Register for free to join our community of investors and share your ideas. You will also get access to streaming quotes, interactive charts, trades, portfolio, live options flow and more tools.
Register for free to join our community of investors and share your ideas. You will also get access to streaming quotes, interactive charts, trades, portfolio, live options flow and more tools.
I meant enterprise customers generate sales (billings)...the meat of the matter! Wave can PR all the product they want but if they don't generate enterprise sales it IS all fluff.
I'm sure you know that Wave gets sales in the enterprise space first...it's where their last four years of approximately $30m yr. billings come from...bundling on enterprise PCs, tablets and SEDs, enterprise software sales and consulting...all enterprise related. Consumer hopefully follows somewhere down the road!
alea, all true but here's the last sentence in the announcement:
Enterprise customers looking for the TCG Opal 1.0 compliant KC300 solid state drive should contact their local Kingston sales representative and for more information about Wave, visit
http://www.wave.com/products/embassy-remote-administration-server-self-encrypting-drives
"One thing I suspect most folks have kinda grasped by now is that building infrastructure is an endless task. There are always going to be new devices."
TPMs are now present across, for all intents and purposes, 100% of an enterprise's PCs. Still some Win XP out there which is harder to remotely deploy TPMs on but it's finally being phased out. Enterprise tablets except iPad have TPMs. TPM or TPM-like capability is in the works for enterprise smartphones.
"Wave needs to find ways that make them appealing to their current customers and prospects. If they succeed in that, they have a business."
Solms has been indicating that there is significant customer (including large customer) interest in TPM-enabled Virtual Smart Card and device ID. These can be large enterprises who are looking for an as secure and more cost effective alternative to the use of external authentication tokens such as RSA SecureID, Vasco and many others. So we'll see if this "interest" translates into orders. It may because it does make a great deal of sense to move the "root of trust" if you will from an external token which are expensive to maintain into the device where it can't be lost and requires zero physical maintenance.
Solms has also indicated Wave is rapidly moving into the smartphone space and that is definitely not imo a matter of speculating on some distant opportunity because smartphones are widely deployed in the enterprise population (both commercial and gov't) and it's imperative that Wave TPM or TPM-like solutions be made to support these devices.
I recall my encounter with Steve Hanna a TCG worker and employee of Juniper Networks at the 2010 Interop when I asked him why Juniper hadn't deployed their TPMs. He pulled from his pocket his RSA token device and replied that he can use it to access his company's VPN from his smartphone something a TPM couldn't offer because TPMs were on PCs only. Anyways if Solms indicates Wave is moving into smartphones something must be up.
PKI only because the use of TPMs by the enterprise for hardware (TPM)-secured device/user authentication to network resources requires the use of PKI certificates (private keys stored in TPM). Naturally if PKI certs are to be used for devices equipped with TPMs, then the IT dept. wants one common certificate-based implementation for all their network access devices not just those with TPMs. This is where external authentication tokens have had an advantage over TPMs. They can be used from any device including smartphones. Once TPM or TPM-like capability is available on smartphones Wave will finally be able to offer the customer one common ERAS-managed solution across all devices not just PCs that have TPMs.
Thank you alea. I do wish SKS would have had the good sense to build more PKI services going back to the early days of TPMs shipping on enterprise PCs. This would have given TPMs a better chance of being adopted earlier because PKI certificate keys could be deployed on non-TPM machines as well. It also might have meant Wave supporting PKI on pre-TPM smartphones years ago.
Wave needed an enterprise solutions veteran leading the company many years ago.
Thanks for the info.
"Think about your SSL or VPN connection. Those connections are set up via a software token (key) that is exchanged between two devices (PKI).'
And that soft key can be spoofed and migrated to the intruder, correct? If so can't a TPM be of benefit? Actually I think you answered yes with your comments below:
There is absolutely no client/server hardware based device authentication (Essentially you can make that connection from any hardware that has the appropriate software installed (browser, VPN Client, etc..))
Of course it would be beneficial to be able to know for certain that the physical device making that connection is an "enterprise owned", or "enterprise aware" device. That's one major advantage to the TPM right? I can limit the domain of authorized devices in a h/w based "white list".
"Tell me. What can Scrambls do that PGP can not?"
