Mastodawn

Schrödinger's Catgirl (Joyce)

A friend, @chloetankahhui has been speaking up against the proposal to enforce age verification at the OS level, and the QRTs to this shows the extent of naivety that a lot of people have.

No one who does hardware security believes that any system is bulletproof, but do you really think that circumventing these things will always be a simple firmware mod or hardware hack?

Let's dive in. /1

Schrödinger's Catgirl (Joyce)Feb 24

Since the late 2000s, computer chipsets have shipped with security processors like Intel Management Engine and AMD Platform Security Processor.

Part of their job is to verify that the UEFI firmware is from the computer OEM and has not been tampered with or comes from a 3rd party. /2

Schrödinger's Catgirl (Joyce)Feb 24

How do these security processors verify the firmware integrity?

Through a set of cryptographic keys and their hashes, which are used to verify the cryptographic signature of the UEFI firmware. These keys or hashes are *burned* into the processor and cannot be changed. /3

Schrödinger's Catgirl (Joyce)Feb 24

For now, these functions are not strictly enforced or turned on in a lot of consumer devices.

But is there anything stopping nation states from forcing hardware manufacturers and OEMs to do so?

What options do you have in such a case? /4

Schrödinger's Catgirl (Joyce)Feb 24

There have been vulnerabilities in ME and PSP, and there MAY BE a way for users to bypass these checks.

But this assumes:
- Someone out there will put in labor to circumvent these things and release it freely, even at great expense.
- A simple, user doable hack even exists.

/5

Schrödinger's Catgirl (Joyce)Feb 24

Again, no one assumes that any system can be made 100% bulletproof. But that was never the point is it?

The end game is for manufacturers to harden their devices against cheaper tools and raise the barrier to entry such that it costs a fortune for hackers who might even try. /6

Schrödinger's Catgirl (Joyce)Feb 24

This is why GiovanH's blog article is a must-read.

People assume that accessible hacks of invasive systems will always exist, and users hacking their devices is to be expected.

THIS SHOULDN'T BE A NORM. THIS IS AN ARMS RACE AND WE'RE OUTMATCHED. /7

https://blog.giovanh.com/blog/2025/10/14/a-hack-is-not-enough/

Schrödinger's Catgirl (Joyce)Feb 24

People who think "oh we'll just buy Chinese motherboards and chips" or "just use open source hardware"

WHO FABRICATES THE BOARDS AND CHIPS FOR OSHW? DO YOU BELIEVE STATES LIKE CHINA AREN'T INTERESTED IN SIMILAR MEASURES OF CONTROL?

This is the tech equivalent of tankie-ism.

/8

Schrödinger's Catgirl (Joyce)Feb 24

Go on, circumvent these measures & keep our tech open and free.

But know that many hackers find basic hardware hacking tools too costly and out of reach. WE'RE OUTRESOURCED.

PUSH BACK BEFORE THESE POLICIES BECOME NORMALIZED. DON'T RELY ON HACKING ALONE TO SAVE US.

/END

Val Packett 🧉Feb 24

@sleepyowl FWIW the current "contract" for what "a PC" even is (i.e. the requirements to get WHQL certified by MS) specifically defines that it must be possible to completely disable OS verification (UEFI Secure Boot) or use the user's own keys for it, out of the box without any extra requirements.

Firmware verification on every boot (Boot Guard et al) —which has already been widely enabled in Intel-based PC laptops of the last decade— did not change that, on its own.

Of course the policies are subject to change, but I think even Microsoft themselves would be really pissed about having to change any of this due to legal bullshit.

@valpackett @sleepyowl Originally it was intended to be locked down to only boot Windows, as were the first Windows Arm machines.

The reason you can run Linux on your PC at all today without hacks is previous rounds of pushback

Val Packett 🧉Feb 24

@bunny pushback was definitely a part of it; also failure in the market. The 32-bit Windows RT devices were trying really hard to be iPads, but absolutely no one wanted just the walls with no garden inside.

@valpackett At the time the secure boot was initially designed Windows was still going strong. They could get away with locking down all consumer PC hardware to run only Windows (or OS X for that other part), market-wise. Write off anyone not willing to run Windows as weird, suspicious, and potentially criminal. At least in the western PC market. Not sure how well it would go in China or India. Surprising amount of non-Apple consumer hardware was running Windows that was obtained with varying degrees of legitimacy back then

your auntifa liza 🇵🇷 🦛 🦦Mar 2

it was pushback in the form of case law. you may be too young to remember the brief moment techbros went from peddling microcomputers to their disappearance, then “smart phones”. 2 things happened: the end of TAP and passing of DMCA

“smart phone” is marketing used to circumvent case laws & regulations that gave us root access to our computers.

call smart phones microcomputers, and y’all see the techbros screeching why they CAN'T be, not why they aren't.

