The State Of TPM2 Support On Linux, Better Support Coming

[Staffan]

Erm.. no that's not what a TPM does. A TPM is like a smart card/Cryptographic HSM for storing private keys that you generate yourself. Microsoft use it in Windows Hello as a replacement for "remember my password" features of SAML authentication. A TPM also fixes things like OpenSSL Heartbleed by never exposing raw private keys to system processes.

Video DRM is coming too of course. Its going to be a graphics card feature, not a TPM feature.

TPM is part of it. The next part is the SGX extensions that comes with Kaby Lake. Then the chain is complete. They can download encrypted software to your computer, run it encrypted from RAM to do whatever they like and you cannot stop them.

[andrei_me]

Off-topic and fun fact:

TPM is the portuguese acronym for women's PMS, we use the word "tension" instead of syndrome.
Tensão pré-menstrual (Premenstrual tension)

[Luke]

TPM is part of it. The next part is the SGX extensions that comes with Kaby Lake. Then the chain is complete. They can download encrypted software to your computer, run it encrypted from RAM to do whatever they like and you cannot stop them.

You actually CAN stop this. You can refuse to buy any locked hardware that can't boot a FOSS operating system, and you can refuse to patronize DRM media sites and not enable DRM in browsers and media players. As for unwanted downloads, they can be blocked absolutely by airgapping a machine from the network or most of the time by blocking known unwanted servers in /etc/hosts so long as you can control the kernel and the OS. A machine that can't run a trustable kernel can't be trusted with your photos, your video, your email, or anything else you care about. You need your privacy more than you need DRM'ed movies and games.

Why do you think Putin went all the way back to a typewriter with ribbons locked up at night for his most sensitive stuff? You really DO have a choice...

[starshipeleven]

TPM is part of it. The next part is the SGX extensions that comes with Kaby Lake. Then the chain is complete. They can download encrypted software to your computer, run it encrypted from RAM to do whatever they like and you cannot stop them.

Actually, no (on linux).

https://software.intel.com/en-us/sgx

"Relies on an Intel-provided driver and/or the OS for access to Intel SGX instructions and resource management"

So if you hack the opensource CPU driver to disable this bullshit, applications asking for it can go screw themselves. It is also an obvious vulnerability in this would-be airtight scheme.

[Staffan]

You actually CAN stop this. You can refuse to buy any locked hardware that can't boot a FOSS operating system, and you can refuse to patronize DRM media sites and not enable DRM in browsers and media players. As for unwanted downloads, they can be blocked absolutely by airgapping a machine from the network or most of the time by blocking known unwanted servers in /etc/hosts so long as you can control the kernel and the OS. A machine that can't run a trustable kernel can't be trusted with your photos, your video, your email, or anything else you care about. You need your privacy more than you need DRM'ed movies and games.

Why do you think Putin went all the way back to a typewriter with ribbons locked up at night for his most sensitive stuff? You really DO have a choice...

Well you could kill yourself to end all your problems but that is hardly a good solution is it? Fact is that there are very few hardware manufacturers out there and all of them support this nonsense so "not buying" effectively means not using at all.

With regards to /etc/hosts, you also have the Intel Management Engine which is a separate cpu+firmware sitting on your network card that completely bypasses your operating system but has full access to all your hardware. Good luck blocking that in /etc/hosts! The only way to really stop this is to not use the Internet at all but obviously I don't want to do that. Then again, many computers come with built-in wifi today so that even that might not be a solution.

We are quickly heading into scary times where privacy is nowhere to be found. The US government/NSA has a policy to make sure that everything anyone does on the Internet should be traceable and logged by the NSA. That means forcing all hardware manufacturers to include backdoors and tracing methods to their hardware so that no one can escape. The "innovations" we see from Intel here is clearly a result from this policy. While they are not enforcing it just yet we can be fairly sure that once it's inevitable, i.e. when all old hardware is gone and all new hardware have these things stricter enforcement will follow. When spying on you is built into the hardware it's not possible to block it.

I would like to see the FSF or someone like that to start developing an open source hardware platform. It's a hard task and it will take a long time but in the end it will be necessary if we want to have any privacy. Totalitarianism is knocking on our doors.

[uid313]

Considering that 99% of the threats to a PC come by their idiot dumbfuck users, that's not even bad.

Which is fine. If people likes to get ripped off, let them get ripped off.

But this is not to protect the user's PC. This is to protect their commercial content from the user.

About getting ripped off, maybe some of these services you need. If you have a girl over, you need Netflix, for some Netflix & Chill, else you fire up your BitTorrent client and before half the movie is downloaded, she has left.
Without Spotify, what are you going to do? Organize playlists on YouTube with low quality music that gets removed all the time, or go to store and buy a physical CD?

[cj.wijtmans]

Intel ME and TPM... what a disaster for privacy and security...

