructive input, and it's very welcome here. That doesn't mean she's been right in every one of her posts, in fact, I've had a few horribly inaccurate posts of my own, as nearly everyone does.
Yes, I know I just fed the troll, but I felt it needed to be said, if
Re:What? (Score:4, Informative)
Don't buy a TPM module? Just because a motherboard supports it doesn't mean you have to turn it on... or am I missing something?
It's pretty much impossible to get a new system with any reasonable compute ability without at least some form of back doored TPM-like facility these days. For example, the new Intel Ivy Bridge Chipsets have vPro, which gives similar capabilities. Likewis, the new AMD systems currently being planned have the ability to run TZones in the on-board ARM processor to implement a software TPM, as long as they aren't exposed out directly.
http://www.hardwaresecrets.com/news/Intel-Launches-Ivy-Bridge-CPUs-with-vPro-Technology/6464 [hardwaresecrets.com]
http://newsroom.intel.com/community/intel_newsroom/blog/2012/05/15/intel-strengthens-security-boosts-performance-for-business-with-3rd-generation-intel-core-vpro-platforms [intel.com]
Re:What? (Score:4, Interesting)
vPro requires a fair amount of setup to use, so claiming that it's going to backdoored is really just silly.
You failed to read my first link.
"Intel's vPro technology provides IT managers with a collection of security and manageability features, including remote access to the PC independent of the state of the operating system or that of the computer's power. The newest vPro processors include an identity protection technology with public key infrastructure (Intel IPT with PKI), which provides a new second layer of authentication embedded into the PC that allows websites and business networks to validate that a legitimate user is logging on from a trusted PC by using a private key stored in a PC's firmware."
So it allows remote access to the machine using a remote access facility built into firmware, and for which source code is not provided by Intel to allow it to be audited by an independent third party.
For "websites and business networks", read "media distribution companies intent on renting you something instead of selling it to you, even though book licenses are why we started granting media companies copyrights in the first place", i.e. it was in trade for them not being assholes, but now they are back to being assholes, and have lobbied legislators like Pelosi and Feinstein to get the DMCA passed, and criminalize a civil matter.
I'd rather my machine not identify me in a non-repudiable way to a remote attacker of my Article 12 rights under the U.S. Constitution, thanks.
Re: (Score:3)
Re: (Score:3, Insightful)
Yawn. Obsolescence built in, with each OSX "upgrade" Apple drop support for a whole generation of hardware. Quad core xeons are now in limbo. Yes, that standard Intel and PCI system is already at a dead end. When the next cat OS is released with a slightly changed icon set, the next top end systems will be excluded.
And as for imacs, zero upgradability other than RAM and high failure rates, also suffer from OSX obsolescence.
So, no, don't go down the Apple route unless you intend to replace the whole system t
Re: (Score:2, Informative)
Yawn. Obsolescence built in, with each OSX "upgrade" Apple drop support for a whole generation of hardware. Quad core xeons are now in limbo. Yes, that standard Intel and PCI system is already at a dead end. When the next cat OS is released with a slightly changed icon set, the next top end systems will be excluded.
And as for imacs, zero upgradability other than RAM and high failure rates, also suffer from OSX obsolescence.
So, no, don't go down the Apple route unless you intend to replace the whole system to stay current, even if it doesn't need it.
My 2008 MacBook is still receiving upgrades, and will get Mavericks. Upgraded the ram to 8gb and I'm doing just fine.
Re: (Score:2, Insightful)
Are you seriously trying to talk sense to AC? Do I have to revoke your cred...? Don't make me give you this talk again! :)
Re:get a mac. (Score:5, Insightful)
Are you clueless? He's not "talking sense". The whole point here is that it's becoming increasingly difficult to not-buy a TPM. A lot of motherboards now have this shit welded in place, and its presence is often not listed when you're shopping to buy a computer.
An "Ask Slashdot" on how to avoid purchasing Trusted Computing is entirely appropriate. Hell, there should be a goddamn front page story in the New York Times telling people that many computers are being shipped with TPMs, and informing the general public where to shop if they don't want to fork over money for an anti-owner TMP chip pre-welded into whatever computer they buy.
-
Comment removed (Score:5, Interesting)
Re: (Score:3)
The reason is that Apple dropped devices that couldn't book a 64bit kernel. I suppose they could have released a new EFI, but they didn't.
