They are not sanke oil but "compliance tricks" ;=) Basically: - full disk encryption is required for whatever reason - BIOS SSD passwords fulfill that requir

They are not sanke oil but "compliance tricks" ;=) Basically: - full disk encryption is required for whatever reason - BIOS SSD passwords fulfill that requirement and it is good enough to prevent accidentally leaking data when losing the laptop and it goes in the hand of someone slightly technical versatile but not a specialist/hacker nor a targeted attack interested in handing the laptop to a specialist. Hence why compliance rules in cases involving actual sensitive data often require full disk encryption using more strict requirements not fulfilled with BIOS encryption. > Nobody verifies that the encryption scheme is sound. for some Latop brands/variants you most likely have a sound encryption schema, but there is still the problem that it's unlocked by the TPM and the en-/de-cryption is likely run on the CPU or similar instead of an specialized IO description chip tightly coupled with the TPM (modern Apple devices, at least phones, are a notable exception here AFIK). So even if the encryption schema is sound it's normally not too hard to extract the key in one of many ways for a specialist. And even if that doesn't work there is still the attack to inject your OS which then sees the unencrypted SSD... so normally not secure.