Hacker News Reader

Comment by rektide | Hacker News Reader

I more just hate the principle of tpm, that there's some part of my system running which I have no way to see, no way to hack, no way to modify. give me a special ring -1 that i the owner can use to own my system and I'm ok but what a vile situation that windows now mandates that users can't have control over their systems.

argument against there being the possibility of access all boil down the to apple no-sideloading arguments, that users might possibly do bad things, that the world is scary. it's a lot more scary to me when mega corps can invisibly do whatever they want on hardware I "own". re-personalize the PC, please.

also 4 year old Ryzen processors don't have support for the digital fascism chip so a lot of them would have to spend a court hundred bucks to upgrade.

View on HN

The TPM is not “ring -1,” nor is it a DRM device. It’s a little fixed-function cryptographic HSM that can do a limited set of operations. It is possible to use it to make a computer that resists end-users switching OSes without losing access to the data, and this is roughly what BitLocker does. If you want that functionality, then enable it. If you don’t, don’t.

Saying you can’t hack your TPM is like saying you can’t hack your credit card. (Not your credit card account — your actual card.). Making it hackable would defeat the whole purpose. And, unlike your credit card, your TPM will gladly support fully open source Linux SSH key protection, whereas your VISA credit card is not about to emulate a MasterCard.

TPM does contain a secure key store, not just fixed function encryption and signing operations. Unless it's fTPM, in which case the storage and device firmware attestation is handled by firmware - but it is still key functionality.

You really don't need anything particularly special to make a cloneable module that supports all TPM 2 functionality, it's just that the available ones are not and any other would not get certified.

The ring -1 functionality is firmware attestation. It must be supported as per spec.

So no, TPM is not just a chip or just a key store. It is much more than that hence the blobs that handle it had security bugs.

Ryzen 1000 chips have TPM. We don't know exactly what feature Microsoft wants that they don't have. They announced this morning that they're going to do more testing of Ryzen 1000 and Intel 7th gen chips during the preview in the hopes of officially supporting them.

Internal communication on requirements hasn't been very clear either. I can see them requiring TPM2.0 but Kabylake and Ryzen 1000 cut-off seems unnecessary from my POV.

IHV push back is the only reason I'd wager but then most of the hardware features requiring OS changes are being back-ported to 10 for enterprise support anyway.

Reply on news.ycombinator.com