Microsoft Windows 11 to be a free upgrade for Windows 10 users

[Kanoe]

Eh? second hand ryzen 2600 are around £100 - £125. S/hand mobo £50. Decent ddr4 16 gig £50
It's not a large amount at all - only graphics cards are super expensive right now

Ofc I could if I wanted a serious downgrade. I mean I could save even more and drop to 1st Gen Ryzen and 8GB of RAM.

[Tabbykatze]

It's more than just a store for data it also generates cryptographic hashes to confirm things (software, firmware) haven't changed. The decryption isn't transparent, that would defeat the purpose of generating the cryptographic hashes, perhaps you're talking about when those keys are used to decrypt something else though, like Bitlocker.

TPM has always been a leper so this is nothing new, there were objections to it when Microsoft said W8 would require TPM until they rowed back on that and made it optional. I'd disagree that its only purpose is being a security key layer and cryptographic store, at it's most basic it generates and stores cryptographic keys and hashes, much like https works with a public and private key pairs, with TPM storing the private key or hashes and checking if the public key or hash match. (At least that's my understanding, happy to learn more or be corrected).

Anything closed book is classified by the open source community as a leper, that's just nature of the beast but TPM, in this instance, is getting over stated about how much it does/can affect/will affect your systems. It's used as a store to facilitate a transparent data decryption layer (i.e. Hardware Security Module). What I'm not understanding is you have accurately described TPMs purpose solely as a security/cryptographic key storage layer and yet propagating a notion it is more that that? As that is the case, it is up to the software developer and the flashback to them if they use it maliciously. Additionally, it's more of a key storage enclave than just a hashmatch database.

It being just an escalation of the minimum requirement is what concerns me, we'll likely see further escalation in how TPM is used. With W8/W10 TPM was an optional requirement, with W11 it's looking like it will be mandatory, with W12, 13, or 14 will we see a situation where access to certain software or hardware will be restricted because you don't have the right private key. Will we see the TPM RNG being used to identify each and every unique system.

Secure boot through Windows, Linux and other OSes that utilise it is very effective at preventing at boot/kernel loading viruses because it is an end to end check of the integrity of the kernel and its installed medium, they can't do it really any other way without having a separate system to load the values that they're expecting in. I get where you're coming from but I do not believe your expectation will come to reality.

Edit: Every system is already stamped with UUID based on a hash of the hardware mixed with DMI and other environmental elements so TPM isn't needed for that...

EDIT: This write up on linux-magazine does a good job of explaining things IMO. Before any berates me for unfounded DRM concerns because the article says...

Pretty sure that I have never heard nor seen of a system having multiple TPMs (if someone has a link to one, would be very interested to see it!) let alone the UEFI BIOS would have to be overridden to allow multiple TPMs to be available to the system (which would mean loading an unsigned/fake BIOS which is hard enough as it is on modern systems) and then I have never seen or heard of an OS being compatible with multiple TPMs so due to these two points, I am highly dubious if such a hypothetical is even possible. A quick 5 minutes of very targeted googling to confirm this yielded me no results on multi-TPM systems even existing. So as much as I respect Matthew Garretts piece on that about the hypothetical possibility, I do not think it would be any time soon.

We already have remote attestation for Office 365 services, if your TPM is corrupt or malfunctioning it will prevent Office from functioning as it cannot establish hardware security. As long as it stays in the Enterprise, that's where I draw the line.

I know and I've not said nor am i saying TPM is being used for remote attestation, I'm saying that it could be in the future. (à la Boiling frogs)

Yes, it could be, we could go to subscription Windows with custom silicon and a locked down app store. I just don't think fighting the TPM fight is worth it over "privacy" or "restricting your systems" when it's nothing, really, to do with your privacy or restricting the use of your software.

But, this will really be a case of each persons opinion is valid in their own way and my belief they shouldn't enforce it because it draws a substantial line in the sand that I don't think the wider public is ready to cross technologically.

