5 ms·

The TPM is not a DRM enforcement mechanism if you set it up for your own use. It is a very useful tool for taking control of machine that you own - it provides

The TPM is not a DRM enforcement mechanism if you set it up for your own use. It is a very useful tool for taking control of machine that you own - it provides a way to prove* to yourself that the system booting with the firmware that you've approved, in the configuration that you setup, and running the kernel and initrd that you've signed. https://safeboot.dev/attestation/#i-thought-remote-attestation-and-tpms-were-only-for-drm https://safeboot.dev/attestation/#i-thought-remote-attestati... *: Depending on your threat model and risks, some of which are discussed here https://safeboot.dev/threats/ https://safeboot.dev/threats/

raxxorrax 6y ago
No it is not, but I am fairly sure that is one of the main use cases. And you have a uniquely identifiable machine which creates new security problems. We also know from smartphones that manufacturers can indeed be motivated to lock bootloaders. I think the main reason we don't have that on PC is that there are still multiple manufacturers and legacy considerations. Aside from that it remains true: https://ieeexplore.ieee.org/document/5283799 https://ieeexplore.ieee.org/document/5283799 I cannot read the minds of Microsoft, but I have my assumptions that I believe are quite safe. https://trustedcomputinggroup.org/ https://trustedcomputinggroup.org/ has rebranded themselves because they got a bad name. Justified in my opinion. People have identified the motivation on day one. But again, yes, it can have some security advantages against the numerous disadvantages. I think it is bad for open computing overall. There are certainly mechanisms to secure your OS that don't rely on TPM. It may benefit you, but I would actually like to see it removed from my machine with all the consequences (which would be not being able to play DRM protected media).

raxxorrax 6y ago

No it is not, but I am fairly sure that is one of the main use cases. And you have a uniquely identifiable machine which creates new security problems. We also know from smartphones that manufacturers can indeed be motivated to lock bootloaders. I think the main reason we don't have that on PC is that there are still multiple manufacturers and legacy considerations. Aside from that it remains true: https://ieeexplore.ieee.org/document/5283799 https://ieeexplore.ieee.org/document/5283799 I cannot read the minds of Microsoft, but I have my assumptions that I believe are quite safe. https://trustedcomputinggroup.org/ https://trustedcomputinggroup.org/ has rebranded themselves because they got a bad name. Justified in my opinion. People have identified the motivation on day one. But again, yes, it can have some security advantages against the numerous disadvantages. I think it is bad for open computing overall. There are certainly mechanisms to secure your OS that don't rely on TPM. It may benefit you, but I would actually like to see it removed from my machine with all the consequences (which would be not being able to play DRM protected media).