Good question. I don't know the answer but a question might be does a TPM potentially offer secure storage for either PGP or Scrambls keys? I believe Scrambls was designed to use a TPM but it's initial free version doesn't have the capability.
I know you're an enterprise IT person so I was asking if the current data in motion encryption solutions you reference as being superior to Scrambls but yet need improvement in their ability to be deployed and managed in the enterprise are PKI-based. If so I would be interested to hear your opinion if they can benefit from TPM security.
So is that technology PKI-based? If so TPMs should be of value to it's security.
Who knows perhaps Solms sees potential for enterprise sales of Scrambls product. Scrambls keys can potentially be secured by a TPM and there is a need for better and easier and to use encrypted data in motion communication in the enterprise.
I'm expecting a Scrambls update in the earnings call and hopefully we'll learn one way or the other if Scrambls solutions have near-term sales potential in the enterprise markets both gov't and commercial. If not then I expect it to be good-bye to Scrambls for Wave.
Maybe Scrambls is indeed tied up in the SKS severance issues. We should find out next month.
Apparently the CEO needed months not days to determine an accurate figure for what goes out the door every month in payroll and other expenses?
In other words the CEO has gradually come to realize the cash crunch is bigger than initially thought?
A competent CEO taking over the company would quickly determine from the gitgo an exact cash burn and formulate a plan to cut expenses, increase sales and perhaps use the ATM to improve the balance sheet in order to foster a better environment in which to do business. We'll get an update in the call on how Solms is doing but I think it unlikely at least that "he" found the "cash crunch to be bigger than intitially thought". Maybe you meant "us" lol.
"my guess is that the mnos will adopt and own the tpms in their mobile phones and they may want to license the m-tan (or equivalent) for a fixed fee in the controlled distribution of trustlets."
What can a TPM do for an MNO that Trustonic TEE can't?
http://www.marketwatch.com/story/ils-sponsors-new-technology-center-at-southwest-tennessee-community-college-2013-02-19?reflink=MW_news_stmp
"Where is there any evidence that Solms has taken the steps normally associated with a "turn around specialist" (Cutting unprofitable business units, trimming > 200K a year family perk jobs, etc...)"
Where is there not evidence? Ie. it remains unknown. If it's unknown can we "assume" nothing has happened?
"There is no evidence, there have been no announcements, the issue was avoided on the last CC, *that IS* business as usual."
Right, there is no evidence. No evidence ie. announcements means one can assume it's "business as usual"? There would be announcements relating to specific cost trimming measures and other improvements to the organization?
"As for the speculation, when the losses continue and the money drain of Scrambls, e-Sign, Michael, Peter, continues, there are only two choices:"
Speculation indeed, in fact do we even have numbers for the supposed "Scrambls/e-Sign/Michael/Peter drain"?
I would like to learn that cost cutting and other measures such as improving the sales culture and other aspects have put Q4 and Q1 on a sustainable path to CFBE, but at the same time I recognize we may have to wait for the next earnings call to find out vs. having expectations that specifics relating to cost cutting and the such will be announced separately.
Vendors and carriers and make their living by giving the consumer and the enterprise what they demand.
By the above I meant the ability to put on their device the apps users want just like a PC ie. keep giving the user what they demand in terms of downloading what they want not what the vendor or carrier dictates they put on their device.
Like the banking industry?
These folks have shareholders to satisfy. And shareholders are satisfied by increasing cash flows.
What do the apps and access the banking industry provide their customers via the internet have to do with the vendors and carriers? The user is happy to access their accounts via on app they download to their phone.
If you mean methods for mobile payments that is currently handled via UICC/secure element but it could move to TEE. In any case consumers get what they want today which is to make payments using mobiles. Who cares about vendor/carrier control? Users just want to do the transaction.
Trust the carriers and the vendors with the key to my identity, my wallet, my front door, my health records, my love letters, my interests, my transactions, my confessions, my devices, my software, my music, and my safe? Er, no. I'm not quite that naive! wink
How does the user having a secure container such as TEE or TPM give the vendor or carrier access to their personals? Already we have players tracking us through cookies etc. on PCs etc., how does the TEE/TPM on mobiles make this any worse? In fact it should provide better privacy.
If TC is to become a reality it means a transition from the current user-based model with credentials secured in hackable software to a device-based model where the device credentials are secured in hardware and multiple user credentials are then secured to each device also in hardware. Finally the keys for these credentials will be unhackable, the identities they represent no-spoofable. Finally, security and thus privacy for the user.
