3 ms·

Because if you took the disk, even if you $5-wrenched the pin out of someone, you don't have the TPM hardware to make use of it. As for the second question, I

Because if you took the disk, even if you $5-wrenched the pin out of someone, you don't have the TPM hardware to make use of it. As for the second question, I suppose it depends on the implementation; I suspect there is a way to migrate and transfer the keys for the device for the person who already has access to all of the factors. If I use a Yubikey and LUKS for example, I can re-use the Yubikey if I move the disk to another machine. I'm not sure how this would work for integrated TPMs and Bitlocker (I don't use Windows), but I believe they have recovery key-files you could use.

pmontra 3y ago
If there is no way to transfer the disk to another machine, it's not a disk I want to use. I think that there are very few use cases for losing all the data when a machine dies. And if there is a procedure to let me move the disk to a new machine, somebody can wrench me until I perform that procedure for them.
- dwattttt 3y ago
  For Bitlocker (and I imagine other tools which support TPM keying), a recovery password is generated in addition to the TPM unlock key. If the motherboard goes kaput you dig out the long key to unlock it, assuming you kept it somewhere safe (speaking as someone who has had to dig through a pile of old USBs to get access back to a disk).
  - robertlagrant 3y ago
    Sounds as though this is where the $5 wrench would work just fine.
    - mkopec 3y ago
      It's a matter of priorities, I guess? If you want to you can just not save the recovery password. In that case I guess they'll just beat you to death with that $5 wrench.
      - robertlagrant 3y ago
        That's why I'd rather use a service without a recovery password :)
- mkopec 3y ago
  With LUKS you can enroll an extra auth option in addition to TPM, like a password or a FIDO2 token.
- alias_neo 3y ago
  > And if there is a procedure to let me move the disk to a new machine, somebody can wrench me until I perform that procedure for them. I think the implication is that they (the attacker) don't have the machine, or you, or whatever "thing" you have/use to unlock it. If someone stole your disk, or took a copy of it, they can't offline attack it. An external hardware device seems preferable for this scenario; if someone steals/snatches your laptop, they won't have your Yubikey or whatever. In any scenario where the wrenching is an option, I suspect all bets are off, but if wrenching is a real risk, and whatever you're protecting is worth taking a wrenching for (as opposed to just giving it up at the threat of a wrenching), there should probably be some tougher protections which make it clear that the wrenching will gain an attacker nothing, and hopefully save you from it to begin with. I'm not sure what or how that would work.
forty 3y ago
> Because if you took the disk, even if you $5-wrenched the pin out of someone, you don't have the TPM hardware to make use of it. I sincerely hope that the guy with the $5 wrench knows this and don't continue hitting until he has the key...
- mkopec 3y ago
  Indeed, it seems that having another unlock option might be preferable. If you value your own live over the secrets, that is.

pmontra 3y ago

If there is no way to transfer the disk to another machine, it's not a disk I want to use. I think that there are very few use cases for losing all the data when a machine dies. And if there is a procedure to let me move the disk to a new machine, somebody can wrench me until I perform that procedure for them.

dwattttt 3y ago
For Bitlocker (and I imagine other tools which support TPM keying), a recovery password is generated in addition to the TPM unlock key. If the motherboard goes kaput you dig out the long key to unlock it, assuming you kept it somewhere safe (speaking as someone who has had to dig through a pile of old USBs to get access back to a disk).
- robertlagrant 3y ago
  Sounds as though this is where the $5 wrench would work just fine.
  - mkopec 3y ago
    It's a matter of priorities, I guess? If you want to you can just not save the recovery password. In that case I guess they'll just beat you to death with that $5 wrench.
    - robertlagrant 3y ago
      That's why I'd rather use a service without a recovery password :)
mkopec 3y ago
With LUKS you can enroll an extra auth option in addition to TPM, like a password or a FIDO2 token.
alias_neo 3y ago
> And if there is a procedure to let me move the disk to a new machine, somebody can wrench me until I perform that procedure for them. I think the implication is that they (the attacker) don't have the machine, or you, or whatever "thing" you have/use to unlock it. If someone stole your disk, or took a copy of it, they can't offline attack it. An external hardware device seems preferable for this scenario; if someone steals/snatches your laptop, they won't have your Yubikey or whatever. In any scenario where the wrenching is an option, I suspect all bets are off, but if wrenching is a real risk, and whatever you're protecting is worth taking a wrenching for (as opposed to just giving it up at the threat of a wrenching), there should probably be some tougher protections which make it clear that the wrenching will gain an attacker nothing, and hopefully save you from it to begin with. I'm not sure what or how that would work.

forty 3y ago

> Because if you took the disk, even if you $5-wrenched the pin out of someone, you don't have the TPM hardware to make use of it. I sincerely hope that the guy with the $5 wrench knows this and don't continue hitting until he has the key...

mkopec 3y ago
Indeed, it seems that having another unlock option might be preferable. If you value your own live over the secrets, that is.