Re: (Score:2, Redundant)
Re: (Score:2)
It's ridiculously easy to upgrade the Mac Pro's to Linux. No need to worry about what Apple's floundering bunch of Steve Jobs wannabees do from then on.
Re: get a mac. (Score:2)
So, no, don't go down the Apple route unless you intend to replace the whole system to stay current, even if it doesn't need it.
That's what you have to do with cars, it's unreasonable to expect that you can swap out the engine. No "consumer" has any idea how to swap out a engine, let alone a CPU. As a professional I sometimes lament that I can't hack my equipment, but seriously, get real. No one is forcing you to upgrade, the software doesn't expire. I have a CNC mill running Windows 95 and TurboCNC just fine thank you.
Re: (Score:3)
Yawn. Obsolescence built in, with each OSX "upgrade" Apple drop support for a whole generation of hardware. Quad core xeons are now in limbo. Yes, that standard Intel and PCI system is already at a dead end. When the next cat OS is released with a slightly changed icon set, the next top end systems will be excluded.
Yawn indeed. If all that's changed is the icons, then why do you give a fuck? You obviously don't need it. Each new OS is designed around the new hardware available, with features that are only possible with that hardware. There has to be some level of obsolescence. I agree that it could be longer, e.g. supporting older graphics sets would be a start, but running older versions of the OS is not really a problem. Apple is pretty good about security updates, Java upgrades, etc. for older OSs.
And as for imacs, zero upgradability other than RAM and high failure rates, also suffer from OSX obsolescence.
So, no, don't go down the Apple route unless you intend to replace the whole system to stay current, even if it doesn't need it.
Double yawn
Re: (Score:3)
My Core-2 Duo Macbook is EOL at Snow Leopard, but I'm fine with that. In fact I'm still running Leopard on it, since I want to do a clean reinstall instead of an upgrade but haven't made time to do it. Besides, once I upgrade to snow leopard I won't be able to run the "AirPort Admin Utility for Graphite and Snow.app" to admin my original Airport base station.
I don't understand the whining about 'planned obsolescence'. My gear continues to run just like when I bought it. Besides, I consider many of the "e
Re: (Score:2)
It's Core, not Core2 that's obsoleted and it should still run Lion...
Re: (Score:3)
mean while, you can run Windows 8 on any Pentium 4.
Re: (Score:3)
mean while, you can run Windows 8 on any Pentium 4.
Meanwhile, if I write software targetted at MacOS X 10.7 or later, I can safely rely on the user having a 64 bit processor. No 32 bit versions needed anymore.
Re: get a mac. (Score:5, Informative)
mean while, you can run Windows 8 on any Pentium 4.
Actually no you can't. Windows 8 unlike Windows 7 requires PAE, NX, and SSE2. NX was introduced into later Pentium 4 Prescott models, but not earlier Willamette and Northwood models. Win 8 Betas did run on these platforms, but RTM will refuse to install on them.
Re: (Score:3)
If your goal is to run Windows and/or Linux, you'd save a lot of money by not buying a Mac.
Non sequitur (Score:4, Insightful)
I have no need to run anything like Blu Ray movie disks or Microsoft Windows that requires TC/TPM or the UEFI boot process.
Non sequitur much? What do Blu-Ray movies have to do with a TPM or UEFI secure boot? Also, Windows 8 can be run just fine without UEFI secure boot and doesn't need a TPM. UEFI secure boot is only needed to sell a certified product. Trying to drum up some FUD or what?
Re:Non sequitur (Score:5, Insightful)
You might be overreacting; english has extremely loose parsing rules. Try reading it like this:
I have no need to run anything like ( ( Blu Ray movie disks ) OR ( Microsoft Windows that requires TC/TPM or the UEFI boot process) ).
No kidding (Score:3)
Also not only does Windows 8 not need secure boot, it doesn't even need UEFI. You can run it on a system with a BIOS, or on a UEFI system in BIOS emulation. My desktop is set up like that. My motherboard had some issues with UEFI boot as well as my video card, so BIOS mode it is. My laptop did not, so it is UEFI boot (it is faster) though without secure boot, it is just regular ass UEFI boot.
I swear these paranoid types need to spend a bit of time getting their learn on about new technologies before whining
Re:No kidding (Score:5, Informative)
Also not only does Windows 8 not need secure boot, it doesn't even need UEFI...
I swear these paranoid types need to spend a bit of time getting their learn on about new technologies before whining about them....
The amount of knee-jerk that goes on with this shit is pretty amazing.