[Saracen999]

....

But, this will really be a case of each persons opinion is valid in their own way and my belief they shouldn't enforce it because it draws a substantial line in the sand that I don't think the wider public is ready to cross technologically.

While I entirely agree with your view (both that they shouldn't enforce it, and that it crosses a line the public isn't ready for) I would just remind you of two principles :-

- the notion of the thin end of the wedge, and
- the law of unintended consequences.

What worried me, right back with the release of Win8, wasn't so much what it was or what it specifically did (despite the problems it gave me personally), but the 'direction of travel' it, and some of MS's comments, suggested.

In short, I don't trust them. Or their intentions.

[Tabbykatze]

While I entirely agree with your view (both that they shouldn't enforce it, and that it crosses a line the public isn't ready for) I would just remind you of two principles :-

- the notion of the thin end of the wedge, and
- the law of unintended consequences.

What worried me, right back with the release of Win8, wasn't so much what it was or what it specifically did (despite the problems it gave me personally), but the 'direction of travel' it, and some of MS's comments, suggested.

In short, I don't trust them. Or their intentions.

I am well aware of those principles but I pick my battles so I don't end up over-exerting myself unnecessarily down a path while not actually preventing those same things I'm trying to avoid from happening to my data.

[CAT-THE-FIFTH]

TBF,I wouldn't upgrade to Windows 11 in the 1st 6~12 months because you are going to be a beta tester!

[Tabbykatze]

TBF,I wouldn't upgrade to Windows 11 in the 1st 6~12 months because you are going to be a beta tester!

I'll test it in work, but absolutely not going to be moving for 6-12 unless there's something really compelling. The Direct Storage API is looking mighty fine though...

[CAT-THE-FIFTH]

I'll test it in work, but absolutely not going to be moving for 6-12 unless there's something really compelling. The Direct Storage API is looking mighty fine though...

I think Direct Storage could probably work under Windows 10 TBF! However,the only NVME SSD in my system is 500GB,and the rest are SATA drives,so would need a new SSD!

[Saracen999]

I am well aware of those principles but I pick my battles so I don't end up over-exerting myself unnecessarily down a path while not actually preventing those same things I'm trying to avoid from happening to my data.

Agreed. But it's a judgement call over when to exert yourself, if you want to be sure. For me, that was W7 to W8. Going to W8 would have meant a lot of exertion to do so, as did not going, but at least the not-going route meant I don't have to worry about it now.

[Saracen999]

TBF,I wouldn't upgrade to Windows 11 in the 1st 6~12 months because you are going to be a beta tester!

If we get the choice, as opposed to turning a machine on one day to find it's installed itself invisibly. Unless I've missed the bit where MS guaranteed it has to be an explicit user choice to upgrade, not automatic. And I may have, having not paid that much attention.

[LSG501]

If we get the choice, as opposed to turning a machine on one day to find it's installed itself invisibly. Unless I've missed the bit where MS guaranteed it has to be an explicit user choice to upgrade, not automatic. And I may have, having not paid that much attention.

I have this feeling you might not be wanting it full stop... supposedly, outside of desktop, MS requires a front facing camera too, I have absolutely zero idea why that is a requirement of an OS.... mind you it does seem to be a way to stop it on laptops, just disable them lol

[excalibur1814]

Blah, blah, blah. Heard it ALL before. Just move away and get on with your life. The rest of us will install Windows 11 and many will simply tweak the OS. It doesn't have to be anything other than fun.

Nice of you to be so dismissive, although I'm not sure why you felt the need to blah, blah, blah about peoples concerns instead of getting on with you life and having 'fun'.

I am having fun.

I've just read ALL of this jazz before. It's not even out for testing yet.

[Kumagoro]

Considering that iMacs etc do not have TPM's to my knowledge, I guess that means no more boot camp on intel ones for Win 11.

