> I'm going to be honest here and say that I don't know what Microsoft's actual motivation for requiring a TPM in Windows 11 is. It is quite obvious: to force people to buy a new PC. TPM provides no added security value for the vast majority of users[1] but it is a convenient hardware that has only started to become standard (fTPM) in PCs built in the last ~8 years so it provides an excuse for Microsoft to declare co…
> TPM provides no added security value for the vast majority of users[1] Yes it does. The vast majority of users aren't going to have their laptop stolen by the CIA/NSA and have their DIMMs popped and cryofreezed. The vast majority of users aren't going to have the case opened and a special-purpose PCIe device installed to steal keys over DMA. The vast majority of users aren't going to have a dTPM vulnerable to SPI s…
The GPU, not the TPM, is the root of hardware DRM
211–220 of 493 posts
Re: The GPU, not the TPM, is the root of hardware DRM
#212Earlier quoted context omitted.
Wait what? I don't game, so this is new to me. Do you have more info? That seems pretty cool.
There are cheats that give you more information than you should have. These typically require access to the game process's memory space. If you're cheating with a video capture card, this likely means you're allowing a program to rewrite your inputs to more accurately target player models. You will likely be banned if you do this on the same machine via screen capture. A video capture card can process the information…
Video capture cards can be countered with encrypted video from GPU to monitor. That's why you can't screencap 4k Disney+ movies.
Re: The GPU, not the TPM, is the root of hardware DRM
#213> I'm going to be honest here and say that I don't know what Microsoft's actual motivation for requiring a TPM in Windows 11 is. It is quite obvious: to force people to buy a new PC. TPM provides no added security value for the vast majority of users[1] but it is a convenient hardware that has only started to become standard (fTPM) in PCs built in the last ~8 years so it provides an excuse for Microsoft to declare co…
I'm embarrassed to admit that I don't actually understand what a TPM does. My vague and probably incorrect impression is that it performs some sort of encrypted verification of firmware or hardware modules? Can anyone expand on what this does? My impression would be that this is not useful for most users, and would be much of a concern in industrial espionage situations. I have no confidence that I'm correct here.
It's a secure storage spot for crypto keys and performing crypto operations for things like bitlocker and validating device or OSs for secure boot. If you know of the Apple Secure Enclave it's a more generic version of that, a place where even the device vendor (in theory, who knows what techniques the secret squirrels of the world have hidden away) cannot extract the actual key material from only request operations performed using that info.
That's my understanding at least.
Re: The GPU, not the TPM, is the root of hardware DRM
#214> I'm going to be honest here and say that I don't know what Microsoft's actual motivation for requiring a TPM in Windows 11 is. It is quite obvious: to force people to buy a new PC. TPM provides no added security value for the vast majority of users[1] but it is a convenient hardware that has only started to become standard (fTPM) in PCs built in the last ~8 years so it provides an excuse for Microsoft to declare co…
I'm embarrassed to admit that I don't actually understand what a TPM does. My vague and probably incorrect impression is that it performs some sort of encrypted verification of firmware or hardware modules? Can anyone expand on what this does? My impression would be that this is not useful for most users, and would be much of a concern in industrial espionage situations. I have no confidence that I'm correct here.
The simplest and most obvious use-case is allowing you to encrypt your hard drive using a key stored in tamper-resistant hardware rather than having to rely on the user to select a passphrase complex enough to resist offline brute force attacks.
Re: The GPU, not the TPM, is the root of hardware DRM
#215>The FSF's focus on TPMs here is not only technically wrong, it's indicative of a failure to understand what's actually happening in the industry. This sounds 100% on-brand for the FSF. The FSF's primary public-facing persona has peculiar computing habits so far removed from the mainstream that it's likely he has absolutely no clue how the real world works. In fact by his own statement he has to rely on volunteers to…
It's been very clear to me for many years that the FSF is staffed by a bunch of out-of-touch boomers who believe that Microsoft is the end-all be-all of evil tech. That was probably true 30 years ago, but from their rhetoric, they've ignored how the computing landscape has changed. Namely, the ways smartphones are walled gardens that screw over people, often in the same ways Microsoft has. I've heard them mention in passing that Apple, Google, and Facebook are bad, but the volume of material directed at Microsoft overwhelms anything else. To the FSF, if it doesn't happen on a PC, its not a priority. It still amazes me that they're hurt over Linux stealing their GNU name/tools/momentum, but hardly a word is written about how Google stole Linux to make Android, and how the Android ecosystem is a complete betrayal of free software's values.
