[iwar] [fc:MS.DRM.OS,.retagged.'secure.OS'.to.ship.with.Longhorn?]

From: Fred Cohen (fc@all.net)
Date: 2002-06-24 20:51:12
Next message: Fred Cohen: "[iwar] [fc:Study:.Security.Worries.Holding.Back.Web.Services]"
Previous message: Fred Cohen: "[iwar] [fc:UC.Berkeley.team.creating.'microfly'.to.infiltrate.enemies]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Message-Id: <200206250351.g5P3pCn20144@red.all.net>
To: iwar@onelist.com (Information Warfare Mailing List)
Organization: I'm not allowed to say
From: Fred Cohen <fc@all.net>
Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com
Precedence: bulk
Date: Mon, 24 Jun 2002 20:51:12 -0700 (PDT)
Subject: [iwar] [fc:MS.DRM.OS,.retagged.'secure.OS'.to.ship.with.Longhorn?]
Reply-To: iwar@yahoogroups.com
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 8bit

MS DRM OS, retagged 'secure OS' to ship with Longhorn?
By John Lettice
Posted: 24/06/2002 at 08:59 GMT

The Microsoft Secure PC project is rolling out, and could be with us as
early as the next major version of Windows, Longhorn. The whole idea of a
computer that just plain won't let you steal other people's stuff is of
course a tricky one (why would you buy it?), as we've previously indicated
here, and here, so the ever-resourceful Beast is proposing to spin it as the
ultimate tool for protecting your stuff.

Starting with a Newsweek exclusive which wonderfully quotes His Billness as
saying: "Itšs a funny thing, we came at this thinking about music, but then
we realized that e-mail and documents were far more interesting domains."
Which is cute, because it suggests that Microsoft's original plans to
produce a secure PC that will protect the music companies' stuff from us
have been spiked in favour of something much more positive and progressive.

The Newsweek piece claims that although the researchers came at the project
from a DRM angle they "quickly understood that the problems of intellectual
property were linked to problems of security and privacy," and that
therefore it had far wider applicability. Their early understanding of this
in an alleged "skunkworks" project commenced in 1997 however is somewhat
questionable, considering Microsoft Research published a piece in 2001
saying that researcher Paul "England has a bold plan to improve the PC and
make it a secure delivery system for audio and video... making minor
modifications to the PC's hardware to allow Microsoft to make a secure
version of the Windows Media Player."

The Microsoft patent claim application granted last December is also for a
digital rights management operating system, although here we do see clear
indications of what it can do other than keep music moguls in coke:

"a computerized method for a digital rights management operating system
comprising: assuming a trusted identity; executing a trusted application;
loading rights-managed data into memory for access by the trusted
application; and protecting the rights-managed data from access by an
untrusted program while the trusted application is executing."

The Newsweek exclusive has, as we said earlier, been deliberately planted in
order to prepare the way for the DRM OS, but it nevertheless contains many
useful nuggets which we'd do well to consider before Microsoft attempts to
build up unstoppable momentum behind the secure Windows you can't afford not
to buy.

First, the project, called Palladium, has at least a hardware component.
Intel and AMD have both been recruited to build the security into their
chips, and while we can probably expect some more spinning on this, the mods
will probably be relatively minor. As England said in his paper last year,
it involves "minor modifications to the PC's hardware." As we understood it
the original plan was to nobble the sound card rather than the whole
machine, so we can see development here. It's also worth noting that: "Intel
originally turned down the idea before eventually embracing it. AMD had
already been thinking along similar lines, and eagerly signed on."

Which looks a little like Microsoft playing the old chippledum and
chippledee game to its advantage again.

Newsweek provides us with helpful bullet points on the uses and applications
of Palladium; we can infer a fair bit from these, and we very sportingly
won't move the order around so DRM is at the top. First, it knows who you
are (we don't know how, but as it's a 2004 timeframe product, we can
surmise), and it knows who you're dealing with, so it verifies the origin of
incomings, and decides what is allowed to run on your computer (No, we know
this is DRM, but we haven't moved it up, honest).

