> it will be easier for Microsoft to claim that non-TPM Windows devices are de facto insecure.
Which only means that programs can choose to not service devices without TPM - things like Netflix/Streaming Services and online competitive games, although it might take 10 years with the amount of people that will be unable to upgrade to 11 or upgrade their computer to one with a tpm at all. With computers become more and more about browsing the web, and especially with the chip shortage, people aren't upgrading their hardware as often.
> Which only means that programs can choose to not service devices without TPM
But those "programs" could include "an online check made by your ISP, mandated by your government". If your computer doesn't pass the check, it won't be allowed online. What good is a phone call if you're unable to speak?
> it might take 10 years
I think more like 5, although the government might start slowly, like only preventing non-TPM devices from accessing "sensitive" online services, e.g. banks or anything that requires a payment.
The next step would be connecting the "online check" with a biometric ID, enforced by the device. Every time you unlock your device, it would request from the government a random ID that is included in every packet sent, and those IDs would be tied to your legal identity in a government database.
Letting someone else use your device would be similar to letting someone else use your car, in that you are responsible for whatever is done while you are logged in, unless you report it stolen.
> I think more like 5, although the government might start slowly, like only preventing non-TPM devices from accessing "sensitive" online services, e.g. banks or anything that requires a payment.
This has already happened for mobile banking apps on Android: Many of them already use SafetyNet with hardware attestation.
The only reason not all of them do require hardware attestation is that not all of the older Android phones support that, which is exactly the situation Microsoft wants to change for TPM.
And increasingly, other apps seem to be starting to use root detection and safety net for frivolous use cases such as McDonalds.
Sadly, it is true. I had it on my local bank app. It is annoying, but the future is for everyone to see. I am only able to vote with my feet and go to the branch in person.
I'm curious what you think we're losing here? I mean, I can't remote order with McDonalds on my vintage Windows 95 PC.
To me, the platforms are simply improving security and slowly jettisoning older systems which cause security issues. We don't allow TLS 1.1 for a reason.
None of these have any requirement on some TPM specification. A government can already do as much invasive monitoring as they want, either by forcing citizens to install MITM root CAs[0] or generally requiring invasive identity checks when people sign in, or just limiting what privacy-invasive devices are even allowed to be sold at all. Banks can already go "lol no web frontend for you, go use our mobile app". And neither Visa/Mastercard nor their bank partners are going to allow such strict restrictions that'll surely reduce the amount of impulsive purchases people can make, and you forget that every online payment is already hard tied to your identity via your bank / credit accounts.
> in that you are responsible for whatever is done while you are logged in, unless you report it stolen.
This is only really true for insurance purposes - for stuff like red light cams, the tickets are invalid if you weren't the one driving (which is why some newer ones snap temporary pictures of people in the driver seat in case they end up running the light).
Right now it is politically unthinkable for Western governments to demand people install MITM root CAs, and technically infeasible that they would re-encrypt every TLS connection (and check for encryption being layered inside the decrypted streams). (When Kazakhstan tried, they also faced resistance from software makers, but I wonder what would happen if those software makers happened to be based in the same country that was implementing this policy.)
It is much more thinkable, however, especially in 5 years, perhaps after a (false flag?) cyber-attack takes down an electricity grid in some country, that a government could prevent "insecure"/"unpatched" devices from going online. This wouldn't require any personal information to be shared with the government (at least, no more than current ISP data retention laws already require), and Microsoft would be all too happy to build support for this right into Windows for free, as it would make it harder for "unapproved" operating systems to be used in that country.
> the tickets are invalid if you weren't the one driving
I guess what I meant was "the government will punish you unless you can prove someone else was using your device" so you won't be able to escape prosecution by sharing a device and saying "I can't remember who was using it at that time". Similarly, I believe in some jurisdictions a car owner is expected to know who was using their car at any given point in the past so that speeding tickets can be assigned to the correct person.*
Anyway, I can imagine the law going further and matching the dystopian vision of "The Right to Read", which includes this passage: "Of course, if the school ever found out that he had given Lissa his own password, it would be curtains for both of them as students, regardless of what she had used it for. School policy was that any interference with their means of monitoring students' computer use was grounds for disciplinary action. It didn't matter whether you did anything harmful — the offense was making it hard for the administrators to check on you."
> Right now it is politically unthinkable for Western governments to demand people
Well now you hit the nail on the head. The issue hasn't been technical for a long time but rather one of "image". People have to still believe they have freedoms and whatever curtails them is for their own good. As long as you're given a good reason to submit to extreme measures (9/11 made the Patriot Act acceptable), or they happen slowly enough that you can't really see a boundary being crossed, these measures will eventually be put in place. And nobody will see a huge difference because they won't remember a time when it was hugely different.
Please drop the hyperbole, there is already enough of an impedance mismatch here. We're talking about slow moving ecosystems, and social normalizing of new technological restrictions. The current locked boot mess has taken oven twenty years to develop since the Trusted Computing Platform Alliance was founded. The pace of change accelerates, but five years won't even make remote attestation available in browsers. I'd say it's at least 15 years until a significant number of websites would require it. Using it for network access control would take further technological development (probably on the corporate side), and then some kind of crisis to drive ISPs/governments to demand consumer implementation. It's worrying because it's a step on the slow monotonic authoritarian march, not because the sky is falling right now.