Quoting fucking MICROSOFT.COM News Center: [microsoft.com]
"Trustworthy hardware. The Trusted Platform Module is a hardware security device or chip that s a great tool for the enterprise, but until now has been an optional piece of technology for consumer devices. TPM provides a number of crypto functions, including securely storing keys and performing cryptographic measurements. We re working to require TPM 2.0 on all devices by January 2015"
You're seriously going to call me "paranoid" when Microsoft has an official public statement that they plan to make this Trusted Computing shit mandatory starting less than a year and a half from now?
Over a half-billion computers have already been shipped with this shit welded to the motherboard. THAT'S why the Ask Slashdot story is asking how to avoid this shit. A lot of computers already come with this shit on the motherboard, and not all of the sales materials list that it's in there.
-
why? (Score:2, Insightful)
ThinkPenguin.com's against trusted computing... (Score:5, Informative)
I'd get in touch with ThinkPenguin. The company avoids trusted computing, non-free dependencies, and other digital restrictions that are bad for users. HP, Lenovo/IBM, Dell, Toshiba, Sony, and Apple are enemies of user freedom and should be avoided. They ship systems with digital restrictions and/or propitiatory pieces that prevent users from replacing things like the wifi in what is otherwise a standard slot. As a result if you get a system with a unsupported wifi card you can't replace it- or in other examples eventually move to a distribution that is 100% free like Trisquel or Parabola GNU/Linux.
ThinkPenguin's been working with the free software foundation on various issues like USB wireless cards and other projects. They helped bring a new chipset to the free software community (ar9271 and the older ar9170). They also don't ship parts/computers dependent on non-free drivers/firmware. The only real exception is the BIOS. That might change if the company gets enough support. Right now it is a non-trivial and significant task to fix. Particularly when every user wants a different configuration and demands the absolute latest in specs (like Haswell for example).
Re: (Score:3)
What, I've Frankensteined plenty of Lenovo machines in my time.
Re:ThinkPenguin.com's against trusted computing... (Score:5, Funny)
I would like to welcome the marketing department of ThinkPenguin (C)(TM) to slashdot.
Re: (Score:2)
pieces that prevent users from replacing things like the wifi in what is otherwise a standard slot. As a result if you get a system with a unsupported wifi card you can't replace it.
[Citation fucking needed]
Please, show me the special proprietary WiFi slot in Dell's latest $299 standardized-to-an-inch-of-existence system that only sends and receives electrical signals from Magical Dell WiFi.
Re: (Score:2, Interesting)
The issue for Lenovo (I don't know about Dell) is that the BIOS has a whitelist of approved cards for those internal slots and if you plug-in a card not on the list the computer won't boot. However, Lenovo doesn't sell laptops with unsupported cards so you'll only see the issue when you try to manually upgrade it (and how many users do that?). For the power users who do open the case to upgrade, there's modified BIOSes that remove the whitelist. And before you start saying how bad Lenovo is for blocking
Re:ThinkPenguin.com's against trusted computing... (Score:4, Informative)
you didn't hear about IBM/Lenovo requiring you to use *THEIR* wifi cards in the laptops? A non-IBM braneded but exactly the same model, wouldn't work because the BIOS checks for it. Pretty widely reported here on slashdot.
I agree with anonymous coward (Score:4, Insightful)
Re:I agree with anonymous coward (Score:4, Insightful)
actually Vista allowed it to be dis/enabled in the device manager - making it immediately available w/o a reboot. The same is true of Win7/8 and later - just like wifi cards can be dis/enabled from the device manager w/o rebooting the system.
Since this is possilbe, it means it's possible to do so w/o user interaction. Making a TPM module a dangerous thing to have on your system.
Not this shit again (Score:3, Informative)
The story about the TPM was a load of horseshit FUD. TPMs are good if you want secure crypto key storage. If you don't, use a tinfoil hat.
"Secure boot" is the thing you want to avoid if you're suitably paranoid.
Buy it, turn it off (Score:4, Insightful)
Just buy it with TPM and turn it off. It's just like 3D televisions--it's a permanent addition to the feature list, regardless of how many people actually want or use it. Yeah it sucks that you pay for stuff you don't use. I'm sure you'll survive the experience.
And if you're paranoid that turning it off won't REALLY turn it off, how do you know a motherboard without a TPM module doesn't REALLY have a super-secret disguised TPM module? If you're that paranoid, you'll have to build the motherboard yourself.
Why? (Score:5, Insightful)
TPM is just a secure hardware keystore. It allows you to store secret keys in it. Don't want it? Don't activate it.
