4 ms·
For a web exposed use case: TPMs are used as part of Windows's FIDO2 implementation, to make sure that the secret actually cannot be exfiltrated to other hardwa
by my123 5y ago
For a web exposed use case: TPMs are used as part of Windows's FIDO2 implementation, to make sure that the secret actually cannot be exfiltrated to other hardware.
That doesn't come with any particular privacy concerns however.
- staticassertion 5y agoRight, I meant that there's no javascript API to communicate with a TPM directly as far as I know. You can still use a TPM as part of your auth to a website, it just has to go through a protocol where the browser handles the interaction. So a website can't leverage the TPM for tracking purposes afaik. But web is really not so much my thing, so I'm now at the point where I'm probably going to start saying incorrect things.
- my123 5y agoIt's too low level of an interface to directly expose to web apps tbh.
- tehbeard 5y agoAh so the vendors implementing the WebAuthN spec in their browser can use the TPM as "secure storage" for the related keys?
- my123 5y agoYes.