Eric Norlin, Peter Biddle, Steven Sprague (and guest appearance by Cory Doctorow)

Peter Biddle: Perimeter security no longer works. Enterprises are porous. Laptops disappear. CEOs use phones to do transactions with no proxy security, no WEP. Full access to email, databases, decisionmaking processes can be picked up on the table at Starbucks. Microsoft's response (Trusted Computing, NGSCB) is contextual: a user with specific needs when using a specific device.

Steven Sprague, Wave: Works on how to manage and deploy strong authentication in a simple manner. This is very powerful, inexpensive technology for anyone involved in enterprise security (and there are some widespread misperceptions about it). Right person walks up to the door, door opens, preferably automatically. Wrong person, preferably he's electrocuted.

Cory took the mike to describe the EFF's mixed feelings about Trusted Computing. You'll never find a better friend of crypto than the EFF. The EFF's problem with Trusted Computing is to secure the computer against its owner. When you take away the ability to control your own computer, you open the door to anticompetitive activity that harms not only individuals but enterprises. We see things like forced downgrades (iTunes, reduction of features), IP litigation issues (NGSCB under fire for patent violation). EFF's solution is Owner Override (telling beneficial lies, in the tradition of Samba), but it loses us certain things like DRM.

Question to Peter: is the charge correct? In the gains v. losses calculus, the gains of Trusted Computing from an overall policy basis win out. The EFF's paper is fair, but it's wrong. On a system that has owner override, you have the ability to lie in a way that makes it impossible to detect the difference between lies and truth. So why would you trust an attestation if you know there's no guaranty of reliability?

Steven: Preexisting trusted relationships (your mom) vs. anonymity. If you wanted to reinforce the strength of software attestations, you could. Today, the ability to ensure purely virtual relationships that are not 100% fraudulent does not exist. There is a strong societal demand for better and context specific control over what and who goes where.

Peter: points out that we engage in cultural imperialism when we think we can build technology that takes into account globally applicable copynorms.

Cory: but you also shouldn't build software that takes away the public's copyrights, fair use rights, first sale rights, by default.

Steven: the consumer has done an excellent job of voting with his or her feet on this sort of thing.

[...]