Everybody will benefit from a non-hackable/non-spoofable environment; consumers, enterprises, vendors and carriers.
Where will the consumer or enterprise lose the choice of what they put on their devices?
How will vendors and carriers control what consumers or enterprises put on their devices if the choice belongs to the consumer and enterprise?
Vendors and carriers and make their living by giving the consumer and the enterprise what they demand.
Supply and demand.
With all the long history of dialogue about the inaccuracies of SKS's talk you sure lend a lot of credence to his quotes in that TCC article. It's almost as though when what he says suits your position you embrace it but at other times we speak of talk of his in a different light.
I know you implied when I posted this before that he must have been waxing optimistic for the ears of shareholders and potential investors and I don't agree. I do not think between when the below comments were made which I consider an accurate portrayal of reality at the time and when the TCC took place five months later that anything material changed. That is, vendors were planning on putting TPMs in then, they were at the time of the TCC and they still are. Bear in mind I do not care a great deal one way or the other because first, PCs get deployed first, and second, even if TPMs were ready today in devices other than Windows Phone 8, there won't be immediate enterprise customer demand to use them. If TPMs were broadly available today (ie. on more than Windows Phone 8) how many large organizations would Wave or any other vendor be bringing to carriers anytime soon requesting TPM provisionment (for pilots)?
So clearly, you can't go out and buy the devices yet, handheld devices with TPMs in them. There are a few from Microsoft, there will be a lot more. I think the marketplace will be a little bit surprised by just how broadly that becomes available. If we believe what we're being told by the supply chain and the infrastructure and the players that are out there, I'm a little jaded. They all think it's going to be second quarter sometime. It's not, it's going to take them this whole year. But it will begin to show up in scale. And I think that it's a -- we've seen this process, it's takes a while for everybody to pay attention. But you're going to have a generic capability to put keys in a mobile device.
"The only way we can wrestle control back from Verizon is through a requirement placed on the environment by a player strong enough to do that," he says. "The only player -- emphasis on the word 'only' -- is the U.S. federal space."
In my opinion at the time he made the TCC comments, vendors and carriers had already conceded a roadmap for TPMs but that doesn't mean it happens per any specific timeline. The advantages for all players to give the enterprise better security is clear but is the deployment ready for primetime? Put all the technical procedures in place but will customers use it? Look at PCs. We're still waiting.
You can take the "wrestle control" terminology literally OR you can look at SKS's March comments, the continuing development work in TCG/GP, the lack of customer demand for TPMs and come to the conclusion that it's not about Verizon giving up control it's about Verizon waiting for primetime.
Why would Verizon mind giving an enterprise control of a TPM root of trust when Verizon could use that same root of trust to sell services to the TPM's owner?
Why would Verizon mind giving an enterprise control of a TPM root of trust when Verizon still controls the UICC?
Why would Verizon mind giving an enterprise control of a TPM root of trust when Verizon can sell services that use the TEE?
Come now.
You and I individual uers will still choose our own apps. Perhaps a TPM will be provisioned to us but it will protect our identity from hacking and malware.
The control you are referring to is that which the enterprise must demand over their users but only as regards accessing enterprise assets. Your personal stuff on your BYOD is still yours, your choice and protected by the TPM.
If the carrier controls the TPM, it isn't TC. It's a secure device that is still controlled by a third party.
Well no, after taking ownership of the TPM, the carrier provisions the device owner ie. you or me into the TPM as the only authorized device which is immutable. It has the same result as a PC TPM ie. only the device owner is provisioned to the TPM, nothing else.
I'm not sure why the TCG procedure has the carrier taking TPM ownership on behalf of the user. There has to a technical basis for it.
But the carrier does have to perform the take TPM ownership process (on behalf of the device owner). Could this, and not MS releasing their API, be the missing link in Windows Phone 8? If an enterprise customer wants to deploy TPM-enabled Windows phones. I assume the carrier has to provision the TPM activations.
If not that, try some other incremental service.
Being core to deploying TC, VSC is actually a large step not an incremental one. In fact "Virtual Smart Card" the term coined by MS for Win 8 is actually what Wave has always offered going back to XP, it's just that MS named the capability and made it easier to provision in Windows than previously.
