GPUs & CPUs & Enthusiast hardware: Questions, Discussion and fanboy slap-fights - Nvidia & AMD & Intel - Separe but Equal. Intel rides in the back of the bus.

[DavidS877]

Was it on this site where some guy was absolutely convinced that the TPM chip was some sort of magical spy device that automatically sent every bit of data on your computer to Microsoft no matter what OS or network configuration you had? I can't recall where i stumbled across that gem.

It's actually the Intel Management Engine that does that. It uses a wireless connection to your smart meter to send everything back to Microsoft. Why do you think everyone switched to smart meters.

 

[The Ugly One]

View attachment 7409039

basically only happens when running slightly more demanding games (Total War, BG3) and is completely fine otherwise

The most likely thing here is you've got a DIMM that is about to shit the bed. Memory DIMMs are one of the most commonly failing parts. Try removing one DIMM and see if the problem persists, then removing the other.

Was it on this site where some guy was absolutely convinced that the TPM chip was some sort of magical spy device that automatically sent every bit of data on your computer to Microsoft no matter what OS or network configuration you had? I can't recall where i stumbled across that gem.

Yes, that was this site. I had a many-page argument with multiple spergs about how TPM was a collaboration between Intel and Microsoft to put spyware on your machine and force you to upgrade to Windows 11 in order to boost MS's bottom line by a fraction of a percent. I remember one person saying rather proudly that he had switched to Linux and disabled TPM on his AMD CPU. It's also no longer a separate chip; it's within the CPU itself now.

I'll take the bait. For whom? The average user has no use for TPM.

If you use a PIN to log into Windows, you're using TPM. If you use your Personal Vault on OneDrive, you're using TPM. If you tell a website, "remember this device," you're using TPM. If you use Chrome's built-in password manager, you're using TPM. The average user on a current-generation PC is constantly using the TPM.

You're surrendering your device to faceless entities that have access to signing keys you aren't supposed to meddle with.

There is no direct remote access to the TPM.

Microshart Wangblows requires one with 11 so that they have a baseline of hardware to work and implement all their anti-consumer, privacy-invading, three-letter agencies welcoming "features" (such as Recall

Windows Recall requires a NPU with at least 40 TOPs to run, it's at most tangentially related to the TPM. Every version of Linux that matters supports the TPM as well. Every modern mobile device has a TPM, except Apple, but that's because they have their own equivalent in-house technology.

And here we go again.

 

[DavidS877]

All TPM really means is they have to steal your whole computer instead of just the drives if you make the mistake of using automatic decrypt on boot.

And thanks for reminding me to get around to disabling it on my non-Windows systems. Last thing I need is something accidentally using it and then moving hardware around and stuff disappearing.

 

[Combustion Engine]

If you use a PIN to log into Windows, you're using TPM. If you use your Personal Vault on OneDrive, you're using TPM. If you tell a website, "remember this device," you're using TPM. If you use Chrome's built-in password manager, you're using TPM. The average user on a current-generation PC is constantly using the TPM.

I cannot imagine doing any of those, sorry. And I would strongly advise anyone not to, either. The majority of those tie the user to proprietary software in the worst ways possible, with your data being sent to the cloud somebody's else PC: is the alleged convenience worth it? Normal versions of Windows 11 will automatically upload your encryption key to their servers once you connect your account. Have a student/work account and sign into your personal device with it? If you're not attentive you've just enrolled it into the institution the account is managed from and have granted them access to your keys, and are now just a mere tenant to Azure. That's just getting started with the possibilities.

There is no direct remote access to the TPM.

Most CPUs are running an entire Minix stack under them with network access. And Microsoft, being the friendly company it is, the root trust for SecureBoot, knows well you're not going to enroll your own keys like a nerd (assuming you don't brick your laptop in the process, like chink lenovo ones do). You are heavily discouraged from attempting to gain any sort of control over it.

Windows Recall requires a NPU with at least 40 TOPs to run, it's at most tangentially related to the TPM. Every version of Linux that matters supports the TPM as well. Every modern mobile device has a TPM, except Apple, but that's because they have their own equivalent in-house technology.