It is most commonly used in corporate machines, but can be used in Linux to support LUKS for full-disk encryption.
As usual, people fear what they don't understand. The trick to TPM is *WHO HAS THE KEYS*. If *I* have the keys, it is a great feature. TPM itself isn't inherently bad any more than any safe is inherently bad.
Stallman's piece focuses exclusively on TPM being implemented as a mandated piece where either the gov't or the media industry has the keys. Focusing on one theoretical use case and determining the entire system is evil is just plain wrong.
Re: (Score:2, Interesting)
Stallman's piece focuses exclusively on TPM being implemented as a mandated piece where either the gov't or the media industry has the keys. Focusing on one theoretical use case and determining the entire system is evil is just plain wrong.
Yeah, and theorizing that the Big Brother really IS watching over you just because it's theoretically possible is a just plain wr-oh, wait, that actually did happen because the people in power can be expected to abuse any technology available to them if we just turn a bli
Re: (Score:2)
LOLwut? Every business laptop I've seen since 2006, and most workstations, have TPMs. These are used by companies with far more need for data security and tight IT restrictions than you can imagine. People who know what the fuck they're talking about (i.e. maybe 50% of the people in this discussion, the OP of this thread is one, the submitter is not) don't have any problem with TPMs because to them it's either a useful tool or an unneeded BIOS/EFI option that ships disabled by default, much like support for
Re:Why? (Score:4, Insightful)
Stallman's piece focuses exclusively on TPM being implemented as a mandated piece where either the gov't or the media industry has the keys. Focusing on one theoretical use case and determining the entire system is evil is just plain wrong.
Both scenarios are more or less "theoretical", but the most likely to end up widely implemented is exactly the one RMS focuses on. That is why he focuses on it. It's also the reason why the entire thing came into being. The other stuff is a nicety for the geeks, nothing more. That nicety doesn't make the purpose behind it less wrong or evil.
Re: (Score:2)
Hardly "just for geeks" at all, actually (or, less politely, "bullshit"). Pretty much all large companies, and many small ones, require disk encryption. Many disk encryption utilities make use of TPMs (even on Linux, as the OP points out). This is already a widely-deployed use of the TPM technology.
Meanwhile, Stallman sounds off about potential evil things that it could be used for, things which there's absolutely no sign of people even working on developing. You compare a hypothetical use case to one that
Re:Why? (Score:5, Insightful)
"Stallman's piece focuses exclusively on TPM being implemented as a mandated piece where either the gov't or the media industry has the keys. "
Not quite, the same way F2P games and always online DRM made it so far. Most people are tech illiterate, all that's needed to get TPM out there is a dumb public and some widget they will always buy mindlessly like phones. I expect phones and/or some aspect of videogames to be where TPM is first implemented. The upper classes in america are obsessed with manipulating the public mind for their own corporate profits. I suspect there are people working right this moment to find a way to push more hardware DRM and legal bullshit. I imagine we'll first see this from the game industry and then it will seep into other industries.
The idea that Stallman is 'alarmist' given how dystopian, authoritarian and anti-freedom american copyright and patent law has become and its negative effect on people owning the digital products they buy is already cause for alarm. The fact that digital goods are effectively infininite and people are talking moronically about selling 'used digital games' (bizarre aspect of american capitalist thinking in the non scarce digital world).
See this article, game developers and publisher are seriously totally in bizarro world trying to get rid of the used game market.
http://www.gamasutra.com/blogs/DanRogers/20130806/197733/THE_FUTURE_OF_RESELLING_DIGITAL_VIDEO_GAMES.php [gamasutra.com]
Re: (Score:3)
The fact that digital goods are effectively infininite and people are talking moronically about selling 'used digital games'
While physical goods are inherently limited, digital goods can be limited artificially.
For instance:
1) the only reason the phoenix mount in WoW has value is that it's hard to get and people want it. Blizzard could make the supply endless, but chooses not to.
2) Furthermore, the reason items have significant value in Eve Online is that developers manage an economy which artificially limits supply.
3) Similarly, "cold hard cash" is limited in "real life" in the same way.
The government could easily
Re: (Score:2, Insightful)
"Don't you have some OWS picketing to do?"
Are you a butthurt right wing american, who politicizes and incorrectly interprets any factual information as an attack on your ideology? Look intelligent adults are capable of discussing important issues and not getting offended at the drop of a hat because they are paying attention to and research the corruption in the world at large, both in governments and corporations. I know reality tends to offend those who yearn for a simple worldview and believe the world
Re:Why? (Score:5, Informative)
As usual, people fear what they don't understand.
