#trustedcomputing — Public Fediverse posts

if you're working on trusted computing at a tech company, know i'll be very mad at you in 20 years when we won't be able to buy real computers anymore and we'll have to either rent a shitty vps from azure or go tear down whatever 2020s era iot devices are still left to steal their MCUs

don't make stuff you know will be used against humanity pretty please

#trustedcomputing

@lug_nuernberg Great Meme 🫶 #TPM2 was a child once - for a better understanding, may I add this great animation to your thread? I think it's worth viewing ❤️

https://youtu.be/mLoIcdIu_Kk?si=YULJHV9WXf56U_OZ
#trustedcomputing #tcpa

À voir! B. Stephan & Lutz Vogel alertent sur l'« informatique de confiance » : un concept qui pourrait servir à mieux nous contrôler. Vidéo percutante pour comprendre les enjeux et défendre nos libertés numériques. #TrustedComputing #InformatiqueDeConfiance #Surveillance #Privacy #LibertésNumériques #Framasoft #PeerTube #French
https://tube.pmj.rocks/videos/watch/d39bb29c-60ec-4c10-a8d9-9beae0c6f3a0

How One 1990s Browser Decision Created Big Tech’s Data Monopolies (And How We Might Finally Fix It)

https://fed.brid.gy/r/https://www.techdirt.com/2025/07/16/how-one-1990s-browser-decision-created-big-techs-data-monopolies-and-how-we-might-finally-fix-it/

@Neffscape

Bellissimo 👍

Ma per avere una qualche forma di penetrazione nei media nostrani, IMHO, andrebbe tradotto e soprattutto doppiato in italiano (e poi in ogni lingua, ovviamente)

Faccio un esempio pratico: la (bella) campagna sul #trustedComputing (tra l'altro argomento ancora valido)

E' stato fatto un video e poi doppiato in ogni lingua. Eccolo in italiano

https://www.youtube.com/watch?v=5OhP6ZzCMgY

@_elena

Solo dal 2023 l'AI è diventata parte del discorso di tutti: il suo utilizzo, l'addestramento con nostri dati, le opposizioni ecc.

Ma ogni tanto mi piace condividere ciò che succedeva già 17 anni fa, che ha posto le basi per tutto ciò, ma che in pochi tenevano in considerazione

#TrustedComputing

EU to Apple: “Let Users Choose Their Software”; Apple: “Nah”

https://www.eff.org/deeplinks/2024/10/eu-apple-let-users-choose-their-software-apple-nah

#DigitalServicesAct #TrustedComputing #EUPolicy #BigTech #DRM

And, once again, "trusted computing" should not be trusted…

L. Wilke et al, "TDXdown: Single-Stepping and Instruction Counting Attacks against Intel TDX"¹

[…]

Intel recently launched Intel TDX, its second generation TEE, which protects whole virtual ma- chines (VMs). To minimize the attack surface to side-channels, TDX comes with a dedicated single-stepping attack countermeasure.
In this paper, we systematically analyze the single-stepping coun- termeasure of Intel TDX and show, for the first time, that both, the built-in detection heuristic as well as the prevention mechanism, can be circumvented. We reliably single-step TDX-protected VMs by deluding the TDX security monitor about the elapsed processing time used as part of the detection heuristic. Moreover, our study reveals a design flaw in the single-stepping countermeasure that turns the prevention mechanism against itself: An inherent side- channel within the prevention mechanism leaks the number of instructions executed by the TDX-protected VM, enabling a novel attack we refer to as StumbleStepping. Both attacks, single-stepping and StumbleStepping, work on the most recent Intel TDX enabled Xeon Scalable CPUs.

Using StumbleStepping, we demonstrate a novel end-to-end at- tack against wolfSSL’s ECDSA implementation, exploiting a con- trol flow side-channel in its truncation-based nonce generation algorithm. We provide a systematic study of nonce-truncation im- plementations, revealing similar leakages in OpenSSL, which we exploit with our single-stepping primitive. Finally, we propose de- sign changes to TDX to mitigate our attacks.

[…]

#TDX #TrustedComputing #Intel
__
¹ https://uzl-its.github.io/tdxdown/

I feel like a #TPM should have a little tag on it that tells people what it does; "If you disconnect me from this computer all the data on it becomes unreadable. Pull in case of cops. Pull and destroy!"

#trustedComputing #encryption #uefi #cryptography #security #infosec

You likely use the #InternetofThings (#IoT) each day for work, school, or leisure - but do you know how to safeguard the devices you use within it from #digitalthreats?

