6 ms·
Does a TPM chip actually bring any relevant security advantages for end users, or is it just for DRM?
by schmorptron 5y ago
Does a TPM chip actually bring any relevant security advantages for end users, or is it just for DRM?
- e2le 5y agoMeasured boot and secure storage of keys. It's not all bad.
- schmorptron 5y agoThat's good to hear then! So will most computers having a TPM chip lead to easier integration of secure boot with i.e. linux distros as well?
- e12e 5y agoAs long as most computers ship in a manner where the owner can adjust the keys in TPM/SecureBoot - you could argue its a good thing. Eg,like: https://ubuntu.com/blog/how-to-sign-things-for-secure-boot https://ubuntu.com/blog/how-to-sign-things-for-secure-boot
- rightbyte 5y agoI had to disable secure boot to get Nvidia's drivers to work. So I guess the end result might be more hardware trouble for distros, with a subsystem that tries to prevent usage of the computer when it is not happy.
- vetinari 5y agoYou can also enroll your MOK (Machine-Owner-Key) to UEFI and then sign the nvidia driver with it. That way, you can leave Secure Boot enabled. However, leaving the secret part of MOK on the machine and let the dkms or whatever updater of kernel modules to use it unattended kind of defeats the purpose.
- ziml77 5y agoIs the NVIDIA driver already signed? If it is, couldn't you create a certificate signed with the root key that says that the NVIDIA key is trusted?
- vetinari 5y agoNo, last time I used it, it was object file and source for a shim. You had to build the shim for your specific kernel and link together with the supplied object file. The result is kernel module, that is unsigned because it is you who built it.
- technion 5y agoThere's a practical benefit that it leads to seamless Bitlocker deployment without making users manage keys or do things that would lead them to prefer to not have Bitlocker. That definitely counts for a lot. It's just a shame that they can't let that stand on its own with their current marketing.
- FDSGSG 5y agoHuge benefits.
- canada_dry 5y ago> security advantages for end users I'd say about as much as Intel's Management Engine. /s
- slaymaker1907 5y agoIt brings enormous security benefits to end users. TPMs drastically reduce entropy/complexity requirements for things like passwords/pins since the TPM can rate limit guess attempts. Doing that without a TPM is impossible since an attacker can always read the encrypted password off of the drive/directly from memory and then brute force it.
- frankzander 5y agoan who of an average user does need that? I'm not an average user but I never need that. I also know no one who can't wait to get it or even think about wanting it. I only read in blogs or HN that one would need it. I think "you need that because of security" is PR/propaganda from certain companies.
- kevingadd 5y agoAs someone with executive function and memory issues, being able to use short pins/passwords to access my secured hardware is incredibly useful.
- Wowfunhappy 5y agoI think that’s a wonderful use case for a TPM, but I don’t think it means all users should be forced to buy a TPM in order to get security patches past 2025. (I realize this is a slightly different goalpost, but I’m not GP.)
- concordDance 5y agoWhat threat model do you have that has people breaking I using a short password?
- DeathArrow 5y agoHDD content can be encripted without storing the password anywhere, without a TPM. If the ecryption algorithm is decent, good luck waiting billions of years to bruteforce, even with the next gen hardware.