Some online retailers (and particularly gambling sites) already use “online signatures” —effectively, ad hoc TPM — through software from Iovation, a California startup. The Iovation system studies each machine as it connects to a site and remembers a unique profile; if it turns out the machine is used in a fraudulent transaction, the next time that same computer logs on — even if the user has adopted a different name and password — it will be turned away.

Mad Dog Roanoke VA: The problem is that in real life I can choose to present my ID. If it is built into my computer I no longer have a choice.

Use of the TPM will be voluntary. In the first place it will be a long time, if ever, that all computers even have a TPM. Nothing will stop people from building computers without them and there will doubtless be a market for that. But if you’re not using one then your bank, say, may limit what kind of transactions you can make online. As mentioned earlier, without a TPM you might have to appear in person to open a new line of credit. Similarly, e-commerce sites might more closely scrutinize your transaction.

Story continues below ↓

Then there were readers who are sure that the TPM idea will fail.

John, Pensacola FLA: Good luck! I'm confident that there will be enough 14-year-olds with time on their hands to make this useless. This thing will go the way of the V-Chip.
Doug Hedger, Gaspe, Quebec, Canada: I am supposed to believe that this will be absolutely, positively fool proof and no criminals will ever, ever find a way to find a way to get around, or thru this absolutely marvelous chip. I don't #@^%$&^%$ think so.

No security system is ever 100% fool-proof — whether it’s the lock on your front door or a bank vault — but that doesn’t mean they’re worthless. Adding hardware identification to computers is one more step, and a significant one, toward creating better security tools on the Web. When and if criminals learn to work around those tools, we’ll have to think of new ones. But as I understand it, without a change in hardware, the good guys are running out of ideas on how to improve security using only software. And if the Web can’t be better secured, that will limit just how vibrant and important the online world can become.

Dan Anthony: You say that biometric (fingerprint) readers are more secure than a PIN number. Why is that? People leave latent fingerprints around all the time, and biometric information is like a password that can never change. Once your biometric is compromised, your identity is stolen, and unlike a PIN, you can't recover from that. Finally, the combined false acceptance and false rejection rate of most biometric systems is statistically substandard to a 4-digit PIN number.

Biometric readers are improving all the time — take a look, for example, at the Authentec fingerprint reader, which actually uses radio waves to read under the first layer of skin. That makes it much harder to fool and far more reliable under different conditions. PIN numbers are just too easy to steal or guess to rely on as your sole identification factor.

There were also readers suspicious about exactly what the TPM might be used for, besides securing one’s identity.

Tom Brown, Gilbertsville, PA: Trusted Computing assumes that we the public *trust* companies like Microsoft, which the vast majority of us do not. The Sony incident demonstrates how far a company can be trusted with our equipment, which is not at all. All companies have an agenda to make as much profit as possible, and that's fine. But I don't want them doing so by taking choices away from me (or selling my personal preferences and activity for that matter), and TPM has the potential of doing just that. TPM may make it easier for Microsoft to code the next version of IE or Outlook, but it's not my job to help them. TPM might make it easier for Amazon to sell things on line, but it's not my job to help them, either. I want choice, and I want privacy, and I don't want to lose either one. And yes, I recognize what the "MS" in "MSNBC" stands for, and who benefits from this article. It only confirms my mistrust.

As I’ve said before, Microsoft has no influence on what MSNBC writes. And Microsoft is only one of many companies involved in the Trusted Computing Group. I disagree that the “vast majority” of the country mistrusts all big companies; actually, I think the vast majority of the country doesn’t think about it that often. It’s pretty hard to buy much in this country that isn’t made by a big company that’s out to make a buck. That said, I’m quite sure one will be able to opt out of using any kind of TPM-based technology, just as one is able to refuse to buy any product if you don’t trust the motives behind it. To use Tom’s own example, many people do all of their computing without ever directly using a Microsoft product.

William Upshaw, Atlanta, GA: I bet the Department of Homeland Security is giddy with anticipation of this chip, so they can find out who hasn't been purchasing the required amount of duct tape. I am not a huge fan of the ACLU, but this sounds like a perfect issue for them to drag through the courts for about ten years. I only wish the EFF had longer and larger political teeth.

It’s hard to put anything past the current administration at the moment, but as I said in the original column, users can choose not to enable the TPM, or it can be used in ways that may actually increase one’s anonymity and ability to maintain encrypted communications. The Electronic Frontier Foundation has a very clear stand on the importance of anonymity; they will watch TPM implementations closely. And the ACLU has already been involved in a number of legal actions around online privacy. Both organizations deserve support from anyone who shares William’s concerns.

CONTINUED

< Prev | 1 | 2 | 3 | Next >

Discuss StoryOn Newsvine
Rate Story:
View popularLowHigh
Email
Instant Message
Print