5 ms·

> TPM provides no added security value for the vast majority of users[1] Yes it does. The vast majority of users aren't going to have their laptop stolen by th

by p_ing 2y ago

> TPM provides no added security value for the vast majority of users[1] Yes it does. The vast majority of users aren't going to have their laptop stolen by the CIA/NSA and have their DIMMs popped and cryofreezed. The vast majority of users aren't going to have the case opened and a special-purpose PCIe device installed to steal keys over DMA. The vast majority of users aren't going to have a dTPM vulnerable to SPI sniffing as modern and not-so-modern processors have fTPM. This is to provide some baseline level of protection of the user's data against theft and loss. Are there attacks against TPM? Yep. In as much as there are attacks against SMS 2FA, but for the vast majority of people, SMS 2FA is an acceptable level of security. If you're a CEO, well sure, you're going to want to do something better (TPM + PIN). I acknowledge that Windows 11 Home users don't have this specific option. Everyone needs to level set on the type of attacks that are practical vs. involved and who the targets of those attacks are. FDE (w/ TPM) is part of defense-in-depth. Even if imperfect, it's another layer of protection.

AnthonyMouse 2y ago
> The vast majority of users aren't going to have their laptop stolen by the CIA/NSA and have their DIMMs popped and cryofreezed. That's kind of the point. The vast majority of users aren't going to have their laptop stolen at all, if they do it will 99% of the time be by someone who only wants to wipe it and fence it, and attempts to access data are most likely to be by unsophisticated family members who would be defeated by a simple password without any TPM. Meanwhile there have been plenty of TPM vulnerabilities that don't require anything so esoteric and can often be attacked purely from software, so if a normal user was facing even so much as someone willing to watch some security conference talks, they're going to lose regardless. If the TPM doesn't make them more vulnerable to that, because it contains the secrets and is susceptible to attack, vs. FDE with a boot key stored in some cloud service secured with the user's password instead of a TPM, which can then rate limit attempts without being susceptible to physical access attacks and be revoked if the device is stolen. Moreover, the more common threat to normal users is data loss, in which case you only want your laptop to be secure against your unsophisticated nephew and not the tech you want to recover your data after you forget your password. > In as much as there are attacks against SMS 2FA, but for the vast majority of people, SMS 2FA is an acceptable level of security. The current recommendation seems to be against SMS 2FA because the security of SMS really is that bad, so if you need 2FA, use an authenticator app or similar. > FDE (w/ TPM) is part of defense-in-depth. Any snake oil can be painted as defense-in-depth.
- adgjlsfhk1 2y ago
  imo sms 2fa is great since it is sufficient to stop automatic mass account stealing.
  - AnthonyMouse 2y ago
    So is an authenticator app. Also, SMS isn't, because attackers often get access to the SMS network itself (see e.g. Salt Typhoon) in which case they can do automatic mass account stealing because they can see all the totally unencrypted SMS codes. The security of SMS really is that bad.
    - oyashirochama 2y ago
      Not to mention LTT showed the ability to spoof and steal SMS directly, on specific targets using the international phone system trust, something that is effectively impossible to block due to the inherient trust built into cell companies at the moment.
    - dataflow 2y ago
      > attackers often get access to the SMS network itself (see e.g. Salt Typhoon) "Often"?
      - andy81 2y ago
        Bit of an understatement, should be "always have access" if state attackers are included in the threat model.
        AnthonyMouse 2y ago
        To be fair, there are also non-state attackers that can mass intercept SMS.
- wkat4242 2y ago
  > That's kind of the point. The vast majority of users aren't going to have their laptop stolen at all, if they do it will 99% of the time be by someone who only wants to wipe it and fence it, and attempts to access data are most likely to be by unsophisticated family members who would be defeated by a simple password without any TPM. True, any preboot password method (even fully software) will be sufficient to prevent data exposure when a laptop is stolen. The whole TPM + secure boot thing is more to prevent evil maid attacks where a laptop is messed with (eg installing a bootloader that intercepts the password) and then placing it back in the user's possession so they can be tricked into entering the password. That whole scenario is extremely far-fetched for home users. Laptops get stolen but then they're gone.
coppsilgold 2y ago
> The vast majority of users aren't going to have their laptop stolen by the CIA/NSA and have their DIMMs popped and cryofreezed. If you happen to have a Pro variant of Ryzen (there may be some Intel variants as well) then you can enable RAM encryption. The RAM will be encrypted with an ephemeral AES key on boot.
sidewndr46 2y ago
What is the argument here about the CIA / NSA or any other US Federal 3 letter agency? If your device is secured via TPM or some other scheme that relies on an industry to secure your device they aren't going to be doing "DIMM popping". They are just going to get the master keys from whomever issued them and use that bypass whatever they need to on the device.
- p_ing 2y ago
  You're missing the forest. The point being is that Microsoft's implementation on Win 11 Home ("device encryption", aka unconfigurable BitLocker) is sufficient for nearly all of their user base. If you're a target of a 3-letter agency, additional security measures are required.
a1o 2y ago
https://xkcd.com/538/ https://xkcd.com/538/
nfriedly 2y ago
In my experience, FDE (Full Disk Encryption) is more of a hindrance than help to average users. It just means that when something goes wrong, such as a forgotten password or a botched update, their data that would have otherwise been recoverable is now lost forever. I'm not sure I know anyone who's had a computer stolen, but I know lots of people who have lost data. Edit: I do know one person who had a computer stolen. It was a work laptop while they were in SF, and I'll concede that FDE probably does make more sense on a work-related computer. I was only arguing that it's more of a hindrance on personal devices that mostly stay in the owners home.
- kd913 2y ago
  Surely this is an issue for there not being an easy mechanism for backing up? The proper solution should be secure by design and user friendly. We shouldn’t compromise the former for the latter.
- xyzzy_plugh 2y ago
  I know of at least 10 instances of a company laptop being stolen. From the back of a car, from a coffee shop, from a hotel room, etc. It happens. Knowing any data on it cannot be recovered by malicious actors can be very reassuring.
- p_ing 2y ago
  > It just means that when something goes wrong, such as a forgotten password or a botched update, their data that would have otherwise been recoverable is now lost forever. Not at all. You can get your recovery key back via a few different means (for 11 Home, OneDrive/printed/PDF, for enterprises, various ways) and boot into the Windows Recovery Mode environment to perform the same repair options one would have without BitLocker in place.
- n144q 2y ago
  > I'm not sure I know anyone who's had a computer stolen, but I know lots of people who have lost data. That's exactly where you got your priorities wrong. Yes there is a tradeoff. But backing up your data is easy (especially in a corporate environment), while security is hard. And computers do get stolen a lot all the time, just not in your circle.
devops99 2y ago
I agree. TPM defends against the most likely threat that typical users are facing. And, where users that are individually targeted, the theft/robbery will more often than not be designed to appear "random". Because TPM sniffers are now at a material cost of about $15 and can be acquired for a price at under $200, more than a TPM is needed for data encryption, especially for users like a CEO. This is why a firm I used to work for encrypted the key that could unlock user data with both TPM plus Yubikey.

