• kadu@lemmy.world
    link
    fedilink
    English
    arrow-up
    5
    arrow-down
    2
    ·
    1 year ago

    Chrome can’t determine what my kernel is doing, unless I give it admin privileges.

    I’m not giving a browser admin privileges, and I can guarantee they’ll not make it mandatory otherwise many educational and business machines would be locked out of Chrome.

    • maynarkh@feddit.nl
      link
      fedilink
      English
      arrow-up
      6
      ·
      1 year ago

      Your TPM unit in the motherboard has more privileges than you do. It attests to the integrity of the kernel, graphics driver included, and the kernel attests to the integrity of the browser and any peripherals.

      • kadu@lemmy.world
        link
        fedilink
        English
        arrow-up
        3
        arrow-down
        2
        ·
        1 year ago

        That’s not what the TPM does, though you could theoretically build up a chain of trust based, partially, on the TPM.

        That being said, this doesn’t change the level at which the browser runs, how much it’s aware of my screen, and most importantly, it’s once again obviously not going to be anywhere near required unless Google is about to halve Chrome usage worldwide.

      • kadu@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        1
        ·
        1 year ago

        I’m not sure about what you’re talking about here. I’m not suggesting ad blocking will require an aftermarket modified Nvidia driver.

          • kadu@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            arrow-down
            1
            ·
            edit-2
            1 year ago

            You’re misinterpreting my comment.

            The whole chain here is that no matter what Google does with the browser, ultimately, I can control what pixels light up in my monitor. The only possible exception was indeed if Google made the drivers and somehow forced ads to display - that’s an exaggerated point that is obviously not true, but to emphasize that indeed, that would be the only way to truly guarantee apps show up.

            You started a chain about Google having driver control - but one, that’s not true, that’s not what TPM and secure computing do. Secondly, not the point. The point is that you can pass an integrity check and not display an ad, so long as you’re still the admin user.

            • i_am_not_a_robot@discuss.tchncs.de
              link
              fedilink
              English
              arrow-up
              2
              ·
              1 year ago

              The technology is useless if you can pass an integrity check just by running as admin. The point is that Google has control over what the process is doing and knows if you’re tampering with it. I guess nothing would stop you from making a device’s that uses the hdcp osd support to draw black boxes over ads you find using accessibility information, but if you’re able to modify the page through extensions or developer tools or memory manipulation, then you’re able to make automated API calls, and preventing that is supposedly the whole point of this system.

              The reason for using an external device to overlay data on the video signal is that there is a browser API for tracking occlusion. It’s supposed to be used for things like disabling animations of elements that are not visible, but could be unethically used for things like making you pay extra to listen to videos if you don’t have an extra display to put them on.

              I don’t know why you think secure computing doesn’t relate to driver control. Drivers run with special privileges and can modify protected memory. This is why people write root kits, and detecting those root kits is one of the primary motivations behind secure computing.