Re: The GPU, not the TPM, is the root of hardware DRM
#216> I'm going to be honest here and say that I don't know what Microsoft's actual motivation for requiring a TPM in Windows 11 is. It is quite obvious: to force people to buy a new PC. TPM provides no added security value for the vast majority of users[1] but it is a convenient hardware that has only started to become standard (fTPM) in PCs built in the last ~8 years so it provides an excuse for Microsoft to declare co…
hard disagree. All security requires a root of trust. If you don't have that, how can you ensure you're not running on a mailicious hypervisor, you've not loaded any bad drivers etc. You can only guess, and badly at that. Because we don't have it, that's why we get crap like kernel-level anti-cheat, various 'security' solutions made by companies of dubious reputation and technical ability, just because you refused to…
Trusting microsoft is a deal breaker.
Re: The GPU, not the TPM, is the root of hardware DRM
#217There’s some technical details missing here. I get decrypting the video on a gpu makes it harder to screen capture, but can’t you just still emulate the GPU in software or directly capture the digital video output? The GPU still has no unique hardware private key, right?
Making your own GPU sounds intriguing. You could hook up a small ARM computer to the PCI slot and implement a GPU in software. A very slow GPU obviously, but fast enough to decrypt the video frames. I'm not sure if you'll be able to write a driver for it that will seem legit to Windows.
Re: The GPU, not the TPM, is the root of hardware DRM
#218> I'm going to be honest here and say that I don't know what Microsoft's actual motivation for requiring a TPM in Windows 11 is. It is quite obvious: to force people to buy a new PC. TPM provides no added security value for the vast majority of users[1] but it is a convenient hardware that has only started to become standard (fTPM) in PCs built in the last ~8 years so it provides an excuse for Microsoft to declare co…
I thought it was to DRM media?
Re: The GPU, not the TPM, is the root of hardware DRM
#219> I'm going to be honest here and say that I don't know what Microsoft's actual motivation for requiring a TPM in Windows 11 is. It is quite obvious: to force people to buy a new PC. TPM provides no added security value for the vast majority of users[1] but it is a convenient hardware that has only started to become standard (fTPM) in PCs built in the last ~8 years so it provides an excuse for Microsoft to declare co…
I'm embarrassed to admit that I don't actually understand what a TPM does. My vague and probably incorrect impression is that it performs some sort of encrypted verification of firmware or hardware modules? Can anyone expand on what this does? My impression would be that this is not useful for most users, and would be much of a concern in industrial espionage situations. I have no confidence that I'm correct here.
Here is how Windows uses the TPM. Most of this is targeted at enterprises.
https://learn.microsoft.com/en-us/windows/security/hardware-...
Re: The GPU, not the TPM, is the root of hardware DRM
#220Earlier quoted context omitted.
You're at an industry conference. I want the data on your laptop's hard drive. You leave your laptop in the hotel room. Which one is easier: 1. Go into your room and screw around with the boot loader to somehow give me unencrypted access to your laptop after you login next time. 2. Go into your room. Take your laptop. Put an identical looking laptop in place that runs software that boots and looks identical. Have it…
The attacker must be able to fake any pre-boot drive unlock screen and OS login screen to look exactly as the user's real screens but accept any password. Legend goes that security oriented people will visually customize their machines with stickers (and their associated aging patina) and all kinds of digital cues on the different screens just to recognize if anything was changed. MS chose to impose TPM because it al…
> Legend goes that security oriented people will visually customize their machines with stickers (and their associated aging patina) and all kinds of digital cues on the different screens just to recognize if anything was changed.
Maybe I am mistaken, but I feel that the people going to such lengths to ward off an attacker and the people who’d want to rely on fTPM with Bitlocker over FOSS full disk encryption with a dedicated passphrase are two entirely separate circles.
> The TPM is not there to protect against NSA, or proverbial $5 wrench attacks but as a thick layer of convenience over the thinner layer of security.
I agree with you there, it is convenience, not security, but as such, should it be any more mandatory than any other convenience feature such as Windows Hello via fingerprint or IR? I’d argue only for newly released hardware, but don’t make that mandatory for existing systems.
Especially since I had one case where fTPM was not recognized, no matter what I did, despite it being enabled in the UEFI and showing up in Windows 10 and on Linux, I could not install 11.