by p_ing 2y ago

AnthonyMouse 2y ago

> The vast majority of users aren't going to have their laptop stolen by the CIA/NSA and have their DIMMs popped and cryofreezed. That's kind of the point. The vast majority of users aren't going to have their laptop stolen at all, if they do it will 99% of the time be by someone who only wants to wipe it and fence it, and attempts to access data are most likely to be by unsophisticated family members who would be defeated by a simple password without any TPM. Meanwhile there have been plenty of TPM vulnerabilities that don't require anything so esoteric and can often be attacked purely from software, so if a normal user was facing even so much as someone willing to watch some security conference talks, they're going to lose regardless. If the TPM doesn't make them more vulnerable to that, because it contains the secrets and is susceptible to attack, vs. FDE with a boot key stored in some cloud service secured with the user's password instead of a TPM, which can then rate limit attempts without being susceptible to physical access attacks and be revoked if the device is stolen. Moreover, the more common threat to normal users is data loss, in which case you only want your laptop to be secure against your unsophisticated nephew and not the tech you want to recover your data after you forget your password. > In as much as there are attacks against SMS 2FA, but for the vast majority of people, SMS 2FA is an acceptable level of security. The current recommendation seems to be against SMS 2FA because the security of SMS really is that bad, so if you need 2FA, use an authenticator app or similar. > FDE (w/ TPM) is part of defense-in-depth. Any snake oil can be painted as defense-in-depth.

