Post #4327165

2026-08-02 09:50 UTC

@david_chisnall@infosec.exchange and I will never use a desktop computer with a TPM chip. TPM moves power from the user to corporations. devices with a TPM chip are not fit for purpose when it comes to security.. I think we're on an ideological divide here 😁

Replies (1)

@david_chisnall@infosec.exchange 2026-08-02 09:58

@bazkie@beige.party No, I think you don’t understand what a TPM does. A TPM provides a set of cryptographic primitives and key storage, as well as a set of PCRs that allow you to record boot state so that keys can be stored in such a way that they can be released (or derived) only when the boot has met some external policy. On top of a TPM, you can build whatever policies you like. Linux can it for disk encryption so that you must boot GRUB then a Linux kernel signed with a specific key, then enter a passphrase to get access to your files. If someone boots Windows, they cannot access the key for the files. Things on top of Linux can use it for storing a secret that’s used with key derivation and a signing flow to ensure that WebAuthn keys cannot be leaked (though they can be used) even if an attacker manages to use a privilege-elevation exploit and compromise your kernel. Neither of these is moving power to a corporation. Your argument is like saying you refuse to ever put a lock on your front door because slave labour camps use locks. The problem isn’t the lock, it’s who holds the key.

Open ##4327164