I've studied the entire TPM technical specification. I understand it in minute detail.
The trick to TPM is *WHO HAS THE KEYS*. If *I* have the keys, it is a great feature.
EXACTLY!
And the entire point here is that you DON'T have the keys. The TPM technical specification is quite explicit that the owner of the computer is FORBIDDEN to ever get his keys. Specifically this means the PrivEK (Private Endorsement Key) and the SRK (StorageRootKey). The owner is forbidden to have his StorageRootKey, because the StorageRootKey is explicitly designed to encrypt data on the harddrive such that the owner of the computer cannot read or alter it. The owner is forbidden to have his Private Endorsement Key because this key is used to secure the Remote Attestation process against the owner. Remote Attestation is where the chip securely (secure against the owner) securely tracks your hardware and the software you run, and sends that spy-report out to other computers over the internet. If the owner had his Private Endorsement key, these Attestation spy-reports wouldn't be secure against the owner.
TPM is just a secure hardware keystore.
It's more than that, but an important part of it is that it's a "secure hardware keystore". Specifically, it is designed to be SECURE AGAINST THE OWNER. The Trusted Platform Module Technical Specification explicitly refers to the owner of the chip as an attack-threat which the chip MUST be secure against.
Stallman's piece focuses exclusively on TPM being implemented as a mandated piece where either the gov't or the media industry has the keys.
The "Master Keys" are held by the Trusted Computing Group. The crucial individual keys are locked inside the Trusted Computing chips, secured against the owners.
Focusing on one theoretical use case and determining the entire system is evil is just plain wrong.
Lets make it really simple. The moment they give owners some option to read their keys out of the chip, or give owners the option to buy chips that come with a printed copy of they keys, then I will jump up front and center proclaiming that Trusted Computing is wonderful and harmless... I'll lead the charge smacking down anyone claiming it's evil.
However the Trusted Computing Group has explicitly refused all demands for any sort of "Owner Override" and explicitly forbid owners to ever get a hold of their own keys. That is because the entire point of Trusted Computing is to secure computers AGAINST their owners. The entire point of Trusted Computing is that "Owners can't be trusted", so they want to be able to "Trust" computers to be secure against the owners.
The moment they allow owners to get their keys then I agree that the owner is in control.
Note that the standard argument against allowing owners to get their keys is that a virus or malware or something might get a hold of the key if it's accessible from the chip, or if it's on the harddrive anywhere. Which is a patently bullshit argument for refusing to let me buy a chip with a PRINTED COPY of my master keys. Malicious software can't read paper. End of argument. Then I can toss the printed keys in my safety deposit box at my local bank, and you can't make any believable argument that it's somehow "for my security" that you're refusing to let me get my own goddamn keys.
A simple rule for everyone:
Just say "I want my keys", NO KEYS, NO SALE
-
Re: (Score:2)
Excellent post. Clear, thorough, and informative. Thank you.
Ok then TURN IT OFF! (Score:3)
That is the point all you TPM-ranters seem to be missing: It is 100% optional to use. In most cases I've seen, it is off by default because people just don't give a shit about it. On my system I go and have a look in device manager and, oh look, there's no "Security Devices" category, which is where the TPM appears if it is turned on. My board either shipped with it off, or without one (I haven't bothered to check in the BIOS) and it is a new Z77 board.
I could see the issue if this was being required, but i
Re: (Score:2, Insightful)
Nobody cares that you can turn it off. It shouldn't be there in the first place. That's the point of the TPM-ranters, which you seem to be missing.
The big evil issue is not what it is today, but what it will (rest assured) soon become. When that day comes you can look back at your open embrace of TPM with a sad face and say "If I'd only known". We on the other hand will simply say "we told you so and you did nothing".
Good luck clawing back the computer freedom you gave up.
Re: (Score:3)
It shouldn't be there in the first place.
Sure it should be. Here's one example: If I have Intel Anti-Theft (AT) Technology, TPM and encryption my data is very well protected.
If my computer is out of my control I can lock down the hardware with Intel AT. If the encryption key is in the TPM then no one can put the drive in another machine and decrypt it even if they know my password.
There are lots of good uses for TPM if you remove your tinfoil hat.
