Post #4328211

Replies (1)

• @david_chisnall@infosec.exchange 2026-08-02 10:37

  @bazkie@beige.party I would really encourage you to read up on what TPMs are and what they do. I have no idea where you are getting your information but it is a mixture of hypothetical use cases (corporations don’t use TPM IDs to track people because there are far more privacy-invasive alternatives that are much more useful for surveillance and easier to access) and misinformation that are leaving you to adopt security features because they might be misused. It sounds like you read the marketing bullshit Microsoft tried to sell the movie and music industries in the late ‘90s and actually believed it. Meanwhile, you leave your systems vulnerable to large classes of attacks that can be entirely prevented. I think you don’t understand what a TPM does. I have worked on hardware security modules that can implement the TPM specification, so I think I can confidently claim that I do. The TPM spec is not great and omits a load of features that should be table stakes for a hardware root of trust. But it is, at least, a standard. a TPM provides an non-removable fingerprint This is true. that corporations can use to identify your device. No, that software with access to the TPM can use to identify the device. Whether you allow corporations to control software on your device that has direct access to the TPM is a policy choice made by you. If you don’t want corporations to have access to that unique identifier, don’t let them run code in kernel mode on your device or access kernel APIs that expose this identifier. But, generally, corporations don’t want that identifier because they don’t want to track computers, they want to track people. At least the use cases you should be worried about (not, for example, a company doing inventory management of the computers that they own). also, they can force you to use TPM'ed hardware, by having their software/hardware/services not work without one; Hardware? Not sure what that would be. Software? Windows 11 needs a TPM, to provide a bunch of things in the security subsystem because there are a bunch of attacks that it can’t defend against without a TPM. But if you’re running Windows then Microsoft is already in the TCB for everything on your computer. Every Windows install already has a unique identifier that Microsoft can query, they don’t need a TPM for this, they have been doing all of the privacy-invasive things that you might care about since Windows XP, without any TPM requirement. If your threat model includes Microsoft, don’t let Microsoft run the most privileged software on your system. Services? The TPM can provide the trust anchor for the very first chain in a remote-attestation scheme, but remote attestation for desktop / mobile applications is ludicrously broken. The claim you get is ‘assuming these hundreds of millions of C code are bug free, the user is running an authorised client’. The TPM really doesn’t help here at all. Things like Intel SGX are much better for that kind of use case because they allow a small amount of trusted code that you might plausibly be able to make claims about. It’s a far better model for corporations to control the clients that can access their services. Oh, and SGX doesn’t depend on a TPM at all. thereby forcing you to use only hardware that corporations, or later, governments, "approve of". A TPM is trivially virtualisable. If you want to go down this road, you need a bunch of things at higher levels in this stack. The TPM is largely irrelevant. It’s like saying ‘people can use computers to send spam, therefore I won’t use computers’ in terms of generality and misplaced blame. this is the groundwork of a forced identification ecosystem that we are being moved towards. No, it is not even a necessary component for those. They all run at much higher levels of the stack and don’t meaningfully depend on anything a TPM can do. A TPM is less important for these things than a CPU, does that mean you refuse to use a computer with a CPU?

  Open ##4328209