TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

TPM provides zero practical security

76 点作者 osy超过 1 年前

19 条评论

Nextgrid超过 1 年前
Unfortunately this sounds like a typical pro-Linux rant with the usual scare words such as &quot;Microsoft&quot;, &quot;UEFI&quot;, &quot;secure boot&quot;, etc. To be clear, I am attacking the piece itself, not the author.<p>The reason there is no explicit threat model defined in the TPM specs is because it defines a general-purpose hardware security module. It is up to integrator to define the threat model (TPM&#x27;s security properties also depend on the rest of the system) and the application.<p>Even if a TPM is not perfect and depends on other pieces of the puzzle to also be secure, it at least opens the possibility of making it secure in the future once those vulnerabilities are discovered &amp; fixed. Furthermore, even in this vulnerable state, it still increases the effort required for a successful attack.<p>Support for TPM-backed full disk encryption means you can now have FDE on by default for everyone with no usability impact at all. Even if it&#x27;s not secure and a dedicated attack will still break it, it means a casual attacker can&#x27;t just pull a drive or reboot the machine and run chntpw or steal sensitive data from discarded drives that haven&#x27;t been properly wiped.<p>I like TPMs. I like the fact that a rogue datacenter employee or intruder can&#x27;t just pull one of my servers&#x27; drives out and get sensitive data. I like not having to worry about having sensitive keys on the filesystem somewhere because every secret is in memory and is ultimately derived from the TPM doing remote attestation at boot and handing ephemeral keys. I like not having to worry about unattended reboots or entering LUKS passphrases remotely.
评论 #37437182 未加载
评论 #37437079 未加载
评论 #37437393 未加载
评论 #37439272 未加载
评论 #37450968 未加载
评论 #37437586 未加载
评论 #37437650 未加载
评论 #37438098 未加载
ak217超过 1 年前
&gt; You can also use the TPM + PIN as a sort of Yubikey<p>That&#x27;s not zero. In my mind that&#x27;s the main thing a TPM is really useful for. It&#x27;s a secure enclave for a private key used for U2F&#x2F;WebAuthn style attestation. I agree that the threat model not being explicitly discussed is a huge miss. But to that point, a TPM is still useful because it prevents someone who has hacked into my computer from commanding the TPM&#x27;s authentication factor.<p>The other useful application is to prevent block device data extraction without knowing the passkey. And the author&#x27;s argument there hinges on the notion that Microsoft won&#x27;t patch OS security vulnerabilities that enable key extraction from memory. Which, OK, third-party drivers suck, but Microsoft&#x27;s effort to patch is also not zero, and the most common (OS+browser&#x2F;sandbox) threat model requires a chain of vulnerabilities that are hard to come by.
评论 #37437457 未加载
评论 #37437768 未加载
评论 #37437101 未加载
pxeger1超过 1 年前
I don&#x27;t agree with this. Yes, any TPM is necessarily possible to bypass, but it&#x27;s not easy. I know I could bypass normal password-based FDE with physical access to a machine without any special hardware or software, but not TPM-based. I assume, by the Pareto principle, that there are lots of people with my ability but exponentially fewer who <i>could</i> bypass a TPM. So it&#x27;s definitely more secure than password-based FDE, and it&#x27;s good enough for me.
评论 #37437867 未加载
EPWN3D超过 1 年前
Not a great take. The TPM provides the primitive of &quot;non-extractable keys&quot;; it&#x27;s not supposed to magic up secure boot.<p>Even then, the argument that a TPM is worthless because it can&#x27;t guarantee that software is free of vulnerabilities just belies an un-seriousness of the post. Like okay, that argument applies to every threat model ever.<p>A boot chain can be secure with or without a TPM. The TPM just says &quot;I&#x27;ll record what your boot chain told me and spit it back out with a signature that is verifiable by public key cryptography, so that you can tell it&#x27;s what your boot chain told me. How much you trust your boot chain is up to you.&quot;
评论 #37454298 未加载
donmcronald超过 1 年前
&gt; the signature of the BIOS is checked against a public key whose hash is stored in fuses<p>&gt; Each of dozens (up to hundreds) of UEFI drivers written by various OEMs with varying levels of competence and care are loaded<p>Doesn&#x27;t the BIOS signature encompass those drivers? Put another way, isn&#x27;t the BIOS vendor attesting those drivers are non-malicious with their signature?<p>I think the TPM will turn out to be a net negative for consumers since it&#x27;s going to get used to get used for attestations users can&#x27;t control (ie: against the will of the user), but there are some benefits. Having a BitLocker key unlocked via a PIN where the TPM can protect against brute force attacks is useful for me. That alone covers most of my threat model which is having my data extracted from a lost or stolen PC.
