161–170 of 273 posts
Earlier quoted context omitted.
Mine, and I like it to stay that way. A TPM can be a valuable tool for protecting my data, making it difficult if not impossible for anyone to decrypt my drives. TPM+PIN is hard to beat.
TFA literally shows a TPM+PIN is totally insufficient to protect your data
Earlier quoted context omitted.
You have no idea who designed the thing, who manufactured it, or who swapped it out while it was in shipping to you Wait, what? In most cases you 100% know who designed and manufactured it. Regarding "swapping out" a TPM, how do you do that for fTPMs or TPMs that are on the same die as the CPU? Come up with a perfect replica AMD CPU with a bugged TPM? Desolder the original CPU and put the replica in?
I think if you went back in time, you'd find people saying that openssl was developed by a consortium of open source contributors. It's painfully obvious nowadays that openssl was written by the NSA (or equivalent state level entity) via intermediaries deliberately adding subtle but significant vulnerabilities. Let me propose this metaphor: you buy a front door to your house. For some reason I (the door vendor) inclu…
The problem is that your lack of context and perspective on this fairly simple, easily-falsified theory calls all of your opinions into question.
A more nuanced conspiracy theorist would say "if you look at PR's to openssl that contributed later-discovered security issues, 70% were from first-time contributors who never went on to submit any other PR's". And I'd be like "wow, that's suggestive of a coordinated action", and we could dig into it.
But "the NSA wrote openssl" is as factually, demonstrably wrong as saying "the NSA builds every door lock that's for sale at Home Depot". It's too big of a conspiracy, to inefficient for the supposed state goals, and too easy to falsify by just looking at a couple of examples.
Earlier quoted context omitted.
if Linux full disk encryption would have a more user friendly UX a lot of Linux users would probably use that too its a very convenient feature through is not convenient to setup and a lot of Linux users never trusted it to be secure, i. e. a lot of people expected an attack like this sooner or later
The current state of userfriendly is quite good. In Ubuntu it's just a checkbox in the installer and input a passphrase.
Earlier quoted context omitted.
[flagged]
I'm a windows user since 3.1 and don't know much about linux except the few trials and my pihole. What's the impact of having systemd (or not) for the everyday layman like me that just uses Visual Studio Code to build flutter apps ?
Nothing. I run Void Linux Musl with XFCE and I have no issue running Steam and other big glibc programs in Flatpak, docker, etc.
Earlier quoted context omitted.
Tampering with the bootloader is game over. And what, are you keeping this other bootloader medium on your person and in your sight at all times? It's never ever unattended?
Using TPM with closed source firmware, especially written and designed by Microsoft, probably full of backdoors, when you don't even know what it's doing is a worse choice.
Earlier quoted context omitted.
I think if you went back in time, you'd find people saying that openssl was developed by a consortium of open source contributors. It's painfully obvious nowadays that openssl was written by the NSA (or equivalent state level entity) via intermediaries deliberately adding subtle but significant vulnerabilities. Let me propose this metaphor: you buy a front door to your house. For some reason I (the door vendor) inclu…
> It's painfully obvious nowadays that openssl was written by the NSA The problem is that your lack of context and perspective on this fairly simple, easily-falsified theory calls all of your opinions into question. A more nuanced conspiracy theorist would say "if you look at PR's to openssl that contributed later-discovered security issues, 70% were from first-time contributors who never went on to submit any other…
You might for example, just outright buy out the cryptography solution providers:
https://en.wikipedia.org/wiki/Crypto_AG
Money is a relatively simply mechanism to achieve an end goal. Much safer than for example, torturing someone or beating them with a wrench.
Earlier quoted context omitted.
Would it? Apple crippled iCloud image encryption for years at the request of federal LEAs.
Can you share a source for this please? Not finding anything useful.
I figured it would be generally known at this point, especially with the whole perceptual hash debacle (intended to satisfy LEAs despite the plan to finally enable image encryption). I'm not sure what the internal politics looked like after the perceptual hash snitch got axed - my friends who would know quit Apple by then.
> Our attacks have shown that an fTPM cannot sufficiently protect its internal state against firmware or physical attacks. In such a scenario, a passphrase-only key protector of reasonable length provides better security than a TPM-only protector with a numeric PIN (5.3.1). This is in stark contrast to Microsoft’s claim that “BitLocker provides the most protection when used with a Trusted Platform Module” [29] (see a…
Not only do they hide it under a group policy even when you enable an "Enhanced PIN" there is a maximum length of 20.
Why not simply abandon TPM and focus on making simple, trustable, massively parallel general-purpose hardware without backdoors for spy agencies and corporations? Whose computer is this, anyway?
Mine and I want a TPM, it's a device essential for modern laptop security. _Even if you would be able to control every bit of firmware on your computer and there was no DRM or similar you still would want a TPM!_ through potential a different implementation and not some of the features build on top of it like something like a TKey integrated into your CPU with some additions for securing the boot chain (including the…