3 ms·
There's a huge difference between TPM and IME: with TPM, you can put your own keys, and use the TPM to refuse payloads not signed with your keys (ex: a Windows
by csdvrx 4y ago
There's a huge difference between TPM and IME: with TPM, you can put your own keys, and use the TPM to refuse payloads not signed with your keys (ex: a Windows install thumbdrive)
With AMT/IME or BootGuard, you don't get that control: you can't replace the bootguard keys (as it's a way to kill the secondary market of CPUs being resold and used in a different motherboard) and with AMT you can't fully disable it unless you're a government agency as you said.
The technology isn't bad, it's the actual implementation that's wrong by avoiding certain features which could give the user more freedom.
- wkat4242 4y agoYeah security is good but it needs to serve the user, meaning they must be able to have full control over it if they so desire. I also hate Apple's Mac and iOS closedness. Sure, on Mac you can disable SIP but you will disable its security completely, and you will also lose access to some of the OS features. There should be a way to sign your own code and simply allow that to be trusted with full protection, just like it is on generic intel systems with secure boot where you can easily add your own signing keys.
- bpye 4y ago> I also hate Apple's Mac and iOS closedness. Sure, on Mac you can disable SIP but you will disable its security completely, and you will also lose access to some of the OS features. On an Apple Silicon Mac you can have multiple operating systems installed, with different security configuration. It's totally possible to have both Asahi and macOS installed without disabling any security features in macOS.
- mjg59 4y ago> with TPM, you can put your own keys, and use the TPM to refuse payloads not signed with your keys (ex: a Windows install thumbdrive) No, that's UEFI Secure Boot, which doesn't use the TPM - it's entirely handled on-CPU. Most of the keys on a TPM are under user control (but aren't involved in the boot process) other than the EK, which is generated at manufacture time and will be consistent for the lifetime of the TPM.
- csdvrx 4y agoIndeed, it's s simplification. If you want to go down the TPM rabbit hole, read this interesting comment about IEEE 1667: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/5429#issuecomment-554661734 https://github.com/MicrosoftDocs/windows-itpro-docs/issues/5...