Hacker News Reader

Comment by dstaley | Hacker News Reader

> Unless you have a recent store-bought PC that has Secure Boot and TPM enabled out of the box, you probably aren’t going to be able to upgrade, even if your hardware is theoretically compatible.

The vast majority of Windows devices are "store bought". TPM 2.0 has been an OEM requirement from Microsoft for almost five years now, so the only people that need to worry about enabling it are people who built their own PC, as in the exact type of people that would know how to do so.

View on HN

It doesn't make any sense. He contradicts himself. If you bought a computer in the store (not tech savvy) then you are fine. If you built your own computer (tech savvy) then you can't figure out the bios settings?

Exactly my thoughts. He builds a "custom" computer, mix matches parts but is unaware of the difference between CSM/UEFI or MBR/GPT?

UEFI and GPT have been on the scene since Vista (2007).

Assembling a computer from parts doesn’t really require in-depth knowledge these days thanks to true plug’n’play.

No jumpers to set for CPU multipliers, IDE master/slave or IRQ/DMA/IO etc.

MBR/GPT and BIOS/UEFI aren't anywhere in-depth as clock multiplier, bus master/slave or IRQ/DMA/IO.

MBR/GPT and BIOS/UEFI along with SecureBoot are neatly explained in the UEFI and motherboard manuals. Also custom parts imply you're running XMP memory and need to enter UEFI to enable the advertised clocks anyway (Hello! JEDEC).

I more just hate the principle of tpm, that there's some part of my system running which I have no way to see, no way to hack, no way to modify. give me a special ring -1 that i the owner can use to own my system and I'm ok but what a vile situation that windows now mandates that users can't have control over their systems.

argument against there being the possibility of access all boil down the to apple no-sideloading arguments, that users might possibly do bad things, that the world is scary. it's a lot more scary to me when mega corps can invisibly do whatever they want on hardware I "own". re-personalize the PC, please.

also 4 year old Ryzen processors don't have support for the digital fascism chip so a lot of them would have to spend a court hundred bucks to upgrade.

Ryzen 1000 chips have TPM. We don't know exactly what feature Microsoft wants that they don't have. They announced this morning that they're going to do more testing of Ryzen 1000 and Intel 7th gen chips during the preview in the hopes of officially supporting them.

Internal communication on requirements hasn't been very clear either. I can see them requiring TPM2.0 but Kabylake and Ryzen 1000 cut-off seems unnecessary from my POV.

IHV push back is the only reason I'd wager but then most of the hardware features requiring OS changes are being back-ported to 10 for enterprise support anyway.

The TPM is not “ring -1,” nor is it a DRM device. It’s a little fixed-function cryptographic HSM that can do a limited set of operations. It is possible to use it to make a computer that resists end-users switching OSes without losing access to the data, and this is roughly what BitLocker does. If you want that functionality, then enable it. If you don’t, don’t.

Saying you can’t hack your TPM is like saying you can’t hack your credit card. (Not your credit card account — your actual card.). Making it hackable would defeat the whole purpose. And, unlike your credit card, your TPM will gladly support fully open source Linux SSH key protection, whereas your VISA credit card is not about to emulate a MasterCard.

TPM does contain a secure key store, not just fixed function encryption and signing operations. Unless it's fTPM, in which case the storage and device firmware attestation is handled by firmware - but it is still key functionality.

You really don't need anything particularly special to make a cloneable module that supports all TPM 2 functionality, it's just that the available ones are not and any other would not get certified.

The ring -1 functionality is firmware attestation. It must be supported as per spec.

So no, TPM is not just a chip or just a key store. It is much more than that hence the blobs that handle it had security bugs.

Reply on news.ycombinator.com