• Phoenixz@lemmy.ca
    link
    fedilink
    English
    arrow-up
    4
    ·
    5 hours ago

    Oh yeah, I remember ranting against TPM since two decades ago. Not that it mattered, it happened, here we are

  • typhoon@lemmy.world
    link
    fedilink
    English
    arrow-up
    5
    ·
    5 hours ago

    Very uninformed person here and a genuine question. Isn’t TPM endorsed by respected security projects such as GrapheneOS, I mean the Titan chip isn’t some type of TPM equivalent for computers and one of the main reasons GrapheneOS doesn’t support other phones that aren’t Pixel?

    • spinning_disk_engineer@lemmy.ca
      link
      fedilink
      English
      arrow-up
      3
      ·
      3 hours ago

      The thing is, trusted computing as a security feature isn’t useless. For the particular case of phones, people generally use relatively low entropy passwords, because it’s impractical to do otherwise. The Titan chip uses trusted computing technologies to ensure that an attacker with physical access cannot bruteforce the password, which it does by forcing a timeout between successive attempts. It might do other things too, this isn’t my area of expertise, but (I believe) it isn’t needed for the general functioning of the device, as opposed to e.g. the intel ME.

      Of course, a security chip that you have the power to control would be better, and no less secure, but that doesn’t exist. However, neither the OS itself not the apps directly depend on trusted computing. Otherwise GrapheneOS couldn’t exist in the first place.

      Note that this problem doesn’t exist on desktops or laptops: it is entirely possible to memorize a passphrase around 96 bits of entropy, which is high enough that it can’t practically be bruteforced, especially if the algorithm to check if it is correct is computationally slow.

      So, you lost a bit of sovereignty for your phone in the interest of security, but phones aren’t private to begin with: the actual modem also uses trusted computing. The devs behind GrapheneOS considered this the best solution to the problem, after weighing the pros and cons. Personally, I’d be happy to have a flip phone which has no password, and then do everything of significance (possibly including call and SMS) on my laptop. That is to say, I’d rather I didn’t have to use GrapheneOS, but it’s compromises align well with my own for now.

  • audaxdreik@pawb.social
    link
    fedilink
    English
    arrow-up
    13
    ·
    edit-2
    9 hours ago

    Trusted computing has been a trap, slowly closing over the course of years. And with so many things like it, it happens very slowly at first, then all at once. The door is closing. Escape their environment before you can’t anymore.

    We’ve seen that consumers can no longer dictate the market, they are dictating the market at us. This will not get better, you have to be proactive.

    EDIT: Richard Stallman article that is necessary reading on the matter, Can You Trust Your Computer?. Do you find this hard to believe?

    • cecilkorik@lemmy.ca
      link
      fedilink
      English
      arrow-up
      4
      ·
      6 hours ago

      Couldn’t have said it better myself. This is what they’ve done and are continuing to do to phones. We talk about the Apple and Google’s “walled gardens” but it’s even more than that. It’s about only allowing “trusted” applications to run, on “trusted” operating systems, with “trusted” drivers and “trusted” hardware, for “your security”, to “protect you” (from yourself). But it’s really about control, complete control, not just of our devices but of us as people.

      That is what they intend to do to all computing devices. Over time, gradually. They know they can’t do it overnight and force it down people’s throats, because it’s fundamentally anti-freedom, people will resist, rebel, start to switch to devices and systems that allow them to take back their personal and computing autonomy, using technology to enable their own goals instead of what the manufacturers and services “allow”. So they have to slowly creep it in. People still resist and rebel, but they keep pushing ever so subtly towards more control for them and less control for you. One step back is followed by two steps forward, then another step back when people resist, then another two steps forward. Progress keeps being made, despite the resistance. They will keep normalizing it until people say “well of course they have to protect <x>” and we forget that the freedom to decide what we ourselves are willing to trust so we can do what we want with the hardware and software we own is a fundamental and necessary human right.