10 ms·

So why do you have f/TPM enabled in the first place? There was no Windows 11 back in 2019. Do you have an actual need for it?

maven29 4y ago
Full disk encryption as in Bitlocker?
- daneel_w 4y ago
  Maybe. Only they know. I can't answer your question.
vel0city 4y ago
I have the fTPM enabled on a few AMD Ryzen CPU computers I own. I like using Bitlocker even on my personal machines. I've got a lot of personal information on my computers, FDE helps to keep my data safe in case a drive goes missing.
- daneel_w 4y ago
  Bitlocker/FDE is a valid use case. I personally prefer to protect sensitive information with software-based solutions that are portable between various operating systems.
- whyoh 4y ago
  BitLocker can be used without TPM, for example with a password or a key file on a USB drive. And those are probably safer options if your whole computer gets stolen.
  - vel0city 4y ago
    The experience of doing it with a password is pretty poor compared to using a TPM. Every time the computer reboots, I need to type in the password. If it is a remote machine, I have to physically be at the station to type in the password. Keeping the key file on a USB drive isn't exactly safe either, as there's a high likelihood that flash drive is probably going to be near my computer when stolen. Also, that flash drive may be active and plugged when the system is running, exposing it to the machine directly. Having that key material easily accessible on a flash drive makes it less protected than using the TPM. Using the TPM gives me a better experience and depending on how things are handled a far more secure way of handling the key. Its way easier to grab the key file off the flash drive than coaxing it out of the TPM without booting the trusted boot process.
  - gambiting 4y ago
    They are only safer if you always unplug the USB drive and take it with you. Which I know I would never do reliably enough to offer protection(and I would probably lose the drive eventually which is then actually a complete loss of data unless you have a backup, but if you have a backup then that's yet another weakness in the system). A built in TPM module might have some unknown fault that hasn't been disclosed yet, but I think that's about 10000x less likely than the chance of me forgetting/losing the USB drive with encryption key.
cameronh90 4y ago
I use Bitlocker FDE. And frankly, having to disable this bit of hardware that you paid for because it doesn't work properly is bullshit.
- daneel_w 4y ago
  AMD's fTPM is a gratis bonus as far as I'm concerned. Bitlocker's disk encryption can be used without TPM. It's less convenient - Windows needs to read the cryptographic key from a USB flash drive at boot - but I'm willing to bet it's much easier to get used to than 3 years of glitching and stuttering.
  - cameronh90 4y ago
    It's not a "gratis bonus" when I specifically buy a device because I require that feature. Besides Windows 11 requiring a TPM, which was known to be on the cards for a while now, storing the key on a USB drive is not functionally the same as the TPM. It means either the key material is stored in plaintext on the USB, which is pointless, or I still need to use a PIN. I need my computer to be able to boot without intervention, so that isn't an option.
    - daneel_w 4y ago
      > It's not a "gratis bonus" when I specifically buy a device because I require that feature. I don't understand, since fTPM specifically isn't a requirement. Any TPM will work. If you had bought Intel you would have paid more for just the CPU alone, regardless of the cost of a discrete TPM. > Besides Windows 11 requiring a TPM, which was known to be on the cards for a while now, storing the key on a USB drive is not functionally the same as the TPM. It means either the key material is stored in plaintext on the USB, which is pointless, or I still need to use a PIN. I need my computer to be able to boot without intervention, so that isn't an option. With f/TPM and no PIN you're storing the keys in plain-text right next to the encrypted content. It's like hanging the keys to your door on the knob. This effectively cancels the point of full-disk encryption for your implied personal use. I cannot believe what I'm reading.

maven29 4y ago

Full disk encryption as in Bitlocker?

daneel_w 4y ago
Maybe. Only they know. I can't answer your question.

vel0city 4y ago

I have the fTPM enabled on a few AMD Ryzen CPU computers I own. I like using Bitlocker even on my personal machines. I've got a lot of personal information on my computers, FDE helps to keep my data safe in case a drive goes missing.

daneel_w 4y ago
Bitlocker/FDE is a valid use case. I personally prefer to protect sensitive information with software-based solutions that are portable between various operating systems.
whyoh 4y ago
BitLocker can be used without TPM, for example with a password or a key file on a USB drive. And those are probably safer options if your whole computer gets stolen.
- vel0city 4y ago
  The experience of doing it with a password is pretty poor compared to using a TPM. Every time the computer reboots, I need to type in the password. If it is a remote machine, I have to physically be at the station to type in the password. Keeping the key file on a USB drive isn't exactly safe either, as there's a high likelihood that flash drive is probably going to be near my computer when stolen. Also, that flash drive may be active and plugged when the system is running, exposing it to the machine directly. Having that key material easily accessible on a flash drive makes it less protected than using the TPM. Using the TPM gives me a better experience and depending on how things are handled a far more secure way of handling the key. Its way easier to grab the key file off the flash drive than coaxing it out of the TPM without booting the trusted boot process.
- gambiting 4y ago
  They are only safer if you always unplug the USB drive and take it with you. Which I know I would never do reliably enough to offer protection(and I would probably lose the drive eventually which is then actually a complete loss of data unless you have a backup, but if you have a backup then that's yet another weakness in the system). A built in TPM module might have some unknown fault that hasn't been disclosed yet, but I think that's about 10000x less likely than the chance of me forgetting/losing the USB drive with encryption key.

cameronh90 4y ago

I use Bitlocker FDE. And frankly, having to disable this bit of hardware that you paid for because it doesn't work properly is bullshit.

daneel_w 4y ago
AMD's fTPM is a gratis bonus as far as I'm concerned. Bitlocker's disk encryption can be used without TPM. It's less convenient - Windows needs to read the cryptographic key from a USB flash drive at boot - but I'm willing to bet it's much easier to get used to than 3 years of glitching and stuttering.
- cameronh90 4y ago
  It's not a "gratis bonus" when I specifically buy a device because I require that feature. Besides Windows 11 requiring a TPM, which was known to be on the cards for a while now, storing the key on a USB drive is not functionally the same as the TPM. It means either the key material is stored in plaintext on the USB, which is pointless, or I still need to use a PIN. I need my computer to be able to boot without intervention, so that isn't an option.
  - daneel_w 4y ago
    > It's not a "gratis bonus" when I specifically buy a device because I require that feature. I don't understand, since fTPM specifically isn't a requirement. Any TPM will work. If you had bought Intel you would have paid more for just the CPU alone, regardless of the cost of a discrete TPM. > Besides Windows 11 requiring a TPM, which was known to be on the cards for a while now, storing the key on a USB drive is not functionally the same as the TPM. It means either the key material is stored in plaintext on the USB, which is pointless, or I still need to use a PIN. I need my computer to be able to boot without intervention, so that isn't an option. With f/TPM and no PIN you're storing the keys in plain-text right next to the encrypted content. It's like hanging the keys to your door on the knob. This effectively cancels the point of full-disk encryption for your implied personal use. I cannot believe what I'm reading.