@valpackett @bunny

Anthony Sorace Mar 3

@valpackett Content of the discussion aside, “just the walls with no garden inside” is a *wonderful* turn of phrase.

Matthew Garrett Mar 4

@bunny @sleepyowl @valpackett this is untrue, although the precise details of *how* it was going to work took a while to figure out

Jeff Cutsinger Mar 2

@valpackett counterpoint: MS would love to have greater levels of control over what software can be installed on machines. My guess is that the reason these things are as lax as they are is because customers (particularly enterprise IT) are wary of this. Having a law would give them a convenient excuse to do what they already want to do.

@jeffcutsinger ultimately I think microsoft don't _really_ want that sort of fine graned ironclad control at the hardware level as much as they want to lock you into platforms and services, "Windows" is just one of the er, "windows" you get pushed through into Copilot/Teams/Office. What they don't want is to let you out of the walled garden once you fall in.

There are though already very strongly locked platforms that seriously limit what you can boot (iPhoneOS, OSX) without hacks

@valpackett @sleepyowl It's hard to find a motherboard where you can both add your own keys and remove microsoft's without breaking hardware. For example, you can theoretically do both things in a Lenovo laptop but you had better verify your gpu hardware's software will boot without that microsoft key or you just bricked your laptop.

There's really no point if you can't add your own and remove the widely used one. May as well turn it off or use the shim method.

Sobri | Zoe (she/her)Mar 2

@sleepyowl we have done amazing things we will do even better things locks are made for keys and picks we shouldent rely on hacking but we can start fucking around and gain a time advantege we need to develop good tools now so latter we can use them better

Tokyo Outsider (337ppm)Mar 2

@sleepyowl How does someone push back against this? (If it's covered somewhere you've linked already please let me know and I'll read it there)

Lutin Discret Mar 2

@sleepyowl one of the biggest threat to humanity.

Who/what project must we support to ensure we will always have alternative? Even alt non pc architectures

John Abbe (aka Slow)Mar 2

@lutindiscret @sleepyowl It's not going to be any one project, resiliency requires redundancy. I haven't been following alt architectures closely, but Ubuntu for RISC V seems like one place to start? https://www.phoronix.com/news/Ubuntu-RISC-V-2026

Canonical Talks Up RISC-V This Year With Ubuntu 26.04 LTS

Canonical put out a new blog post today highlighting their RISC-V work over 2025 that included switching to the RVA23 profile baseline for Ubuntu 25.10 and moving forward

@sleepyowl Hacking shit is not plan A. That makes a terrible plan A

@sleepyowl Yeah, I've wanted to do a lot of hardware hacking but even good oscilloscopes cost a fortune, not even talking about all the other stuff you need. Every time I see a video people always have expensive equipment and then go "You can do this with any cheap alternative" and sometimes you buy the one cheap thing that can't do what you want it to do because reasons.

The option to mod THAT thing can be there, but that's ALSO a lot of time and effort. Atp it's a cycle of circumventing trash that our system designed to make it not trash,and then the question becomes 'What the fuck are we doing here?"

Kirils Solovjovs Mar 2

@sleepyowl While I'm all for pushing back on the policy, we should also make technical measures. Stock pre-covid era hardware. No way that states can come for all that hardware and force us to turn it in.

As for the 'performance improvements' -- software, including OS written in the past 20 years is so shitty that with a lot of optimisation work we can make it run at least a 100x faster on any existing hardware.

@sleepyowl Intel is extending BootGuard with FSP signing too (which is a blob doing all memory/silicon init magic behind the scenes) which was specifically requested by delusional vendors like AMI.

We had some heated discussions with their engineers about it because they wanted to move reset vector(!) to be owned by FSP-O before allowing actual firmware to execute (kinda like TF-A on ARM64).
Eventually everyone in the meeting went quiet and let me cook, it was a bit comical (me vs. three engineers from Intel), where I suggested extending CSME with it's own cache (as RAM is initialized much later) that can check status of EFUSEs and validate FSP signatures before releasing x86 cores from reset (which is nothing new, that's also what AMD is doing with PSP and PSB) if BootGuard is enabled and board went trough EOM.

In any case, they wanted to make it mandatory in the beginning. We pushed back, which brought Intel to negotiating table and made them change their minds. You can clearly see though that vendors don't care about openness of their platforms (unless money is involved) and real ROT is in the hardware.
Whoever makes the SoC and board, whoever rolls cryptographic keys *truly* owns the platform (or in other words - your hardware belongs to entity burning their signing keys into the "BootROM").

