the 8cx is infected with a remotely accessible
Pluton is not only not remotely accessible, but it was designed to be pretty much as inaccessible (outside of a VERY good spec) as is possible--not even the packaging facility should be able to tinker with Pluton devices.
This is in large part meant specifically to piss off intelligence agencies.
rootkit that you can’t block or remove
It bares no resemblance to a rootkit.
The idea is that Microsoft can update your firmware
Pluton does not allow Microsoft to update your firmware. Your firmware allows Microsoft to update it, and Pluton allows Microsoft to make the update process slightly more secure.
Think SecureBoot, but for all firmware components on a machine, among a few other things that you may want to include in device attestation.
validate your platform
I'm not sure what the issue is with this.
[to] encrypt
But this is like pointing to an enigma machine, or the OpenSSL website, or to Intel's AES instructions, and saying that it can encrypt/decrypt anything.
Like, it's technically true, but I'm not sure what the problem with that is.
decrypt anything
It cannot decrypt arbitrary data on your machine.
push or remove keys
To the extent that this is a thing, it's a feature of just about all TPMs. It doesn't introduce any security risks that don't already exist (to a much greater extent) in any counterfactual.
and much more
This is a copout.
all silently without your permission, knowledge, or ability to block
I'm not quite sure where this is from, but these things are unrelated to Pluton and still not necessarily true.
This block literally allows them to do anything they want to your PC remotely
Not true.
You won’t even know they are doing something if they don’t decide to notify you
Who are "you" and "they"? Pluton just provides some APIs. It very literally doesn't do anything unless you notify it.
And any government can ‘request’ that Microsoft pull anything on your PC and give it to them
Windows doesn't have this capability, but to the extent that such a style of attack could be orchestrated (and it'd be very expensive and hard), it'd be marginally harder in a world with Pluton.
the TPM in Pluton holds the keys for disk and memory encryption so that becomes a moot point
Memory encryption and disk encryption are transparent. It was a moot point before Pluton. In fact, on Xbox One at least, that's all outsourced to AMD's PSP (which is way more powerful and likely to have vulnerabilities than Pluton)
Basically it blows away anything you can do to secure your data and system on Windows
It does the opposite by providing a root of trust with which you can enhance other security measures in a defense-in-depth approach. It doesn't even compromise any existing security stuff.
Pluton is touted as being able to recover a non-booting machine so if the OS isn’t active and Pluton can fix it, that means someone isn’t telling the truth.
I'm not sure what "recover a non-booting machine" is referring to, but these can all be true under a few conceivable conditions:
- Pluton devices can support various "capabilities," not all of which have to be enabled by an OEM. Whatever this recovery thing is, it may be an optional capability.
- "Recover" can refer to a support function for e.g. validating a recovery bootloader
- A miscommunication regarding "recover a non-booting machine" or other documentation