Part of Solms' strategy is to do a better job than before marketing and selling Wave VSC to the customer, but make no mistake if an enterprise deploys it, they've deployed TC, actually a large step.
I saw it. It's along the lines of what I think is needed to deliver a top-down solution. Or the beginning of the process.
It also kinda supports the view that it isn't going to happen on its own - eg federal government encouragement is required to put TPMs in tablets and phones. [I hear an echo of the words of SS in this sentence]
Do I have faith that the recommendations will be followed by the US government when implementing policy? No. I'll wait to see if they are. Incumbent influence lurks along this road.
Solms has connections in the military and experience selling IT solutions to the gov't.; perhaps he can use them to Wave's advantage in selling Virtual Smart Card. Using Wave's TPM zero-touch technology (backwards compatible to Win Vista), Wave VSC is a relatively easy integration into the customer's existing infrastructure.
The PCAST report may not be a bad thing for Solms and Wave as a sales talking point, in fact I saw he was interviewed for the DarkReading article.
http://www.darkreading.com/vulnerability/presidential-council-calls-for-feds-and/240164291
I'm cautiously optimistic Wave VSC is a viable entry point into large organization TPM deployment. There is already PwC. We'll see.
"TC still faces enormous barriers to entry."
That's a pretty bold statement, especially from industry outsiders like us. We're not the ones pitching the enterprise.
See Pg. 1:
http://www.whitehouse.gov/sites/default/files/microsites/ostp/PCAST/pcast_cybersecurity_nov-2013.pdf
(Note: XP is the least TPM-friendly Windows OS.)
Finding 1: The Federal Government rarely follows accepted best practices. It needs to lead by example and accelerate its efforts to make routine cyberattacks more difficult by implementing best practices for its own systems.
Recommendations:
• Phase out within two years the use of unsupported and insecure operating systems, such as Windows XP, in favor of modern systems, such as current versions of Windows, Linux, and Mac OS.
• Encourage the universal adoption of the Trusted Platform Module (TPM; an industry-standard microchip designed to provide basic security-related functions, primarily involving encryption keys), including for phones and tablets.
• Encourage the universal adoption of the latest, most secure browsers to facilitate prevention of identity theft.
• Move toward nationwide availability of proofed identities for people, roles, devices, and software. While voluntary in the private sector, these should be mandatory for transactions and data exchanges among Federal users.
• Encourage effective Federal use of automatically updating software, including cloud-hosted software, both for COTS and GOTS2 products.
"For my guess, I think MS/Nokia and the carriers are both aware of the meaning of TPMs to their businesses and the current status of the negotiation is that the networks are willing to permit vendor use of the TPM but not adoptive use by subscribers."
I'm not sure what "vendor use" is, but the carriers themselves might in the future be able to offer subscriptive services that use the TPM to secure keys and do cryptography, applications for which the design and capabilities of the UICC are not suited.
New Wave...
So is it your impression MS has an agreement with their carriers relating to releasing the fTPM API?
All four major carriers now offer Windows Phone 8 with Sprint being the most recent.
http://www.sprint.com/landings/windows8/
Also I wasn't clear the DoD is currently running MOBILE TPM pilots or is it that they haven't started and are planned for 2014?
Tia.
"It is perfectly reasonable to focus on the PC space and to hope for an adoption mandate in mobile government."
But it may or may not take a mandate from gov't.. Demand from the enterprise space may be enough. We'll see. Don't forget there is already Windows Phone 8 which is a starting point. Windows Mobile IS a small market share but so is enterprise the smaller market vs. consumer.
"But I don't think you give sufficient thought to SS' opinion that the carriers and vendors currently block the way in mobile. Ignoring it is a surprising response. I don't think you can just imo your way past it."
I don't exactly ignore it, where did I show I ignore it? I discount it down some from how you view it. I believe a more important point than the posturing of SKS during the TCC, is the matter of demand itself from the enterprise, yes including gov't and fine if there comes a federal mandate but a "mandate" could just as easily be in the form of enterprise customers asking for the same solution they have on PCs. Again, deployment is possible in Windows Phone 8 so it could begin from there without a "mandate".