Re:Ok then TURN IT OFF! (Score:4, Insightful)
It doesn't have to be outside my control. It only has to be outside of my laptop's control, which is a crucial difference.
A TPM that came with my keys printed on a piece of paper, and which would allow me to replace the keys it uses would do just fine for what you say.
Re: (Score:3)
Re: (Score:3)
I don't want to turn it off. I want not to have it. I want it this way so that I can't possibly be counted as part of the TPM market share.
Besides, once it's there, it's trivial to remove the option to disable it, so the option likely won't be stay there for long, once it's widely distributed enough.
Re:Ok then TURN IT OFF! (Score:4, Informative)
There's lots of screaming about it, that is backed up by a big lack of knowledge about it.
I've studied all one-hundred-plus pages of the TPM technical specification. I know how it works in detail.
It really seems like something that some people just want to be a big evil issue so they pretend it is.
At one point the TPM technical specification explicitly names the owner of the computer as a potential "attacker", and explicitly states the chip must be secure against the owner. And in about a hundred places it endlessly mandates that the chip is forbidden to allow anyone, which includes the owner, to ever access the master keys.
I could see the issue if this was being required, but it isn't.
Microsoft has declared they plan to make it mandatory starting less then a year from now.
-
Wish I could mod this to +6 n/t (Score:2)
no text
Re: (Score:2)
The whole point of the TPM is that once secret keys are installed, they can't be removed -- by anyone.
By taking ownership of the TPM unit, a new SRK is created, unique to the system. It is ensconced in the TPM chip and there it shall stay. That is the point -- securing the private key.
The keys created in the TPM are supposed to be unique to the system -- not something you wander around with. They are irrevocably tied to the system. That is the entire point.
As long as the TPM_EK is generated internally to th
Re: (Score:2)
Malicious software can't read paper. End of argument.
it wouldn't have to if you were to actually use those keys.
if the platform is to be trusted the keys have to be secret, period. the only question is who needs this level of trust. there are plenty valid usecases for this, maybe even in the public interest, but all are closed, specific systems. it definitely has no place in general consumer devices. i can only think of 2 usecases for this: totalitarian control or good old vendor lock in going high, and fuck both.
Re: (Score:3, Interesting)
I've studied the entire TPM technical specification. I understand it in minute detail.
I don't doubt you've looked at it. But clearly you've looked at it from the perspective of how you think it impinges on your liberty rather than from the perspective of a security engineer trying to achieve simple properties such as executing code that isn't manipulated by an attacker. That's fine, that's the perspective I expect most slashdotters to be coming at it from. But I'm pretty encouraged by how many people in this thread have pushed back ag
Re:Prove you're right: Show me how to get my keys (Score:4, Informative)
Help me judge which of you is right.
Alsee says I can't have the keys to the TPM which comes with the computer I buy. You disagree with Alsee.
No, he explicitly agreed with me on that point:
I said: "The TPM technical specification is quite explicit that the owner of the computer is FORBIDDEN to ever get his keys"
He said: "Forbidden from getting them out of the TPM"
That's agreement.
He merely followed up with a lame explanation "not forbidden from using them in ways that allow for guaranteeing security properties". The Trusted Computing definition of "security properties" explicitly includes security against the owner. "Guaranteeing security properties" means you are unable to read or alter your own files in Sealed Storage [wikipedia.org]. An example "security property" would be that you cane read (and run) a Sealed-Storage program without securely verifying that the date it is within the approved software-rental period. Or think DRM music file, the "security property" is that the chip won't let you play the music except with the approved DRM-music player, and only if it decrements the number of plays remaining in the pay-per-play count.
It also means enforcing the security of Remote Attestation [wikipedia.org], which in plain English means a cryptopgraphically secure "spy report" sent out to other people over the internet telling them exactly what software you are running. For example if you had your master keys you could tell a website that you aren't running an ad-blocker when you actually are. That would violate the anti-owner "security properties".
That's why your forbidden to have your keys.... then other people could not Trust that your computer would enforce anti-owner "security properties" against you.