Will there be any implications for using it for Virtual Machines, in particular Vbox? I have never paid much attention to whether a TPM is available to it.

[nacasatu]

I have an Asus Maximus VIII Formula motherboard with an Intel i7-6700K and 32GB ram along with a Nvidia 3090FE

It fails the Windows 11 compatibility check.

The Asus motherboard has NO TPM header at all and it does not even have the intel PTT support in the BIOS either.

Also the I7-6700k is deemed not supported by Microsoft for Windows 11.

I'm running near all games in ultra everything at 1440p on a 144Hz G-Sync LG monitor with fullest possible FPS.

My PC is fine.

Microsoft can suck a fat one.

Out of touch, as always they seem to be. Idiots working for them, absolute morons.

[Iota]

It didn't require it in my case. I just enabled PTT in BIOS and it was fine (for the TPM requirement anyway, I then hit MBR issues).


They've already said they're going to allow TPM 1.2 later, and I suspect this is enabled by default on laptop installs.

Ah, for some reason I swapped over to GPT a while ago. I didn't hit that issue.

But even something as simple as a Start menu has implications some people may not appreciate, especially on a tech forum like this. My wife is dyslexic (as are a few others on here that I know of) and part of her dyslexia seems to be trouble with mapping things in her brain. It works differently to me. Not inferior, just different. If I want to describea route for her to drive, I have to do it in a way that works for her, not what works for me. And the same is true for where to find things on a menu. adaptive menus where things change position is a disaster for her, because she learns where things are by rote, and if they move ....

....

I can and will "just move away", if need me, because I mainly already have. But for anyone that hadn't been forced into proactive measures in the past, it could be a major headache, not something to be treated so dismissively.

Actually all very good points to be made, additionally to your own scenarios, I really do not wish to have to teach my mum how to use Windows again. The less they change in it on the front facing aspect the better in that regards.

TBF,I wouldn't upgrade to Windows 11 in the 1st 6~12 months because you are going to be a beta tester!

If we get the choice, as opposed to turning a machine on one day to find it's installed itself invisibly. Unless I've missed the bit where MS guaranteed it has to be an explicit user choice to upgrade, not automatic. And I may have, having not paid that much attention.

Well I hope we get the choice, I delay major updates in Windows 10 anyway, purely because Microsoft "could do better" in regard to not causing issues.

[Tabbykatze]

Considering that iMacs etc do not have TPM's to my knowledge, I guess that means no more boot camp on intel ones for Win 11.

Will there be any implications for using it for Virtual Machines, in particular Vbox? I have never paid much attention to whether a TPM is available to it.

It'll likely be an emulation of TPM using the T2 chip?

(The T2 chip is far far more horrendous than the TPM!)

[Corky34]

Anything closed book is classified by the open source community as a leper, that's just nature of the beast but TPM, in this instance, is getting over stated about how much it does/can affect/will affect your systems. It's used as a store to facilitate a transparent data decryption layer (i.e. Hardware Security Module). What I'm not understanding is you have accurately described TPMs purpose solely as a security/cryptographic key storage layer and yet propagating a notion it is more that that? As that is the case, it is up to the software developer and the flashback to them if they use it maliciously. Additionally, it's more of a key storage enclave than just a hashmatch database.

I wouldn't know if the open source community classify anything closed book as a leper, that sounds more like your personal view as I'm sure there's many instances of closed book not being treated as a leper, the article i provided from linux-magazine certainly doesn't and I'm sure i could find many other instances. I'd also say it's not being over stated about how much it does effect your system, i even pointed out that I'm not saying TPM is being used for remote attestation so I've been pretty clear on the front IMO. To know how it can or maybe will effect your system in the future you'd really have to look into the history of Trusted Computing as a lot of the issues (PDF) people had have been 'addressed' essentially making them a nonissue, however IMO those issues have simply been put on the back burner and will eventually find their way back into TPM once it see widespread adoption and people are just used to using it (boiling frogs).