Circumventing those protections is not viable, saying "I'll buy second-hand" or "I'll buy from China" is simply... delusional. If every piece of hardware would become locked-down, you wouldn't be able to upgrade your hardware past certain point whatsoever. Buying from China might work for now, sure... but guess what would happen if China's SoC manufacturers would get equally as big as let's say, Intel/AMD/Qualcomm?
Yep, you've guessed it - same exact thing.

numanumayey Mar 2

@elly @sleepyowl

>but guess what would happen if China's SoC manufacturers would get equally as big as let's say, Intel/AMD/Qualcomm?

the executives would inevitably complain about state regulation, and the state's usual response for this is (for this day and age) surprisingly cathartic.

Val Packett 🧉Mar 2

@elly @sleepyowl imo the urgent crisis rn is with Android OEMs which are walking back on the whole "OEM unlock bootloader" contract. Full control from the reset vector up was always hard to get (esp. on retail consumer devices) beyond a certain level of platform complexity, was always a freedom-nerd niche desire. But both the PC and Android contracts included custom OS support because there's real demand for that. Evidently some vendors are still somewhat cool (Moto collab with Graphene sounds positive?) but between Xiaomi announcing straight up "no more unlock for you" and OnePlus doing weird efuse-blowing things it's the most worrying space right now x_x

We really need to build an actually compelling and desirable platform (see the Modal.cx vision) with the best FOSS components we have, with which we would be able to campaign for our requirements much better. IMO just having abstract and nerdy demands would never get wider political/regulatory/business/NGO/etc attention, while "this is the free people's digital sovereignty sustainable green repair awesomeplatform we want X Y Z requirements to be met for our future innovation to unlock freedom horizons and independent sovereign cyber security" is the best shot we can have.

@valpackett @sleepyowl If I would have:
- Some free time (~3 days)
- Money
- People from countries other than France, Netherlands, Germany, Poland (need 3 more)
I would finish this and start European Citizens Initiative: https://md.sakamoto.pl/Z0qF0ZoARuOrWKuPCQYH-g#

Smartphone ecosystem problems: Overview for policymakers - HedgeDoc

@elly @sleepyowl @valpackett If you just need someone to sign I have also been complaining about play protect and lack of unlocking bootloaders and am an Italian citizen (though not resident in the EU)

Rasmus Sindum Mar 3

@elly @sleepyowl @valpackett Looks like great work so far. Thums up

Jonas Platte Mar 3

@elly @sleepyowl @valpackett is money the hardest part? How much are we talking? The 3 extra ppl sounds like it should be easy? (I know ppl who probably care about this in at least Croatia + Denmark)

mateusz6768 Mar 2

CC: @[email protected] @[email protected]

I remember that ever since a few years ago i have always been thinking in my mind of making a company that would be making phone SoC’s (including phones with the vendor chip) and baseband chips just as good and efficient like Qualcomm or Mediatek but 100% open source down to the baseband code which is something that companies fear over certification and company policy so that I could prove to the world that baseband code can be audited and not behind proprietary blobs but that will for now be a imagination and more of a alternative universe of mobile tech

Seclusion5500 [they/them]Mar 2

@sleepyowl "THIS SHOULDN'T BE A NORM. THIS IS AN ARMS RACE AND WE'RE OUTMATCHED"

we may be outmatched, but we're not outnumbered. don't lose hope, we can defeat this.

@sleepyowl the android world, with safetynet/play protect is an example of this. Used to be that a tech savy user could bypass it with magisk. Nowdays passing attestation is impossible without someone giving you leaked keys, and since google is banning those I they become public and they are relatively hard to obtain, good luck getting your hands on them

@sleepyowl I remember telling people about the fact that in the future google can simply require hardware attestation and that we'd all be screwed, but my fears got dismissed :/

Not to mention "move elsewhere"

it unfortunately seems like _everyone_ is doing this all at once

if I was more conspiratorial minded I'd assume it was coordinated on purpose

@sleepyowl also

"We'll just buy secondhand"

what, supply is going to become a fraction of what it is now and we'll "just" buy what remains?

In this _optimistic scenario_ everything will be expensive as fuck

Violet Madder Mar 2

@pixx @sleepyowl

Get more conspiratorial minded. Fast.

Hell, just the "trusted computing" shit back in what, was that even the 21st century yet???-- made it pretty clear what big tech's goals for us were.

Lesley M 🏴󠁧󠁢󠁳󠁣󠁴󠁿 🇪🇺Mar 3

@pixx @sleepyowl @violetmadder Agree. When all the "Trusted Platform Module" stuff started appearing, it raised my suspicions about them wrenching ownership control away from the user to the big corps. Win 11 requiring TPM and an MS account + add OS age verification, they can basically watch everything you do.

It's totally killed my tech enthusiasm, as everything seems geared to collect data and spy on you. It's why I avoided all the IoT stuff and Alexa/Siri/Ok Google.

Lesley M 🏴󠁧󠁢󠁳󠁣󠁴󠁿 🇪🇺Mar 3

@pixx @sleepyowl @violetmadder (I still have an android phone, but have disabled the voice search app. But I have no faith that voice still isn't collected via the baseband.)

