[Shank]

Fact: The Snowden leaks confirmed the long suspicion that governments work to backdoor software and hardware at an insane level. Related fact: Governments also try crazy hard to bust into insecure, vulnerable devices to compromise them.

So we have this really annoying catch 22, where people like this author report on real security and tamper protection systems as bad -- yet without them, the device would actually be prone to different actors attempting to own devices remotely.

Every security mechanism in place on modern computing hardware can be viewed as being either cryptographically important or encumbered against users. The fact of the matter is that it's extremely hard to build a platform that's resistant to all types of attack without also encumbering real users and real benefits of device ownership.

At some point, I just want to throw my hands up and ask why people continue to buy these devices if they dislike them so much. I can understand wanting to tinker and wanting to hack. But voluntarily forking over money just to complain about why that platform isn't an open box amazes me. It's plenty easier to buy a hackable and open by default platform than it is to buy a closed one and try to turn it into an open one.

[candiodari]

And given the extreme asymmetry of defense vs offense there is only one possible outcome :

Backdoors for every state actor ...

It is incredibly easy to make ridiculously hard to find backdoors in both software and even more so in hardware, and early versions have been caught (including the US and Chinese governments). The odds of finding "v2" or, more likely "v50" backdoors are bad. Very bad.

[asciilifeform]

Google, quite untypically for large manufacturers, put their golden key backdoor in plain sight, inside published source. (Apparently, "only a terrorist!" would read it?)

[pgeorgi]

Let's track the RMA flow (the challenge/response mechanism you've tried out before it refused access because you're not a factory employee doing RMA repairs):

common/rma_auth.c:rma_challenge_response() calls process_response(), which on success calls common/factory_mode.c:enable_ccd_factory_mode()

That one calls factory_enable_deferred(), which resets the system before flushing all TPM data, and only on successfully removing all that proceeds to enable factory mode.

Therefore: gaining access through that venue also removes all secrets established on the system, including the TPM-part of the key used to encrypt the disk (the other part being derived from the account credentials, which isn't stored persistently anywhere).

(Disclosure: I'm part of the Chrome OS firmware team. If you find anything we forgot to do to protect user data, I'd _really_ love to know)

[asciilifeform]

You are quite right, I do not work at your factory (TBH, I'd rather work for, e.g., Monsanto...)

Instead, I'm a reluctant purchaser of your hardware (the market is completely devoid of alternatives, if I go to buy a 6-core ARM64 laptop with a IPS display, it's the Chromebook or the highway). A purchaser who would like to actually use what he paid for. And this means the removal of all golden-key backdoor garbage, in the AP, EC, and Cr50 ROMs.

And yes this includes the FBI-subpoena-keyed "upgrade" capability, the AP ROM write-protect override, the I2C/SPI bus mastering, the locked-from-all-but-the-anointed-few console, etc.

I couldn't care less about user-installed "TPM secrets", disk encryption, etc. I get these boxes brand-new. What I want is to wipe the Cr50 and install a routine that simply handles the power button, 3.3v bringup and whatever else is absolutely required for the box to run, under full owner control like the old Chromebooks that had no Cr50.

[asciilifeform]

> It's plenty easier to buy a hackable and open by default platform...

Pray tell, where can I buy a laptop (of new, rather than vintage, manufacture) without blobs and master keys?

[Shank]

Sure thing! I'm not entirely sure if this is 100% open, but it's worth checking out: https://puri.sm/

[asciilifeform]

Intel. No thanks.