Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TPM provides zero practical security

gist.github.com

Post reply on HN
Print view View original

101–110 of 111 posts

Re: TPM provides zero practical security

#101

Post by mixmastamyk »

Nextgrid wrote: post #78
mixmastamyk wrote: post #65

Earlier quoted context omitted.

This "middle-brow dismissal" should be downvoted and flagged on the first sentence alone. Not be the top comment. The datacenter use case sounds useful—should have led with that.

I've edited my comment to hopefully clarify that I am talking about the piece and not accusing the author himself. My problem with the piece is that it reads like the usual knee-jerk pro-Linux FUD that typically originates around scare words like "Microsoft", "secure boot" and "UEFI".

I didn’t read it that way. Was spirited, but no insults that I noticed.

And it’s not like those “scare words” didn’t become scary for a reason. Your response starts with reverse FUD.

Re: TPM provides zero practical security

#102

Post by sim7c00 »

Nextgrid wrote: post #12

Unfortunately this sounds like a typical pro-Linux rant with the usual scare words such as "Microsoft", "UEFI", "secure boot", etc. To be clear, I am attacking the piece itself, not the author. The reason there is no explicit threat model defined in the TPM specs is because it defines a general-purpose hardware security module. It is up to integrator to define the threat model (TPM's security properties also depend o…

you are right that tpm and such technologies are a right step, you have to start somewhere. (i know it didnt start at tpm ofcourse). The author is also right that some claims are too markety while in the real world device are still vulnerable. The piece also goes on to say theres further efforts such as TXT etc. taking place, so in essence for me it reads like you mostely agree. microsoft, uefi etc. arent scare words here imho, they are very closely related to claims made and technologies involved.

I thought the piece was ok, but it doesnt add anything new. its another piece pointing at the puzzle a lot of people including you already know exists. its not aimed at you for that matter. (so fair comments, but perhaps a bit harsh?)

Re: TPM provides zero practical security

#103

Post by nine_k »

candiodari wrote: post #97
nine_k wrote: post #93

Earlier quoted context omitted.

If your data is this valuable, you certainly do backups? I suppose something like cloud backups is now built-in into windows, and would save your Documents (and maybe more) also by default.

Windows backups are subpoenable by half the governments on the planet, who have bad actors in them, and may also have exploits for dedicated attackers because they present a huge target.

If your threat model includes state-level actors, I wonder why you consider running Windows at all, or at least not in a highly secured transient VM.

Re: TPM provides zero practical security

#104

Post by AnthonyMouse »

nine_k wrote: post #93
AnthonyMouse wrote: post #57

Earlier quoted context omitted.

For the typical user, losing their data is a greater risk than someone with physical control over their machine being able to access it. The logic board in your computer fails or you forget your password and all your data is gone . And the default way of mitigating it is an even worse security risk. Now all your data is on some cloud somewhere, waiting for that vendor to get breached or your account to get phished wh…

If your data is this valuable, you certainly do backups? I suppose something like cloud backups is now built-in into windows, and would save your Documents (and maybe more) also by default.

We're talking about ordinary people here. Their data is valuable to them because it's their pictures of their grandkids and their draft of the Great American Novel and their recipe collection. They're not backing it up themselves, they don't even know how.

But it's also their copy of all their bank statements that include their routing number, which nobody who is physically in their house is going to use against them but is a serious fraud risk if it can be accessed remotely on some cloud.

Re: TPM provides zero practical security

#105

Post by saagarjha »

lostmsu wrote: post #98
sudosysgen wrote: post #61

Earlier quoted context omitted.

If the attacker can replace your bootloader, why can't they just get the decryption key from the kernel later? And if you did have Secure Boot, then using a password with encryption at rest is just as secure : you can't change the bootloader and you can't change the OS (since it's encrypted), so you can't exfiltrate the password. The end result is that the TPM doesn't have a practical benefit.

The bit about "two touches" seems to imply physical access, so in absence of TPM the attacker can replace your bootloader with little effort vs with TPM they'd need to break TPM.

You can fix this by asking for the password before letting the attacker replace the bootloader.

Re: TPM provides zero practical security

#106

Post by saagarjha »

EPWN3D wrote: post #88

Not a great take. The TPM provides the primitive of "non-extractable keys"; it's not supposed to magic up secure boot. Even then, the argument that a TPM is worthless because it can't guarantee that software is free of vulnerabilities just belies an un-seriousness of the post. Like okay, that argument applies to every threat model ever. A boot chain can be secure with or without a TPM. The TPM just says "I'll record…

TPM relies on every link in the chain up to your OS being free of vulnerabilities. If any part has a bug, then the TPM is broken. For this kind of model, why not just put the data in one of those layers then? You've said that it's secure already.

(Most other threat models go "ok we trust some part of this is secure, and that means we can guarantee x, y, z; if that part is not secure then we cannot do this.)

Re: TPM provides zero practical security

#107

Post by saagarjha »

helloooooooo wrote: post #17

Ask Google exactly how they enforce their zero trust, VPN-less remote work environment. Hint: it has to do with the TPM. DRTM + Device Certificates + TLS Token Binding is a huge deal for proving that the endpoint is trusted, and that the principal actually logging in is using an approved device. DRTM prevents boot time tampering by assuring that the measured boot state is consistent with what the network expects.

None of my machines when I was at Google implemented this. The attestation was a bunch of scripts running on my computer that cobbled together the output of various things they cared to validate.

Re: TPM provides zero practical security

#109

Post by lostmsu »

saagarjha wrote: post #105
lostmsu wrote: post #98

Earlier quoted context omitted.

The bit about "two touches" seems to imply physical access, so in absence of TPM the attacker can replace your bootloader with little effort vs with TPM they'd need to break TPM.

You can fix this by asking for the password before letting the attacker replace the bootloader.

Sorry, I missed the bit about Secure Boot.

Yes, with Secure Boot and password your data is safe. But you have to type the password to boot your system, which is impractical for remote and headless systems, or even local systems that need to be available remotely.

Re: TPM provides zero practical security

#110

Post by TowerTall »

> The Trusted Platform Module(TPM) requirement enables Windows 11 to be a true Passwordless operating system

Good luck trying to remote (RDP) into a Windows box with a passwordless account or to access a fileshare.

While passwordless Microsoft accounts are very convenient it is only according to MS Marketing department that windows can be a true passwordless system. In reality it is not. There any several components in Windows that does not work with a passwordless account. The RDP and network issues has been know for many years and is a PITA for home networking.

Post reply on HN