I indicated in a much earlier post that Steven's comments could have been a form of SpragueSpeak. He has a way of going off on historical tangents when he gets going on a subject. I agree a federal mandate would get TPMs on mobiles but then you have to get customers to use them just like with PCs. In my opinion the key driver for inclusion of and subsequent enterprise implementation of TPMs on mobiles will be their adoption on PCs.
Hello New Wave...
You made the same point I've tried to make in vain on this board that enterprise demand for TPMs on PCs is what will drive the inclusion of TPM MOBILE, not the MNOs "releasing their grip" on their perceived "UICC monopoly" per se. In fact the MNOs imo will embrace TEE including TPM MOBILE running on it once demand to use these technologies evolves to the point where applications are being deployed to use them, because they as service providers and deployers of apps are in as strong a position as any player to make money in TEE including TPM MOBILE.
So whether it's gov't or private enterprise or consumer driving demand, the demand will show imo and TEE including TPM MOBILE will be utilized and the MNOs will be among the players who benefit.
A weakness with the MNO UICC monopoly argument is that it lacks a technical basis by assuming UICC can do everything TEE including TPM MOBILE running it can do. Another weakness to the argument is that MNOs have zero to gain from TEE. In fact if one does a token amount of DD in this space there are indications of MNO interest in TEE, yet the UICC monopoly position remains intractably entrenched.
But yes, this discussion is first about adoption in the PC space, again what I emphasize here adnausem yet I continue to be pigeon-holed as a dreamer banking on some far-fetched mobiles paradigm...not!!! PCs come first!
More TEE:
The Global Platform TEE whitepaper:
http://www.globalplatform.org/documents/GlobalPlatform_TEE_White_Paper_Feb2011.pdf
(Pg 7):
MNOs' UICC architecture has it's limitations. Imo MNOs will use the TEE to deploy services and apps for which the UICC is not suited.
Mobile Network Operators: MNOs are considered reliable partners for service deployments on smartphones. The use of a UICC (usually owned and managed by the MNO) is relevant to deploy some services, but for some applications that exceed the resource capabilities of the UICC, there is a need to have a higher level of security than what the Rich OS offers. The Advanced Trusted Environment: OMTP TR1 specification1 provides a mechanism to satisfy this requirement by delivering a comprehensive security roadmap aligned with current threats, business opportunities, and the overall industry
objectives of achieving hardware-backed security.
Again, MNOs as service providers can deploy their app products in the TEE including a TPM MOBILE running in the TEE, apps the UICC can't properly host.
OS and Application Developers: A well-defined and standardized TEE allows defragmentation and creates broader alignment in the industry around commonly deployed security frameworks and associated software and APIs. This allows for a large ecosystem of application vendors in numerous segments and industries, which ultimately leads to greater economies of scale.
TCG and Global Platform are converging, in fact Microsoft Phone 8 has already deployed a TPM in TrustZone TEE in conformance with the TCG/GP standards.
In 2012, GlobalPlatform and the Trusted Computing Group (TCG) created a joint work group to enable the sharing of expertise and collaboration around mobile device industry standards. This white paper, the first joint work item, introduces how GlobalPlatform's defined TEE standards and TCG Mobile Trusted Module (TPM MOBILE) can work together in mobile devices to provide security, peace of mind and enhanced services to users.
http://www.globalplatform.org/documents/whitepapers/TPM_MOBILE_with_Trusted_Execution_Environment.pdf
barge, I believe there is room for everybody on mobiles, everybody being iOS, SIM/secure element, TPMs, other.
Imo TPMs in TrustTonic will come to mobiles in scale but no way will they subsume SIM/secure element.
SIM/secure element is better suited for some stuff, TPMs for other things (especially control for enterprises of their networks which SIM/secure element can't do in the same way), and Apple can stay with their model which is fine for the MNOs (they provide access to and sell services to zillions of iPhones) however Apple will ultimately lose the gov't and enterprise if they don't include TCG.
Courtesy of 4321:
http://www.cs.helsinki.fi/group/secures/CCS-tutorial/tutorial-slides.pdf
The guys including SKS on the TCC panel know TCG is coming to mobiles whether the MNOs like it or not, they were simply imo framing their comments around "historical challenges" not the reality taking shape ie. that enterprise will demand TC phones, a demand MS has already anticipated in launching their own line of Windows 8 Phone. Imo Android phones for the enterprise are next.