adgjlsfhk1 2y ago
imo sms 2fa is great since it is sufficient to stop automatic mass account stealing.
- AnthonyMouse 2y ago
  So is an authenticator app. Also, SMS isn't, because attackers often get access to the SMS network itself (see e.g. Salt Typhoon) in which case they can do automatic mass account stealing because they can see all the totally unencrypted SMS codes. The security of SMS really is that bad.
  - oyashirochama 2y ago
    Not to mention LTT showed the ability to spoof and steal SMS directly, on specific targets using the international phone system trust, something that is effectively impossible to block due to the inherient trust built into cell companies at the moment.
  - dataflow 2y ago
    > attackers often get access to the SMS network itself (see e.g. Salt Typhoon) "Often"?
    - andy81 2y ago
      Bit of an understatement, should be "always have access" if state attackers are included in the threat model.
      - AnthonyMouse 2y ago
        To be fair, there are also non-state attackers that can mass intercept SMS.
wkat4242 2y ago
> That's kind of the point. The vast majority of users aren't going to have their laptop stolen at all, if they do it will 99% of the time be by someone who only wants to wipe it and fence it, and attempts to access data are most likely to be by unsophisticated family members who would be defeated by a simple password without any TPM. True, any preboot password method (even fully software) will be sufficient to prevent data exposure when a laptop is stolen. The whole TPM + secure boot thing is more to prevent evil maid attacks where a laptop is messed with (eg installing a bootloader that intercepts the password) and then placing it back in the user's possession so they can be tricked into entering the password. That whole scenario is extremely far-fetched for home users. Laptops get stolen but then they're gone.

coppsilgold 2y ago

> The vast majority of users aren't going to have their laptop stolen by the CIA/NSA and have their DIMMs popped and cryofreezed. If you happen to have a Pro variant of Ryzen (there may be some Intel variants as well) then you can enable RAM encryption. The RAM will be encrypted with an ephemeral AES key on boot.

sidewndr46 2y ago

What is the argument here about the CIA / NSA or any other US Federal 3 letter agency? If your device is secured via TPM or some other scheme that relies on an industry to secure your device they aren't going to be doing "DIMM popping". They are just going to get the master keys from whomever issued them and use that bypass whatever they need to on the device.

p_ing 2y ago
You're missing the forest. The point being is that Microsoft's implementation on Win 11 Home ("device encryption", aka unconfigurable BitLocker) is sufficient for nearly all of their user base. If you're a target of a 3-letter agency, additional security measures are required.

a1o 2y ago

https://xkcd.com/538/ https://xkcd.com/538/

nfriedly 2y ago

In my experience, FDE (Full Disk Encryption) is more of a hindrance than help to average users. It just means that when something goes wrong, such as a forgotten password or a botched update, their data that would have otherwise been recoverable is now lost forever. I'm not sure I know anyone who's had a computer stolen, but I know lots of people who have lost data. Edit: I do know one person who had a computer stolen. It was a work laptop while they were in SF, and I'll concede that FDE probably does make more sense on a work-related computer. I was only arguing that it's more of a hindrance on personal devices that mostly stay in the owners home.

kd913 2y ago
Surely this is an issue for there not being an easy mechanism for backing up? The proper solution should be secure by design and user friendly. We shouldn’t compromise the former for the latter.
xyzzy_plugh 2y ago
I know of at least 10 instances of a company laptop being stolen. From the back of a car, from a coffee shop, from a hotel room, etc. It happens. Knowing any data on it cannot be recovered by malicious actors can be very reassuring.
p_ing 2y ago
> It just means that when something goes wrong, such as a forgotten password or a botched update, their data that would have otherwise been recoverable is now lost forever. Not at all. You can get your recovery key back via a few different means (for 11 Home, OneDrive/printed/PDF, for enterprises, various ways) and boot into the Windows Recovery Mode environment to perform the same repair options one would have without BitLocker in place.
n144q 2y ago
> I'm not sure I know anyone who's had a computer stolen, but I know lots of people who have lost data. That's exactly where you got your priorities wrong. Yes there is a tradeoff. But backing up your data is easy (especially in a corporate environment), while security is hard. And computers do get stolen a lot all the time, just not in your circle.

devops99 2y ago

I agree. TPM defends against the most likely threat that typical users are facing. And, where users that are individually targeted, the theft/robbery will more often than not be designed to appear "random". Because TPM sniffers are now at a material cost of about $15 and can be acquired for a price at under $200, more than a TPM is needed for data encryption, especially for users like a CEO. This is why a firm I used to work for encrypted the key that could unlock user data with both TPM plus Yubikey.