My stance on this topic is in line with that of the FSF. I'm not going to drag this discussion, and haven't read your previous one yet, but I understand that position and the reality we live in where ownership of data and control is traded for convenience and alleged security. I strongly believe its existence is a detriment to the user thanks to the possibilities it allows to enforce user-hostile behavior, which is now incentivized thanks to its mandatory presence in all desktop machines. I also suspect remote attestation will become another cancer upon personal computing, if the current state of desktops doesn't die first, it being pretty much one of the last places you have any resemblance of ownership. If an user wants secure management of keys, they should get a YubiKey (or preferably an open-source alternative) instead of relying on shady manufacturers and their physical or software implementation of that. TPMs aren't even good RNGs and using their crypto primitives isn't even recommended.

Also
>Windows 11
>upgrade

 

[Slav Power]

>Use case for TPM?

 

[DeadwastePrime]

i have upgraded the cooler in my pc. the stock one was holding my pc back and now it can unlock its true potential by not overheating to death all the time when playing games

 

[The Ugly One]

The majority of those tie the user to proprietary software in the worst ways possible

Ah, I see you are a RISC-V patrician running Slackware like myself.

with your data being sent to the cloud somebody's else PC

The TPM key is physically burned into the device and not accessible to software, so it can't be sent to anyone. Decryption happens in hardware.

Normal versions of Windows 11 will automatically upload your encryption key to their servers once you connect your account.

No, they don't.

My stance on this topic is in line with that of the FSF.

There are basic factual errors in this. TPM 2 is not a chip on the motherboard; it's part of the CPU. Microsoft also does not control it.

they should get a YubiKey (or preferably an open-source alternative) instead of relying on shady manufacturers

Intel's implementation is open source: https://github.com/tpm2-software/tpm2-tss. What manufacturer are you getting your CPU from that isn't Intel, AMD, Qualcomm, or Apple?

You should probably learn about what this technology actually does before writing a bunch of nonsense. Start here:

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/tpm-key-attestation

 

[Combustion Engine]

No, they don't.

What about the following? I read it's the default from 11 24H2, but I have never installed it (and wouldn't bother using an account), so I can't be certain about it.

There are basic factual errors in this. TPM 2 is not a chip on the motherboard; it's part of the CPU. Microsoft also does not control it.

fTPMs are exchanging one attack surface for another. It just so happens there is past evidence of them being attacked successfully:
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-4005.html
https://seclists.org/fulldisclosure/2018/Jan/12

I know enough about them, and what I consider to be better alternatives, to stay away from them until it won't be possible anymore.

 

[Slav Power]

I read it's the default from 11 24H2

My Win11 24H2 laptop had BitLocker disabled from the factory, and it is a ThinkPad so you'd think it'd be enabled by default.

 

[The Ugly One]

What about the following? I read it's the default from 11 24H2, but I have never installed it (and wouldn't bother using an account), so I can't be certain about it.

Your Bitlocker Recovery Key and the TPM Endorsement Key are different things, and you should probably spend some time learning what things are.

 

[Combustion Engine]

Your Bitlocker Recovery Key and the TPM Endorsement Key are different things, and you should probably spend some time learning what things are.

I'm fairly sure I have not implied that, and I haven't even mentioned EKs, except for the last two links that are about breaking exactly that verification. Like I said, I don't want to put everyone through this again, so I'll end it here.

 

[The Ugly One]

I'm fairly sure I have not implied that, and I haven't even mentioned EKs, except for the last two links that are about breaking exactly that verification. Like I said, I don't want to put everyone through this again, so I'll end it here.

So what does Microsoft keeping a copy of your Bitlocker Recovery Key have to do with the TPM?

except for the last two links that are about breaking exactly that verification

First vulnerability requires physical access to the hardware and uses a voltage fault to bypass the TPM, second doesn't actually compromise the TPM, but rather uses a firmware bug to compromise the memory space of the already-running system.

