TPM provides zero practical security
gist.github.com
TPM provides zero practical security
1–10 of 111 posts
Re: TPM provides zero practical security
#2I don't agree with this. Yes, any TPM is necessarily possible to bypass, but it's not easy. I know I could bypass normal password-based FDE with physical access to a machine without any special hardware or software, but not TPM-based. I assume, by the Pareto principle, that there are lots of people with my ability but exponentially fewer who could bypass a TPM. So it's definitely more secure than password-based FDE, and it's good enough for me.
Re: TPM provides zero practical security
#3> You can also use the TPM + PIN as a sort of Yubikey
That's not zero. In my mind that's the main thing a TPM is really useful for. It's a secure enclave for a private key used for U2F/WebAuthn style attestation. I agree that the threat model not being explicitly discussed is a huge miss. But to that point, a TPM is still useful because it prevents someone who has hacked into my computer from commanding the TPM's authentication factor.
The other useful application is to prevent block device data extraction without knowing the passkey. And the author's argument there hinges on the notion that Microsoft won't patch OS security vulnerabilities that enable key extraction from memory. Which, OK, third-party drivers suck, but Microsoft's effort to patch is also not zero, and the most common (OS+browser/sandbox) threat model requires a chain of vulnerabilities that are hard to come by.
Re: TPM provides zero practical security
#4On the one usage scenario that benefits a PC user, the TPM makes for a really bad yubikey. You can't carry it between computers, you can't back it up, and you are certain to lose it at some point when the computer breaks of gets outdated.
That means it either requires a second protocol for authentication, or that you will lose your accounts with all kinds of services all the time.
Re: TPM provides zero practical security
#5On the one usage scenario that benefits a PC user, the TPM makes for a really bad yubikey. You can't carry it between computers, you can't back it up, and you are certain to lose it at some point when the computer breaks of gets outdated. That means it either requires a second protocol for authentication, or that you will lose your accounts with all kinds of services all the time.
> the TPM makes for a really bad yubikey. You can't … you can't back it up
Technically speaking, the exact same restrictions apply to a Yubikey.
That’s what makes it secure.
Re: TPM provides zero practical security
#6At this point I don't understand why hardware vendors can't just do it like Apple. Put a small ARM SoC with some firmware in ROM onto the mainboard that starts before the main CPU and initializes it, ensuring that the system is in a known state before any components boot.
Re: TPM provides zero practical security
#7well sure, TPM is mostly about limiting what the average Joe can run on his computer. It isn't meant to stop adversaries.
Re: TPM provides zero practical security
#8At this point I don't understand why hardware vendors can't just do it like Apple. Put a small ARM SoC with some firmware in ROM onto the mainboard that starts before the main CPU and initializes it, ensuring that the system is in a known state before any components boot.
That's actually how modern Intel and AMD CPUs work.
Re: TPM provides zero practical security
#9So it boils down to "we shouldn't attempt to build new security stuff because what it's built on could have vulnerabilities"?
Time to go back to kernel mode everything I guess. Just run everything as root, get rid of sudo.
Re: TPM provides zero practical security
#10TPM isn’t about security, it’s about DRM