It's also not just a store to facilitate a transparent data decryption layer, I've already explained that it's not, if it was just that a tiny bit of NVRAM would suffice.

When a TPM is initialized, it generates a key called the Storage Root Key (SRK). This key never leaves the TPM, and the OS has no way to access it. When an application asks the TPM to generate a key, the TPM does so and gives the public and private halves back to the application. However, before handing back the private half, the TPM encrypts it with the SRK. The private key can only be used by passing it back to the TPM, which will then decrypt it and store it in the TPM's internal RAM. Any material that's been encrypted with the public half of the key can only be decrypted by the TPM that can read the corresponding private key: If you have a TPM key pair and someone steals your hard drive, the thief will have no way of using those keys because they can only be decrypted by the TPM that generated them.

The reason I'm saying it's more than just a store to facilitate a transparent data decryption layer is because it is, it generates a root key that's used to decrypt any private keys that it's issued to requesting applications.

Secure boot through Windows, Linux and other OSes that utilise it is very effective at preventing at boot/kernel loading viruses because it is an end to end check of the integrity of the kernel and its installed medium, they can't do it really any other way without having a separate system to load the values that they're expecting in. I get where you're coming from but I do not believe your expectation will come to reality.

Edit: Every system is already stamped with UUID based on a hash of the hardware mixed with DMI and other environmental elements so TPM isn't needed for that...

And that's great but what about if i want to load something on my PC that hasn't been authorised by Microsoft, because AFAIK Linux and other OSes can only be loaded when secure boot is enabled because Microsoft allow the loading of a shim. The system UUID is easily spoofed and all it's really based on is the smBIOS or drive serial number, it's also not something that's persistent between OS's, if i boot into Linux or anything that isn't Windows 8 and upwards that identifier is no longer valid.

Pretty sure that I have never heard nor seen of a system having multiple TPMs (if someone has a link to one, would be very interested to see it!) let alone the UEFI BIOS would have to be overridden to allow multiple TPMs to be available to the system (which would mean loading an unsigned/fake BIOS which is hard enough as it is on modern systems) and then I have never seen or heard of an OS being compatible with multiple TPMs so due to these two points, I am highly dubious if such a hypothetical is even possible. A quick 5 minutes of very targeted googling to confirm this yielded me no results on multi-TPM systems even existing. So as much as I respect Matthew Garretts piece on that about the hypothetical possibility, I do not think it would be any time soon.

We already have remote attestation for Office 365 services, if your TPM is corrupt or malfunctioning it will prevent Office from functioning as it cannot establish hardware security. As long as it stays in the Enterprise, that's where I draw the line.

I assume two TPM's are fairly easy considering most MoBo come with TPM headers and most new CPU's come with embedded TPM (fTMP), switching from one to another would probably be a simple change of a BIOS setting (have you maybe misinterpreted it to mean two running at the same time rather than swapping between one and another?).

But we can be fairly certain that it's not going to stay in the enterprise space and that it can be used to prevent software from running, as you say "an escalation of the minimum requirement", first TPM was a requirement for W8 then after backlash they made it optional, now, if things stay as they are, it's no longer optional again.

Yes, it could be, we could go to subscription Windows with custom silicon and a locked down app store. I just don't think fighting the TPM fight is worth it over "privacy" or "restricting your systems" when it's nothing, really, to do with your privacy or restricting the use of your software.

But, this will really be a case of each persons opinion is valid in their own way and my belief they shouldn't enforce it because it draws a substantial line in the sand that I don't think the wider public is ready to cross technologically.

Well on that we're going to have to agree to disagree as i think Microsoft have telegraphed their intentions fairly clearly, like i said you only have to look at the history of TPM (PDF) to understand what their intentions were for it, intentions i suspect will slows and inevitably be added to TPM as it become accepted (boiling frogs).

I am having fun.

I've just read ALL of this jazz before. It's not even out for testing yet.

So just trolling then, got ya'.