On: faulTPM: Exposing AMD fTPMs' Deepest Secrets

[anthk]

And now I remember people telling me Windows is more secure than Unix because of TPM, foo... bar...

No, thanks, bioctl(4) works well under OpenBSD for disk encryption and so will do under HyperbolaBSD.

[shitter → anthk]

Windows, Linux, OpenBSD - it doesn't matter. Without a TPM you're vulnerable to trivial attacks (Evil Maid), far easier than the one in this article.

[salawat → shitter]

So.... Take your laptop with you everywhere?

When did we start creating nightmarish system complexity to guard against attacks that are generally exceedingly rare....oh wait. Forgot where I was.

[shitter → salawat]

That cannot be a serious proposal. These attacks can and do happen, and it's in our interest to design systems that make them as hard as possible.

I'll take "nightmarish complexity" that puts these attacks outside of the scope of a technically savvy teenager over having to carry my machine with me everywhere I go, any day of the week.

[anthk → shitter]

Did you try OpenBSD with bioctl? You can tamper with the bootloader, but not the rest. And you can always set the bootloader in another media and always boot from that.

[shitter → anthk]

Tampering with the bootloader is game over. And what, are you keeping this other bootloader medium on your person and in your sight at all times? It's never ever unattended?

[codedokode → shitter]

Using TPM with closed source firmware, especially written and designed by Microsoft, probably full of backdoors, when you don't even know what it's doing is a worse choice.

[shitter → codedokode]

I don't think it's a worse choice. Either way, you're screwed with physical access. At least with TPM, the attack requires more sophistication.