4 ms·
It doesn't have to be an equivalent to be an option. Just like having no encryption is an option or auto-unlocking is an option. It's not like TPM detects that
by xaduha 5y ago
It doesn't have to be an equivalent to be an option. Just like having no encryption is an option or auto-unlocking is an option.
It's not like TPM detects that there are hardware changes, Windows itself does and it can lock it down. Or if there is some mechanism it doesn't seem to help in this case, so who is it stopping?
- pgeorgi 5y agoTPMs are notified about the system state along the boot process, so they can present the key only if the boot process looks like it's supposed to (and some of these attributes aren't even modifiable by the CPU but the side processor, e.g. Intel's "Management" Engine or AMD's "Security" Processor, so even taking over the x86 firmware doesn't help anymore) Smartcards lack that data (they wouldn't know that somebody attached a Thunderbolt device that pretends to be a GPU but also comes with its own option ROM that installed a backdoor), so they serve a different threat model.
- xaduha 5y agoAnd now the whole 'separate TPM' thing is obsolete, because newer processors will come with their own TPMs. This was a bad idea from the start if you ask me, with UEFI and shoving all sorts of things into it.