My call is that Windows phones catch on in the enterprise. This is because most enterprises are dedicated to a Windows environment, Active Directory (AD) and all the rest of it. Everything Windows they do will get cleanly ported to their phones. No more lack-of-AD hassles.
"I think you are struggling with this. Let me try again to state the position I outlined from the beginning."
If someone wanted Scrambls enough to offer to buy it outright, then Wave should take the full offer vs. a lower one and retain an ownership is what I assume would be the endorsement of an observer who was of the opinion Scrambls is worthless. That way Wave collects more cash.
Whatever.
Possibly if there is some transaction involving Scrambls Wave WILL retain a stake. That is why I'm interested to see what Solms does.
barge, Apple came up with a great product in iPhone and it was so good the MNOs had no choice but to sell it because everyone wanted it.
So Apple ended up with control of their own root of trust and the MNOs are very happy to still have their SIM/secure element. Do you see MNOs complaining about the Apple control aspect of iPhones? I don't see the MNOs complaining about the Apple control part of iPhones. I do see them using their SIM/secure element to collect access fees and sell services. We have three iPhones plus one Galaxy on our family plan and Verizon is collecting.
The same will happen with TPM phones. Device makers like Apple (not necessarily Apple but Apple is a device maker) will build them because the gov't and enterprises demand it and the MNOs will still be very happy to use their SIM/secure element to collect access fees and sell services.
Did iPhone turn the MNOs into bitpipes?
Will TPM phones do the same?
"expat envisaged a scenario in which SS assigned some value to scrambls."
Apparently you did as well.
"you've misunderstood. we're talking about hiving off scrambls as an independent entity. there is no money to be lost in that scenario. scrambls would be responsible for funding itself. no obligation for wave. just a share of the ownership reflecting wave's previous investment."
First you indicated Wave retaining an interest in Scrambls is innocuous from a money losing perspective but after reading my opinion on what I assumed ExPat's position was you now indicate maximizing the value in a sale makes sense.
"If you assume someone is willing to purchase it, which expat did, and Wave is not willing to continue funding the business, then maximising the value in a sale makes sense."
My point was and still is, ExPat's initial position appeared to be sell the whole thing, but then he/she came to agree with you that a share of ownership would be OK because "Wave would not be losing money".
"Offer to sell it to him outright. It's LOSING money. Keeping any portion of it just exposes existing Wavx shareholders to additional losses."
"you've misunderstood. we're talking about hiving off scrambls as an independent entity. there is no money to be lost in that scenario. scrambls would be responsible for funding itself. no obligation for wave. just a share of the ownership reflecting wave's previous investment."
"Alea, you're right, I misunderstood. That makes sense. /EOM"
Imo ExPat meant to say in the first place was: Keeping any portion of it just exposes Wavx shareholders to an equity loss when Scrambls fails ie. sell out 100% now.
"Offer to sell it to him outright. It's LOSING money. Keeping any portion of it just exposes existing Wavx shareholders to additional losses."
"you've misunderstood. we're talking about hiving off scrambls as an independent entity. there is no money to be lost in that scenario. scrambls would be responsible for funding itself. no obligation for wave. just a share of the ownership reflecting wave's previous investment."
"Alea, you're right, I misunderstood. That makes sense. /EOM"
No, if your presumption is Scrambls is worthless and you are correct, you were right in the first place...cash out equity in full vs. a partial cash-out and lose the remaining equity when it fails.
It will be interesting to see what Solms decides to do.
Agreed telstar agreed (eom)
"A very under appreciated vulnerability in Information Security."
Using hardware to store the private keys is something for which there is apparently low awareness of in enterprises and service providers as evidenced in PKI applications such as those used in SSH, or if there is awareness for it it's not being implemented. TC puts it's private keys in hardware. SSH needs to do the same.
"I honestly don't know whether or not there's any kind of "key audit" capability in ERAS"
It's my understanding the TPM keys management capabilities that was once provided by Embassy Key Management Server has been incorporated into ERAS. ERAS is now differentiated into more than one product and each one has different levels depending on pricing.
Whether a Wave product today or a future one can support SSH keys, I really don't know but it's an interesting possibility I suppose.
"if there's no cross-platform purpose to wave, i wonder what other purposes it serves."
It relates to the enablement and management of Windows devices. Windows OS and the Windows Server don't provide all the software and management capabilities enterprises require. It's why a huge non-MS owned industry has been constructed around Windows enterprise devices.