#Dataprivacy and #digitalsecurity skills can be for everyone! Learn how to stay protected in the article by #Cybersecurity Expert Simone Bertulli:

https://lpi.org/u869

#LPI #SecurityEssentials #malware #openstandards #attestation #Linux #bluebugging #TrustedComputing #cryptography #tech

How Windows uses the TPM | Windows Security | Microsoft Learn

A really nice, clear overview of trusted platform modules:

https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/how-windows-uses-the-tpm

https://alecmuffett.com/article/109104

#tpm #trustedComputing #windows

#CyberSecurity #TrustedComputing: "After all, a system that treats the device's owner as an adversary is a natural ally for the owner's other, human adversaries. The rubric for treating the owner as an adversary focuses on the way that users can be fooled by bad people with bad programs. If your computer gets taken over by malicious software, that malware might intercept queries from your antivirus program and send it false data that lulls it into thinking your computer is fine, even as your private data is being plundered and your system is being used to launch malware attacks on others.

These separate, non-user-accessible, non-updateable secure systems serve a nubs of certainty, a remote fortress that observes and faithfully reports on the interior workings of your computer. This separate system can't be user-modifiable or field-updateable, because then malicious software could impersonate the user and disable the security chip.

It's true that compromised computers are a real and terrifying problem. Your computer is privy to your most intimate secrets and an attacker who can turn it against you can harm you in untold ways. But the widespread redesign of out computers to treat us as their enemies gives rise to a range of completely predictable and – I would argue – even worse harms. Building computers that treat their owners as untrusted parties is a system that works well, but fails badly." https://pluralistic.net/2024/01/18/descartes-delenda-est/#self-destruct-sequence-initiated

You get subjected to draconian tech like #DRM, #TrustedComputing, #RemoteAttestation and #PartsPairing in the name of protecting IP. What about your IP? The code you write, the paintings you make and even your online comments get fed into #AI and reproduced wholly or in part elsewhere, in the name of #fairuse. What is common to these seemingly contradictory, if not hypocritical measures? Those who promote it have the money to deploy them in mass and fight you in court if you challenge them.

Es gibt einen Angriff gegen die #AMD Speicherverschlüsselung. Damit sollte #TrustedComputing in der #Cloud schwer angezaehlt sein.

https://cachewarpattack.com/

BIOS update went off without a hitch!

Except I had to disable the firmware trusted computing module and reenter my Bitlocker key because I just *had* to install a real TCM

I really like #Gigabyte's #Qflash feature. Makes BIOS updates a breeze!

#hardware #pcbuilding #trustedComputing #bios #bitlocker #encryption #motherboard

#TrustedComputing needs to fucking die, #WEI may be dead, but TC is alive on most mobile devices, and it's taking hold on desktops once again too.

TC must be illegal.

This renders also most usecases of #trustedcomputing into the void.

A success attack to #sgx if someone has access to the hardware is exactly the #security threat it should protect from. Important for #cloud and #kubernetes users. Sorry.

Tesla Jailbreak Unlocks Theft of In-Car Paid Features
https://www.darkreading.com/application-security/tesla-jailbreak-unlocks-theft-in-car-paid-features

Weird take:

SafetyNet being utterly broken actually did more harm than good, because a lot of people have picked up the misconception that TC-like or DRM tech doesn't work and can be easily broken.

It gives you a false confidence in the status quo. It would only take Google flipping a switch to completely nuke this.

They've "fixed" it, the only reason basic attestation is still around is because of older devices and maybe some internal politics, but apps can already require strong attestation.

#TrustedComputing #ComputingFreedom #SoftwareFreedom #WEI

https://www.linuxjournal.com/article/7055

Dated 2003.

I was less than 1 year old when this was written, and yet it couldn't be more relevant now that I'm 20.

Here's a quote:

Creating a reliable way for a third party to determine what software you're using is a pernicious project. Today, it's trivial to fool “Internet Explorer only” sites: change how your browser identifies itself, and there is nothing the other end can do. With TCPA's remote attestation, a site that insists on an attestation would receive the whole truth or a highly suspicious “No Comment”.

#TrustedComputing #OpenWeb #WEI #Google #Security

Do #trustedcomputing guys use IPMI/KVM? How do you trust the peripheral buses aren't intercepted?

Here’s How The Precursor Protects Your Privacy - At some point, you will find yourself asking – is my device actually running the c... - https://hackaday.com/2022/08/06/heres-how-the-precursor-protects-your-privacy/ #trustedcomputing #handheldshacks #securityhacks #bunniestudios #bunniehuang #betrusted #precursor #bunnie #trust #fpga

Here’s How The Precursor Protects Your Privacy - At some point, you will find yourself asking – is my device actually running the c... - https://hackaday.com/2022/08/06/heres-how-the-precursor-protects-your-privacy/ #trustedcomputing #handheldshacks #securityhacks #bunniestudios #bunniehuang #betrusted #precursor #bunnie #trust #fpga