Post #4327164

@bazkie@beige.party No, I think you don’t understand what a TPM does. A TPM provides a set of cryptographic primitives and key storage, as well as a set of PCRs that allow you to record boot state so that keys can be stored in such a way that they can be released (or derived) only when the boot has met some external policy. On top of a TPM, you can build whatever policies you like. Linux can it for disk encryption so that you must boot GRUB then a Linux kernel signed with a specific key, then enter a passphrase to get access to your files. If someone boots Windows, they cannot access the key for the files. Things on top of Linux can use it for storing a secret that’s used with key derivation and a signing flow to ensure that WebAuthn keys cannot be leaked (though they can be used) even if an attacker manages to use a privilege-elevation exploit and compromise your kernel. Neither of these is moving power to a corporation. Your argument is like saying you refuse to ever put a lock on your front door because slave labour camps use locks. The problem isn’t the lock, it’s who holds the key.