Rusty Shackleford Mar 2

@sleepyowl @cwebber
"circumvent"

PS5 on 'freebsd' released 2020

*Just* got boot rom keys

So may be able to install linux distros soon, but still don't have full hypervisor access & there's execute only memory (xom) on the SoC

cors dump @ level 0 + jtag mitm *might* work to dump xom

So far no one's tried & I don't have jtag experience

Also, qualcomm qfuses preventing bootloader unlock on mobile phones

Pretty bad out here boss

Hope you have patience & enjoy waiting a decade to use anything

Haelwenn /элвэн/

@sleepyowl Plus even if China wouldn't: There's no such thing as an unregulated market, so they can forbid people from buying hacker-friendly machines.

And decent computer are rather big so it's not really the kind of thing you could just contraband in easily.

F4GRX SÃ©bastien Mar 2

@sleepyowl one option is to NEVER run an OS that could be changing these security settings. My machine has never seen windows. How will it update the uefi security settings?

Sobri | Zoe (she/her)Mar 2

@sleepyowl what keeps us from exsrtacting the keys?

Jeff Cutsinger Mar 2

@cutesobri the keys in this instance are public keys used for authentication. Extracting them doesn't help at all, you need the private counterparts which are likely kept under physical lock & key

Duncan Smith Feb 24

@sleepyowl I’m eying up the ‘security updates’ for my bios with some suspicion.

@sleepyowl This is why I have to have secure boot off. Eventually, I won't be able to turn it off on new ones.

Filene Taylor Mar 2

@sleepyowl so glad @nullagent reposted this. 🙇‍♀️❤️‍🔥🔥✊🙏 Very relevant thread to the moment and OS security at large, plus the imposition of free speech/free association rights and fights. 🔥✊

perdidonavida Mar 2

@sleepyowl It's amazing how people can think manufactures can't lock down desktops and laptops when they manages to do that with phones.

I'm really worried about our computing future...

João Santos Mar 2

@sleepyowl @chloetankahhui the main limitation here would be practical. How would they support age verification in every single country in the world and keep it updated at all times?

BlumenKid Mar 2

@sleepyowl welcome to the age of taking care of your computer like it was a cuban classic car.

🌸 Ⓐnarkitty lumi-nhac

@sleepyowl @chloetankahhui "it doesn't affect me, so it's fine" is also selfish. we should stand together against all injustice, even if it doesn't affect us

@sleepyowl @chloetankahhui Don't buy crippled hardware</thread>

@sleepyowl @chloetankahhui this is an excellent thread

i've had similar thoughts

in the near term any such policy would be incredibly leaky and mostly ineffective

but they have almost all the pieces in place to make this quite difficult to bypass in 5-10 years

first is requiring secure boot+tpm to only load blessed operating systems. windows 11 and maybe a quisling version of linux (focusing on pc here, but the same will apply to macs and mobile devices which are already further along)

next mainstream sites will start requiring hardware attestation to access them. they'll simply refuse to load or only allow very limited versions unless secure boot + tpm is present and it's running a blessed operating system. alternatively this could be applied at the ISP level and accessing anything would fail without hardware attestation

sites not requiring attestation would still exist, but most people only use a handful of already highly restrictive sites like facebook, instagram, youtube, etc. but they could also ban unrestricted sites if they wanted to

workarounds will likely exist for a long time as long as they choose to allow legacy and simple embedded devices to access the internet, but they can choose to restrict those at any time. it'll get increasingly difficult to access uncensored information, especially as more and more countries develop similar regimes and it becomes difficult to even find a VPN endpoint that isn't restrictive

this is why we need to stop age/identity verification before it can take hold

Noisytoot Mar 3

@jiub @sleepyowl @chloetankahhui this reminds me of this dystopian story I read on gnu.org where possessing a debugger was illegal

The Right to Read - GNU Project - Free Software Foundation

Earthshine Mar 2

@sleepyowl @chloetankahhui My hope is that the more they push shit like this, the more people will opt to just not buy/use new tech with all the restrictions on it, until the billionaire CEOs realize they're only hurting themselves by disincentivizing people from buying their shit and put the pressure on to roll it back. If MS loses users to linux, Dell loses customers to upcycling, etc... that hurts their bottom line. They're determined to fuck shit up, but freedom will find a way.

@sleepyowl @chloetankahhui I'm pretty sure the UK Government have already explicitly said they fully intend to pursue this.

Rusty Shackleford Mar 2

Re: https://mastodon.social/@rusty__shackleford/116160442549203428

𒀭Wiiお姉さん 💜 🏳️‍⚧️Mar 2

@sleepyowl Capitalism has been pushing the "you don't own your computer anymore" model extremely hard for years now