Standard line argument is that it's all A-ok because it's all "opt-in". If you don't "opt-in" all "security properties" are still enforced against you, enforced in the sense in that nothing works (you can't violate security if nothing works and you can't do anything). If you don't "opt-in" you're denied any ability to read or modify Trusted-secured Files, if you don't "opt-in" you're denied the ability to run Trusted-secured programs at all, if you don't "opt-in" you won't be able to access websites at all if they use the Trust system to ensure you don't copy pictures or to check if you're running an ad-blocker. And if you don't "opt-in", then in a few years you might be denied internet access. The Trusted Computing group has created something called Trusted Network Connect, and Microsoft has an equivalent version called Network Access Protection. That's a system where a network (or your ISP) can ask for a Trusted Health Check. A "Health Check" is that spy report I mentioned before, it reports the exact software running on your computer. The "Health Check": ensures that you're not infected by a virus(*), and ensures that you're running an approved operating system with ALL of the mandatory patches, and enforces that you're running any mandatory "security software" they want you to run, and that you're not running anything they don't want you to run. And if you don't "opt-in" then you can't pass the "Health Check", and your computer is "quarantined".... no network access access. Obviously no ISP could ever deploy something like that.... not unless most customers already had Trust Chips in their Computers.... oh yeah Microsoft is making Trust Chips mandatory in all new PC's 16 months from now. But even then it would obviously be several more years before most people had Trusted PC's, before ISPs could deploy that sort of "Trusted Health Check" to get internet access. But don't worry, this is all a good thing.... it's just a Health Check.... to ensure you're not infected and spreading viruses
As he explained, there's nothing evil about the system.... they
Re: (Score:2)
The NSA could just get Intel and AMD to include backdoors in their chips/chipsets, if you want to go down that route.
and I want a pony. (Score:2, Insightful)
I am currently running ancient 32-bit hardware and thinking about an upgrade to something x64 with USB3, SATA3 and >1 core on the CPU ... but don't want TC/TPM.
You want to buy a high performance x86 motherboard which for some unfathomable reasons lacks features that have become more or less standard in both the consumer PC and the enterprise markets like UEFI and are not going away any time soon. Good luck with that,
My Asus Z78-Pro seems to work fine.... (Score:2)
I've got two different systems running Arch using these boards. One of them is booting in traditional BIOS mode, and when I turned off the secureboot and followed Arch's UEFI installation procedure, I got the second one booting with UEFI just fine.
TPM often left off (but can work FOR you). (Score:4)
TCM/TPM is often a business only feature. Consumer motherboards *frequently* don't support it. But full disk encryption programs can, and some do.
In other words, yes, you can totally opt out of buying a motherboard with TPM, including a top-of-the-line Haswell motherboard or an AMD chip, if that's your fancy. But if you buy one, you can also use it as a layer of security for a product like TrueCrypt (I do not know if TrueCrypt specifically supports it, that's just an example). And if you don't want it, you can turn it off.
Re:TPM often left off (but can work FOR you). (Score:4, Interesting)
TCM/TPM is often a business only feature.
That was the initial market, but the Trusted Computing Group is quite clear that they intend, as soon as they can manage it, for it to be included in all computers. And they are well on their way to achieving that. They are already included in almost all laptops, and they are increasingly showing up in desktops.
In other words, yes, you can totally opt out of buying a motherboard with TPM
The entire point of the Ask Slashdot is that it's becoming increasingly difficult to do so. More and more computers are being shipped with the TPM soldered in place, and without the product description mentioning that fact anywhere.
-
Re: (Score:3)
But *no* consumer board I'm aware of ships with the *chip.*
Then you obviously haven't been paying attention. Almost all laptops are now shipping with TPMs, and they are increasingly being shipped in desktops. When I was shopping for a PC last year I spotted TPM listed in several system specification lists from different major PC vendors.
According to the Trusted Computing Group [trustedcom...ggroup.org] more than a half billion PCs have already shipped with the Trusted Platform Module. Computer Weekly [computerweekly.com] puts it at over 600 million PCs.
And according to "ZDNET "In January 2015, TPM 2.0 will be r
Stallman (Score:2, Insightful)
Stallman is never "worth reading".
Re: (Score:2)
Already commented on this thread, but +1 insightful. Just because Stallman is blind to things outside his zealotry doesn't make him stupid, and he frequently raises valid concerns. Sometimes, they even turn out to be justified. It's as wrong to assume his conclusions are inaccurate as it is to assume they're accurate. It's foolish to ignore him altogether.
However, when reading what he says, do bear in mind his selective blindness and known biases. In fact, do that for everybody. There's hardly anybody out t
Mac? (Score:3)
Buy an Apple computer? They haven't had TPMs of any sort for a long time, near as I can tell from the literature.
Re: (Score:2)
I've been an Apple user for over a decade, and haven't found a need to open one up other than to increase memory or replace a hard drive.
