The much maligned “Trusted Computing” idea requires that the party you are supposed to trust deserves to be trusted, and Google is DEFINITELY NOT worthy of being trusted, this is a naked power grab to destroy the open web for Google’s ad profits no matter the consequences, this would put heavy surveillance in Google’s hands, this would eliminate ad-blocking, this would break any and all accessibility features, this would obliterate any competing platform, this is very much opposed to what the web is.

  • jarfil@beehaw.orgEnglish
    1·
    1 year ago

    THIS IS NOT (just) ABOUT GOOGLE

    Currently, attestation and “trusted computing” are already a thing, the main “sources of trust” are:

    • Microsoft
    • Apple
    • Smartphone manufacturers
    • Google
    • Third party attestators

    This is already going on, you need a Microsoft signed stub to boot anything other than Windows on a PC, you need Apple’s blessing to boot anything on a Mac, your smartphone manufacturer decides whether you can unlock it and lose attestation, all of Microsoft, Apple and Google run app attestation through their app stores, several governments and companies run attestation software on their company hardware, and so on.

    This is the next logical step, to add “web app” attestation, since the previous ones had barely any pushback, and even fanboys of walled gardens cheering them up.

    PS: Somewhat ironically, Google’s Play Store attestation is one of the weaker ones, just look at Apple’s and the list of stuff they collect from the user’s device to “attest” it for any app.

    • beefcat@beehaw.orgEnglish
      1·
      1 year ago

      you need a Microsoft signed stub to boot anything other than Windows on a PC

      Not necessarily, most motherboards and laptops (at least every single one I’ve ever owned) allow users to enroll their own Secure Boot keys and maintain an entirely non-Microsoft chain of trust. You can also disable secure boot entirely.

      Major distros like Ubuntu and Fedora started shipping with Microsoft-signed boot shims as a matter of convenience, not necessity.

      Secure Boot itself is not some nefarious mechanism, it is a component of the open UEFI standard. Where Microsoft comes in to play is the fact that most PC vendors are going to pre-enroll Microsoft keys because they are all shipping computers with Windows, and Microsoft wants Secure Boot enabled by default on machines shipping with with their operating system.

      • Saturnlks@lemm.eeEnglish
        0·
        1 year ago

        Windows 11 is saying you’re required to have tpm 2.0 enabled in your bios in order to upgrade. Didn’t know what it was on my self built computer until recently when windows said my system wasn’t compatible to upgrade.

        • beefcat@beehaw.orgEnglish
          1·
          1 year ago

          TPM and SecureBoot are separate UEFI features. Windows 11 requires TPM 2.0. If your system meets the CPU requirements, then it should support this without needing to install a hardware TPM dongle. However, until recently, many vendors turned had this feature turned off for some reason.

          Where some confusion comes in is another Windows 11 requirement, that machines be SecureBoot capable. What this actually means in practice is that your system needs to be configured to boot in UEFI mode rather than CSM (“Legacy BIOS”) mode.