There will almost certainly be an ID in the chip, and the 'what can run'
question is rather broader than you might expect. "Only certain applications
will access the part of Windows (nicknamed 'the nub') that performs
Palladiumšs functions with the help of the security chip - everything else
will work exactly the same." Which implies a new generation of trusted
Palladium applications, and "Microsoft expects a flood of Palladium-savvy
applications and services to spring up" rather confirms that. The trusted
application idea also applies to viruses and worms, of course, but it's not
clear how Palladium will differentiate between the new generation of
"trusted Palladium applications" and plain old 'not-a-worm really'
applications. Maybe it won't, maybe in the long run the latter just won't
run.

Encryption capabilities add to the picture, encrypting data moving from
keyboard to computer and computer to screen, and of course computer to sound
card output, but we don't mention that, for some reason. Encryption also
appears to be standard on locally stored stuff

Palladium also: "Cans spam. Eventually, commercial pitches for recycled
printer cartridges and barnyard porn can be stopped before they hit your
inbox - while unsolicited mail that you might want to see can arrive if it
has credentials that meet your standards."

This is a tricky one, as it implies a widescale certification process for
email. It could work if it were possible to know absolutely that everybody
in front of a computer was who they said they were, and to know where they
lived, but we'll get back to that.

"Safeguards privacy." We have what looks like another crack at the services
model here, with MS proposing a collection of services currently tagged "My
Man." These are intended to operate as agents sending out information about
you to the people you want to receive it, and encrypting it along the way.
So "If you apply for a loan, youšd say to the lender, 'Get my details from
My Man,' which, upon your authorization, would then provide your bank
information, etc." Bad example, we reckon. If you have to send all of the
information you'd ordinarily put on a loan form the vipers will know
practically everything about you anyway, and given that you have no choice,
automation will probably lead to them squeezing even more data out of you.
Plus you can't lie, because all of that data's been verified - crumbs, there
go the credit cards...

"Controls your information after you send it." Yes folks, here it comes, DRM
- we've softened the bullet point head, but accidentally got onto the record
companies in the next sentence. But they've evolved: Palladium "could allow
users to exercise 'fair use' (like making personal copies of a CD) and
publishers could at least start releasing works that cut a compromise
between free and locked-down."

We're not entirely sure we know these record companies, but they're clearly
not related to the ones who're trying to stop you playing your music CDs on
your PC, copying your CDs at all, and salivating at the prospect of
time-limited/per play rental arrangements.

More softening of the impact. The first generation of Palladium
installations will allegedly be at the business end of the scale, "financial
services, health care and government," where security is important, and Jim
Allchin says he'd "have a hard time imagining that businesses wouldnšt want
this." Certainly, it fits in nicely with Microsoft's current determination
to reshape itself as a prime vendor of Trustworthy Computing, and it can be
worked up into a sales pitch to counteract all that Windows security bad
news in government and business.

But there's just a tad of dissonance here. If the system's ability to
identify other trusted systems is dependent on those other systems being
Palladium systems, then it doesn't altogether work if practically everybody
doesn't have it. So MS VP Will Poole's contrary claim that: "We have to ship
100 million of these before it really makes a difference" is significant.

Given the way Microsoft ordinarily ships 100 million of whatever it wants to
ship, we'd expect the company to continue thumping the security and privacy
tubs for all they're worth, to start rolling it out around Longhorn time,
and to evolve towards making it, and the chips, virtually compulsory through
the good offices of Intel, AMD and the major PC companies. This will only
work if the publicity campaign to reposition DRM as A Good Thing convinces
the users, and that's by no means a given. We haven't even got on to the
trustworthiness of the people who'll be keeping custody of your secure
digital identity, for starters. Not yet... Ž 

------------------------ Yahoo! Groups Sponsor ---------------------~-->
Free $5 Love Reading
Risk Free!
http://us.click.yahoo.com/3PCXaC/PfREAA/Ey.GAA/kgFolB/TM
---------------------------------------------------------------------~->

------------------
http://all.net/ 

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
Next message: Fred Cohen: "[iwar] [fc:Study:.Security.Worries.Holding.Back.Web.Services]"
Previous message: Fred Cohen: "[iwar] [fc:UC.Berkeley.team.creating.'microfly'.to.infiltrate.enemies]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
This archive was generated by hypermail 2.1.2 : 2003-08-24 02:46:33 PDT