4 ms·
At some point Teams has to ask the TPM to unseal its encrypted copy of the access token. At that point an attacker can read the communication between Teams and
by yrro 4y ago
At some point Teams has to ask the TPM to unseal its encrypted copy of the access token. At that point an attacker can read the communication between Teams and the TPM, or it can read the token straight out of Teams' memory space.
- Genbox 4y agoUnless the TPM performs the cryptographic operations on the chip itself. TPM can do asymmetric crypto using a key in it's secure storage. It would require Microsoft to use a different authentication scheme based on ephemeral signed tokens instead of OAUth to be beneficial for security. That is very unlikely to happen. That scheme would also only reduce the access timeframe from whatever the OAuth token's lifetime is, to a timeframe constrained to the amount of time the computer (the key) is online.