2 ms·

> Microsoft says Bitlocker works best when used in combination with a TPM chip Microsoft is wrong and has issued bad advice. Any disk encryption works best

> Microsoft says Bitlocker works best when used in combination with a TPM chip Microsoft is wrong and has issued bad advice. Any disk encryption works best when used only with an ephemeral pass-phrase known solely to the operator. TPM is an okay solution for a server in a physically secure rack that must be booted remotely without human intervention.

omgCPhuture 3y ago
1. TPM is Common Criteria certified to about a chip bank card. I think 5 or so on CC eval. 2. Many, if not most, consumer motherboards wrongly implements TPM and easily reveals secrets to a logic analyzer. 3. I am yet to see th TPM that is not on that situation AND/OR has several side channel problems. 4. SoC method really just makes physics a problem as die nanometer shrinks; but even before that, not think implementation well through from a mindset like the problem solving mind of an experienced, skilled hacker and end up implementing bugs in hardware format. TEE and the likes are no exception. DPA, DFA, Accoustic analytics, pick your SCA poison when you are done with the weak math or usual code suspects like buffers, data type overflows, logic bugs, etc. Fault injections and bounds overwriting are classic bugs with endless ways to abuse the given situation. MS has been known to shit the bed coding, over & over. The fact is you never know who sees opurtunity where closed source corp culture only sees $ in the short term: Nobody will ever know & the bottom line better. 5. Knowledge is power, ignorance is dangerous. That's how you end up implementing your idea of defense & end up with someone else's idea of a doormat. 6. Never underestimate hubris, ignorance or man's capacity to persuade himself to be lazy or any combination there of. If you cannot and have not inspected it you should not trust it. </blog>.
- nonrandomstring 3y ago
  And was I dreaming that Cavium/Marvell had probably got funky dual elliptic curve RNGs? Didn't that come out in Jacob Appelbaum's PhD and then... wind/crickets/tumbleweeds....
  - omgCPhuture 3y ago
    Applebaum. oh that kid with DOWNS who think some sexual harasment fictictional scandal will convice everyone the US Navy did not invent Tor or Pick the buggiest most exploitable browser on earth to make sure the criminally stupid in fact do get caught by the SHerlock Holmeses in the an agency that in fact did inspect Brothels for the Federal Government in the start aka the FBI? y so srs? It is not like the Navy has ship mounted lasers that make plasma on the sky and convincing idiots there are UFOs flying around by heating the plasma differently to replicate CRT TV Technology .. FROM THE PHUTURE?:)

omgCPhuture 3y ago

1. TPM is Common Criteria certified to about a chip bank card. I think 5 or so on CC eval. 2. Many, if not most, consumer motherboards wrongly implements TPM and easily reveals secrets to a logic analyzer. 3. I am yet to see th TPM that is not on that situation AND/OR has several side channel problems. 4. SoC method really just makes physics a problem as die nanometer shrinks; but even before that, not think implementation well through from a mindset like the problem solving mind of an experienced, skilled hacker and end up implementing bugs in hardware format. TEE and the likes are no exception. DPA, DFA, Accoustic analytics, pick your SCA poison when you are done with the weak math or usual code suspects like buffers, data type overflows, logic bugs, etc. Fault injections and bounds overwriting are classic bugs with endless ways to abuse the given situation. MS has been known to shit the bed coding, over & over. The fact is you never know who sees opurtunity where closed source corp culture only sees $ in the short term: Nobody will ever know & the bottom line better. 5. Knowledge is power, ignorance is dangerous. That's how you end up implementing your idea of defense & end up with someone else's idea of a doormat. 6. Never underestimate hubris, ignorance or man's capacity to persuade himself to be lazy or any combination there of. If you cannot and have not inspected it you should not trust it. </blog>.

nonrandomstring 3y ago
And was I dreaming that Cavium/Marvell had probably got funky dual elliptic curve RNGs? Didn't that come out in Jacob Appelbaum's PhD and then... wind/crickets/tumbleweeds....
- omgCPhuture 3y ago
  Applebaum. oh that kid with DOWNS who think some sexual harasment fictictional scandal will convice everyone the US Navy did not invent Tor or Pick the buggiest most exploitable browser on earth to make sure the criminally stupid in fact do get caught by the SHerlock Holmeses in the an agency that in fact did inspect Brothels for the Federal Government in the start aka the FBI? y so srs? It is not like the Navy has ship mounted lasers that make plasma on the sky and convincing idiots there are UFOs flying around by heating the plasma differently to replicate CRT TV Technology .. FROM THE PHUTURE?:)