helloooooooo超过 1 年前
Ask Google exactly how they enforce their zero trust, VPN-less remote work environment. Hint: it has to do with the TPM. DRTM + Device Certificates + TLS Token Binding is a huge deal for proving that the endpoint is trusted, and that the principal actually logging in is using an approved device. DRTM prevents boot time tampering by assuring that the measured boot state is consistent with what the network expects.
评论 #37437535 未加载
评论 #37454321 未加载
marcosdumay超过 1 年前
On the one usage scenario that benefits a PC user, the TPM makes for a really bad yubikey. You can&#x27;t carry it between computers, you can&#x27;t back it up, and you are certain to lose it at some point when the computer breaks of gets outdated.<p>That means it either requires a second protocol for authentication, or that you will lose your accounts with all kinds of services all the time.
评论 #37437218 未加载
评论 #37437013 未加载
评论 #37436739 未加载
completelylegit超过 1 年前
TPM isn’t about security, it’s about DRM
评论 #37437252 未加载
评论 #37437662 未加载
评论 #37437740 未加载
hirsin超过 1 年前
So it boils down to &quot;we shouldn&#x27;t attempt to build new security stuff because what it&#x27;s built on could have vulnerabilities&quot;?<p>Time to go back to kernel mode everything I guess. Just run everything as root, get rid of sudo.
评论 #37437489 未加载
评论 #37437134 未加载
评论 #37437249 未加载
lxgr超过 1 年前
Should the title at least be &quot;the trusted computing&#x2F;measurement functionality of TPMs provide...&quot; rather than &quot;TPM provides...&quot;?<p>TPMs can do other useful things besides performing attestation measurements for trusted computing, including acting as a secure element to safeguard and rate-limit keys used for SSH, disk encryption and much more.
TowerTall超过 1 年前
&gt; The Trusted Platform Module(TPM) requirement enables Windows 11 to be a true Passwordless operating system<p>Good luck trying to remote (RDP) into a Windows box with a passwordless account or to access a fileshare.<p>While passwordless Microsoft accounts are very convenient it is only according to MS Marketing department that windows can be a true passwordless system. In reality it is not. There any several components in Windows that does not work with a passwordless account. The RDP and network issues has been know for many years and is a PITA for home networking.
PeterStuer超过 1 年前
Wouldn&#x27;t the threath mitigation model be &quot;prevent 80% of normies watching Disney on their HDMI monitor without paying&quot;?
评论 #37437328 未加载
mixmastamyk超过 1 年前
Been wondering if I should enable these things in the firmware for several years, so the discussion is welcomed.<p>I do have a travel laptop and recently installed LUKS to it. I like having my long password, but being able to tie unlocking to the hardware sounds like a good idea too. Is there a way to have both? A long password and require the local TPM?
评论 #37438719 未加载
yakkityyak超过 1 年前
Zero is a stretch. I think they have largely failed to serve their purpose in the consumer device realm, beyond decent integration with BitLocker.<p>Despite the shortcomings, I think they are very useful devices from the perspective of running data centers. I consider it useless against evil maid attacks though.
评论 #37446137 未加载
评论 #37438599 未加载
WirelessGigabit超过 1 年前
All the hardware based attacks require opening up the laptop and doing something with the motherboard.<p>I&#x27;d have to check if bottom cover tampering on my Lenovo actually requires me to put in the BitLocker keys again.
predictabl3超过 1 年前
The absolute dumbest shit here gets up voted regarding Linux.<p>No dang, I don&#x27;t care about the spirit of the site when absolute ludicrous mindrot garbage is up voted here constantly. You&#x27;ll note on the Wayland thread that, despite being the 30th Wayland thread, the only substantive reply agreed with me. It&#x27;s a joke.<p>Don&#x27;t worry, I&#x27;m changing my password to a random guid, you&#x27;ll be free of me in 45 seconds.
decodebytes超过 1 年前
A lot of this is plain naive and wrong.
评论 #37454327 未加载
sidewndr46超过 1 年前
well sure, TPM is mostly about limiting what the average Joe can run on his computer. It isn&#x27;t meant to stop adversaries.
评论 #37437609 未加载
jimkoen超过 1 年前
At this point I don&#x27;t understand why hardware vendors can&#x27;t just do it like Apple. Put a small ARM SoC with some firmware in ROM onto the mainboard that starts before the main CPU and initializes it, ensuring that the system is in a known state before any components boot.
评论 #37436822 未加载
评论 #37437014 未加载