[Luke]

Well you could kill yourself to end all your problems but that is hardly a good solution is it? Fact is that there are very few hardware manufacturers out there and all of them support this nonsense so "not buying" effectively means not using at all.

With regards to /etc/hosts, you also have the Intel Management Engine which is a separate cpu+firmware sitting on your network card that completely bypasses your operating system but has full access to all your hardware. Good luck blocking that in /etc/hosts! The only way to really stop this is to not use the Internet at all but obviously I don't want to do that. Then again, many computers come with built-in wifi today so that even that might not be a solution.

We are quickly heading into scary times where privacy is nowhere to be found. The US government/NSA has a policy to make sure that everything anyone does on the Internet should be traceable and logged by the NSA. That means forcing all hardware manufacturers to include backdoors and tracing methods to their hardware so that no one can escape. The "innovations" we see from Intel here is clearly a result from this policy. While they are not enforcing it just yet we can be fairly sure that once it's inevitable, i.e. when all old hardware is gone and all new hardware have these things stricter enforcement will follow. When spying on you is built into the hardware it's not possible to block it.

I would like to see the FSF or someone like that to start developing an open source hardware platform. It's a hard task and it will take a long time but in the end it will be necessary if we want to have any privacy. Totalitarianism is knocking on our doors.

You most certainly CAN block mandatory spyware in devices, by blocking the entire devices in question. This is why I do not carry a cellphone, so when I am biking through city streets I am immune to attempts to track my position except when I deliberately pop up and show myself somewhere. if cops depend on cellphones they don't bother developing GPS trackers tiny enough to hide on a bike. Will be the same with old hardware.

Real world: there is a huge supply of older desktops and desktop parts out there. You can still buy AMD AM3+ new as well. I have chosen to stockpile and simply stop updating hardware. If my stockpile gets stolen in a raid, I can get more at a computer show. There is a 10-15 year supply at least of this stuff out there, and in the future it will be like guns with the serial numbers drilled out, probably in a place where such guns are legal or semilegal to boot.

I suspect all of the tracking, surveillance, and DRM is going to get so dependant on the "smartphone" model that ten years from now, someone with an old computer and no smartphone will be able to dive under the radar with ease. The other side will get so much low-hinging fruit thown at them that they will have trouble sorting through it, causing old hardware with "missing security features" to just be blacklisted from surveillance-friendly social media, banking, pay media, and shopping sites, then ignored. It will be like driving without license plates in a place where speed and red light cameras have replaced police. There are places you cannot drive, but you don't get tickets and where you go does not get tracked.

Consider a future network of a thousand old devices, with no device being tied to a shopping history, a Google history, any banking site security fingerprints, any transactions tied to their phone by SMS verification or two-factor login, any ad network records at all, and so on. To snoop on those devices requires actively looking for the fact that they exist at all, and then actively monitoring them. If the authorities get reliant on passively monitoring ad networks and social media sites they may entirely miss the whole network, which thus falls off the radar.

If we have not beaten Trump (and Clinton's people too) and the rest of the surveillance state by the time the last of today's brand new AM3+ parts dies of electromigration, we will have a far bigger problem than having to use old video cameras to pirate movies.

[starshipeleven]

But this is not to protect the user's PC.

It's also for that. MS uses TPM also for security reasons.

This is to protect their commercial content from the user.

Which is their right to do. They own the media, they give the rules. You have no right to dictate how they should deal with their stuff.

What you can decide is to NOT use their shit and use alternatives. Only this way you can keep them alive for the future. Also, note that piracy is NOT an alternative. It exists only because they let it exist, and they let it exist only because it helps kill off alternatives, their actual competition.

If you have a girl over, you need Netflix, for some Netflix & Chill, else you fire up your BitTorrent client and before half the movie is downloaded, she has left.

Various levels of wrong:
-I've never needed Netflix to keep a girl with me
-girls that come at my place to use my stuff for free are usually detected well before they can pull it off
-I'm also not in the US, Netflix arrived here this year and it sucks arse due to most of its stuff being US exclusives. To see stuff I like (for example the Mythbusters), I use a VPN to disguise myself as an US customer which is still technically illegal even if I'm still paying Netflix.

Without Spotify, what are you going to do? Organize playlists on YouTube with low quality music that gets removed all the time, or go to store and buy a physical CD?

Again wrong.
-there are tons of videos also uploaded from official channels that are pretty good.
-I download the above stuff from Youtube through firefox plugins
-when I feel the need to buy stuff (if I respect the artist enough, most stuff I download from Youtube I end up buying eventually) I use iTunes because it gives me DRM-free media.

[Luke]

About Netflix: I don't value Hulu and Netflix for the simple reason that I don't value TV as a whole. If I DID need them, they would have to be exiled to a dedicated device used for nothing else, blacklisted from ever logging into any of my online accounts or handling my own encrypted data. No way in hell I would buy a new multi-hundred dollar computer for that if they block old machines, instead I would tell them to fuck off and torrent the offending files.