Other people's mileage will, of course, vary, but the vast majority of folks don't need to tinker inside their machines (and in fact their lives would be so much simpler if they stopped).
I avoid it... (Score:2)
By disabling it in the BIOS, or if that's not an option, don't install the driver. And since when do Blu Ray discs and Windows need the TPM to be enabled to run?
If Windows isn't necessary... (Score:2)
OTOH, an example of FOSS that uses TPM (Score:3)
Anti Evil Maid is an implementation of a TPM-based static trusted boot with a primary goal to prevent Evil Maid attacks.
http://theinvisiblethings.blogspot.com/2011/09/anti-evil-maid.html [blogspot.com]
TPM - Its never there (Score:5, Informative)
TPM requires (for Intel) support from the CPU - and some consumer level CPUs (notably the K series) lack that support. The extremely common 3570K for example - cannot use TPM. So in the above case, support is missing on the motherboard level, and on the CPU level. The newer Haswell variants (for both) still has the same inability.
Re:TPM - Its never there (Score:4, Interesting)
TPM - Its never there
It's already in essentially all laptops, it's already in essentially all "business class" desktops, it's already in some "personal class" PC's, and it's MANDATORY in ALL new Windows PC's as of 16 months from now. [microsoft.com]
Ummmm yeah........ "never".
-
TPM research at Blackhat (Score:3, Informative)
I'd worry more about 8-row business-style keyboard (Score:2)
I am more worried about no new laptops with the standard 8-row keyboard which has Ins/Del/Home/End/PgUp/PgDn block.
All manufacturers that had those for business use - i.e. Dell, HP, Lenovo switched to the new consumer type layouts which are much slower for development work.
When this keyboard layout is ressurected, I am buying a new laptop. Until then, I stick to the fastest possible laptop with such keyboard. Which, at present is Dell E6410/E6510.
As far as UEFI and TPM - all of these can be disabled.
UEFI != Secure Boot (Score:2)
I've never seen as much misinformation on anything on Slashdot as I have on UEFI.
UEFI does not imply secure boot. Microsoft recently baked secure boot into the most recent UEFI standard, but even if your machine is on that version, you can do a UEFI boot without going through secure boot.
Saying UEFI and secure boot are the same thing is like saying HTML and JavaScript are the same thing. Yes, you usually find one with the other, but they're not the same thing and have different use cases. EFI is actually a
Motherboard without TPM/UEFI (Score:2)
Asus P8C WS (Score:3)
The motherboard in the subject came with a header for installation of a TPM, but no actual TPM, and supports both UEFI and BIOS. Leaving out the TPM seems like a cost saving move rather than a privacy one. [It has a LGA1155 socket, which is being phased out, but it's pretty fast with a Xeon E3-12??v2. ECC monitoring not supported on Linux, if you're interested. I wish there was a chip that was equally fast per core, but with more cores..]
I wouldn't worry about TPMs for privacy or security anyway. There may be a backdoor in TPM, but all it could do is to negate the security of the TPM. There may be other hardware backdoors, but there is currently no way to protect against that. If the CPU had a back door that was triggered by a 128 bit pattern, or a sequence of arithmetic or floating point instructions and operands, this could be delivered over the internet to any host as part of an image file over HTTP, regardless of firewalls, VPNs and virtual machines. [The only solution I can think of would be to implement an emulator which re-maps memory addresses randomly at the byte level, and fudges the operands in calculations (maybe adds a random number to the operands, then subtracts it afterwards)]
I would like the OP also try to stick with legacy BIOS, just for practical reasons.
Re:Not sure off the top of my head (Score:4, Funny)
Re: (Score:2)
Any evidence for this statement? There's a bunch of posts above that say it can typically be turned off at the BIOS, if the motherboard even as the unit installed, and that windows 8 will run without it. So if you can run a current OS, why would the OP be stuck 2 generations ago?
Re: (Score:2)
Re: (Score:2)
Or you can just buy Apple products, which don't have the TPM in them, last I knew.
Like other hardware that just has the header and no TPM chip; they can probably be modded for TPM easily.
If not... they may be obsolete in the future, when you eventually want to use a software program that requires a TPM-enabled system.
If you don't have SW requiring a TPM enabled system, then you can always turn off the capability in the CMOS, and ignore the fact your board has that feature -- the OS won't be able to
Re:Get over it... (Score:4, Informative)
No they don't. They started shipping with them in the mid 2000's, but never built a driver for one, and stopped including it in their hardware in 2009.
Thanks for playin', though.