"or put another way, without a cross-platform solution, what exactly is wave's value?"
You mean what can Wave provide on Windows 8 that MS can't?
Call me a risk taker but I recommend WAVX down here. Plain and simple. I'm not adding cuz I have enough for now.
You want more results first. I see the potential reward buying before something happens and the price doubles.
Different strokes for different folks.
"You also are giving no credit to "Shoulder Surfing" or Password Cross site usage."
But I did give credit to shoulder surfing. I then stated the intruder would have to gain posssession of the device.
You and I don't disagree that PIN sniffing is feasible on TPM-enabled devices, I'm emphasizing the point that stolen device scenarios account probably account for a very low% of network intrusions. My assumption is intrusions generally occur using unauthorized devices. I stand to be corrected.
"But I take heartfelt exception that " 'IT Guys' don't get it"."
Hey, that wasn't directed at YOU and I'm sorry if you took it that way; perhaps you didn't. Probably a better way to express my sentiment would have been "many enterprise IT folks aren't aware of trusted computing". Perhaps you disagree; see more below.
"But I take heartfelt exception that " 'IT Guys' don't get it"."
"It's a dismissive and arrogant statement."
"They most certainly do, and much better than your average layman on a message board."
My profession puts me in the convention business environmemt here in Las Vegas. Actually I have a great deal of experience introducing the TC concept over many years to my enterprise IT customers...tons of them. For a layperson to enterprise IT my awareness of and understanding of TC including the challenges implementing it in existing enterprise network infrastructure is exceptionally high for a layperson. Try me on some of the challenges. Name some and we'll talk.
A better way to put it is not "they don't get it" but "many are not aware of it".
"If you are making the claim that people managing MS devices don't get it, then you are making a claim about your own insightfulness against the experience of the folks running enterprise networks."
"I don't do that. I recommend anyone not to do it. Assuming that network administrators are collectively ignorant and/ dull-witted compared to Wave investors is a fairly bold stance."
"It's also a way to ignore an important variable. Rejection does not equal ignorance. It is its own thing and tells you something about folks' objective assessment of the product."
With all due respect much of the above is rather unfair relating to my own attitudes.
When one has enterprise IT professionals asserting that user tokens are better than device ID, or put another way that device ID doesn't have the potential to render tokens unnecessary, it's really a multi-faceted perspective. One facet is that the user-based enterprise network infrastructure is already deployed and entrenched and most professionals will resist displacing incumbent infrastructure and often for good reason relating to cost and practicality. Another facet is that many of these folks are simply not aware of the hardware device ID approach but when a TC expert mentions the SIM card analogy they "get it" which still leaves the matter of spending dollars to integrate device ID into a user ID infrastructure.
The legacy (non-SIM type) way of doing enterprise networking is deeply entrenched and it will take some scale TPM use cases to get the transition moving more quickly. It has started to move. PwC is working their way up to 150,000 Wave-enabled TPMs so it is moving.
When one sees TPMs working their way into all devices, they're not necessarily being used yet but the hardware vendors keep putting them in, and now Windows by far the dominant OS is building it's entire security platform around them and SEDs, it implies a paradigm in the making.
Your point about enterprises buying product (although some already have bought in scale) is valid, however with respect to buying WAVX ahead of more scale enterprise adoption (need I remind that Wave has an estimated north of 500k active ERAS licenses) that is a personal call of risk-taking. Was it good risk-taking to buy 1000 shares of MSFT in 1986 for $25,000 and hold it? I'm not saying there is a comparison between MSFT in 1986 and WAVX in 2013 other than risk-taking is a personal decision.
A keystroke logger would have to be installed on the device, the user would have to log on after the malware was installed and the attacker would then have to steal the device to use the PIN. TPM-enabled rootkit detection could detect the keystroke logger before the attacker was able to steal the device or if the attacker did steal it the user could report it missing and network access rights would be revoked.
Shoulder surfing would also require the intruder to steal the device after getting the PIN. The device would be reported missing and network access rights would be revoked.
Each of these attacks require physical possession of the device after getting the PIN, the Achilles' heel of both.
Device-based ID IS THE FUTURE, the paradigm that will supplant the user-based infrastructure currently in place. It's just taking the IT guys a long time to "get it".