3 ms·
> there's no concept of a separate user-inaccessible data compartment Would a TPM serve here, in some hypothetical world where folk were willing to put in the
by zhengyi13 4y ago
> there's no concept of a separate user-inaccessible data compartment
Would a TPM serve here, in some hypothetical world where folk were willing to put in the work to do this?
Or I guess I'm asking, naively, what are the functional differences between the TPMs on our desktop/laptop machines, and what smartphones have in them?
- zinekeller 4y agoIt could work but in Windows you generally need administrator privileges to touch TPM. > Or I guess I'm asking, naively, what are the functional differences between the TPMs on our desktop/laptop machines, and what smartphones have in them? A security processor on mobile devices are usually actually like TPM and Intel SGX combined together. I won't say it's better than PC TPMs, but have a very different design.
- yrro 4y agoAt some point Teams has to ask the TPM to unseal its encrypted copy of the access token. At that point an attacker can read the communication between Teams and the TPM, or it can read the token straight out of Teams' memory space.
- Genbox 4y agoUnless the TPM performs the cryptographic operations on the chip itself. TPM can do asymmetric crypto using a key in it's secure storage. It would require Microsoft to use a different authentication scheme based on ephemeral signed tokens instead of OAUth to be beneficial for security. That is very unlikely to happen. That scheme would also only reduce the access timeframe from whatever the OAuth token's lifetime is, to a timeframe constrained to the amount of time the computer (the key) is online.