What if I had told you 5 years ago that in 2020, people in Western countries would be forbidden from leaving their homes without permission, and would have to show a digital pass on their phone to be allowed to go into shops?
The technology for remote attestation already exists, and it would take less than a year to roll out checks for it across all ISPs in a country. As you say, it would need some sort of crisis for a government to demand it, but an ill-intentioned government with an offensive cyber-war capability could manufacture that crisis tomorrow if it wanted.
We already have authoritarian Western nations like Poland allegedly using cyber-weapons against opposition politicians[0]. I don't think that claiming existing technology could be used in 5 years is a claim that "the sky is falling right now". The main thing holding back such a scheme is that it would force a lot of legitimate users offline, which is why I think 5 years should be enough time to make those affected users a small enough minority that a government could ignore them.
which is why I think 5 years should be enough time to make those affected users a small enough minority that a government could ignore them.
When predictions of our future read like dystopian science fiction such as Stallman's "Right to Read", 1984, etc. the only course of action is to educate the masses and strongly oppose any further progression down that path.
> What if I had told you 5 years ago that in 2020, people in Western countries would be forbidden from leaving their homes without permission, and would have to show a digital pass on their phone to be allowed to go into shops?
Well I'm coming from a USian perspective, so that prediction wouldn't have come true. But really, trying to contain contagious disease is a societal response with longstanding precedent, and implementing a digital ID like that is technologically easy (at minimum, it's just showing fields from a database). If you had predicted these actions because of a pandemic, it would have been plausible.
Meanwhile if you had predicted similar digital passes in 2000 it would not have been immediately plausible because very few people were carrying around a computer in their pocket. That had to be developed first by private industry, wanted by the consumer market, and the idea of having "apps" for various facets of your life socially normalized, before it could come to pass.
> The technology for remote attestation already exists
What do you mean by technology ? Yes the concept exists, and yes some implementations exist, and yes some are in the hands of consumers. But I wouldn't say the "technology exists" for general web browsing, in that it's available for a single actor, even controlling both ends, to decide to start using remote attestation.
> The main thing holding back such a scheme is that it would force a lot of legitimate users offline
Yes that is one aspect. Another aspect is the lack of implementations for companies to use to start demanding its use. Another aspect is that there has been no application of it to network access control. Yet another aspect is that the government does not understand they have this lever to pull until the trail is blazed by industry. In Y2K authoritarian government went "find a way to stop bad communications on the Internet" and their underlings went "uhh pull the plug?". In Y2020 there are many companies selling carrier-scale TLS MITM and other DPI gear.
All of these things take time. As I said, it has been over 20 years since the TCPA was founded, and you can see where we are. You can directly translate your arguments here to arguments about secure boot in 2000, and yet governments in 2005 were not trying to prohibit computers without secure boot. We had to take a long roundabout trip through a new device type of phones/tablets (for RA this could be security keys) for it to become palatable.
Only now that the market has gotten there on its own would it be plausible for a government to prohibit any device that isn't locked down with secure boot. Even so, it wouldn't be currently advantageous for the more totalitarian countries to mandate this, since they do not fully control the device's manufacturers. That is another progression that will take time before it's ready to click into place.
Personally I agree over the timeline, and hence I find it more worrisome, as a more abrupt change would cause uproar and resistance, while a 20-year long rollout won't be noticed by most (boiled frog effect)
Exactly! Long before remote attestation is used for half of the things we're talking about here (eg prohibiting Adblock), its functionality will have been normalized for other seemingly-necessary uses. People will be wanting to buy devices with RA, similar to how they currently want to buy computers with secure boot and HDCP so they can watch better quality Netflix. And that's the scary part.
It also makes it harder to spread awareness of the threat, since the really concerning implications sound farfetched. Not thinking about it too hard, why would anybody buy a computer that restricts what they can do? Well, the Market finds a way.
>I think more like 5, although the government might start slowly, like only preventing non-TPM devices from accessing "sensitive" online services, e.g. banks or anything that requires a payment.
if that occurs, is that really of microsoft's doing, or of the government and all the other companies that are complicit? I can plausibly imagine a future where microsoft stays its course (ie. it doesn't lock down the x86 platform), but companies still force you to use locked down devices by forcing you to use mobile apps to do online banking. You already sort of see this with messaging apps, where a few (eg. signal) are mobile-only.
I have CalyxOS installed on an old Pixel 2 for "mobile app required" stuff. Signal can verify your account via a voice call to a landline phone number, and I have a cheap VoIP number that worked fine for that.
But the general point is taken. For example my HOA requires payment via Zelle, and my bank requires that I use their mobile app to make Zelle payments. I can still run their app on CalyxOS just fine via microG, but I feel like microG is something Google would find a way to shut down if it were to hit some critical mass of adoption.
Which only means that programs can choose to not service devices without TPM - things like Netflix/Streaming Services and online competitive games, although it might take 10 years with the amount of people that will be unable to upgrade to 11 or upgrade their computer to one with a tpm at all. With computers become more and more about browsing the web, and especially with the chip shortage, people aren't upgrading their hardware as often.