 

[Combustion Engine]

So what does Microsoft keeping a copy of your Bitlocker Recovery Key have to do with the TPM?

You listed a number of things people may do for the sake of convenience without understanding the security compromises and I was expanding on it in this context. You're handing over your recovery key, all that is necessary to access the data if the encryption is enabled automatically (which it may be now?), to your microsoft account that you're requested unless you know better (and you know whatever workaround hasn't been patched yet).

 

[seri0us]

The TPM is a good security feature

Against what?

I'm by no means a security or random numbers expert but it seems you can get proper entropy from WiFi static, hashing random things like user interaction lag, etc.

 

[Agent Abe Caprine]

I hate Recall because it's yet another useless thing that'll clog my OS drive up if I forget to disable it. I barely care about the privacy concerns anymore. I just don't like bullshit clogging my OS drive up.

 

[Fcret]

Was it on this site where some guy was absolutely convinced that the TPM chip was some sort of magical spy device that automatically sent every bit of data on your computer to Microsoft no matter what OS or network configuration you had? I can't recall where i stumbled across that gem.

I've heard that conspiracy about the ME/PSP but not about the TPM.

If you use a PIN to log into Windows, you're using TPM. If you use your Personal Vault on OneDrive, you're using TPM. If you tell a website, "remember this device," you're using TPM. If you use Chrome's built-in password manager, you're using TPM. The average user on a current-generation PC is constantly using the TPM.

Also literally anytime your computer needs to use encryption, it's probably generating a key using entropy that's provided in part by the TPM.

The idea of the TPM itself isn't really objectionable. I understand fear about baroque black boxes (which is why I don't really like the ME/PSP), but TPM stuff has become more transparent with time, not less. It's certainly less onerous than the original proposals for trusted computing.

 

[The Ugly One]

You're handing over your recovery key, all that is necessary to access the data if the encryption is enabled automatically (which it may be now?), to your microsoft account that you're requested unless you know better (and you know whatever workaround hasn't been patched yet).

Your Bitlocker recovery key doesn't work remotely. But yes, it's vulnerable to a data breach at Microsoft, but it would still require someone to steal your physical computer. That key is stored encrypted and requires your Microsoft credentials to decrypt, though.

Against what?

I'm by no means a security or random numbers expert but it seems you can get proper entropy from WiFi static, hashing random things like user interaction lag, etc.

One of the main use cases is when you tell your browser's password manager to save your credentials. Every password saved on your device is saved in a file. That file can, potentially, be stolen. In a world with no TPM, where everything is password protected, if you are a typical retard, you probably used a shitty password to secure this file, and it is vulnerable to a dictionary attack. So the attacker can just run his attack software and come back once your file is cracked. He now has access to all your password-protected stuff online. With TPM, that file isn't password-protected; it's encrypted by a key that is physically burned into your CPU, so the attacker can't decrypt it.

 

[Stratos Sphere]

Have you had a PSU fry? Not fun. Got to inspect everything to see if anything else died. I say upgrade your shit out of kindness. When shit dies, it happens violently.

Upgrading your psu prematurely is like getting an oil change every 1000 miles. Will it help with longevity? Probably not. Will it keep your compenents lasting longer? Maybe. Is it a waste of money ? Yes.
I've only had 3 power supplies fail and they were all gold rated 850w psu's that I bought new(from thermal take), and they all failed in less than a year. Meanwhile I had a shitty 200w dell prebuilt psu in high school that was hanging out of my case because it couldn't fit, you could hear crackling when pushing the psu. That thing never broke and I only got rid of it because I needed a 6pin pcie for a gpu I bought. Point is if it aint broke don't fix it.
Realistically if you have a modern system, there are fallbacks in place that will 99% of the time protect everything in case of psu failure.. your advice is retarded.

 

[DavidS877]

I've only had 3 power supplies fail

I can't even remember, I think I've had one fail. Not counting the 1980s vintage one that let out the smoke a couple years ago.

Obviously I've had RAM, CPU, Disk, Motherboard, SSD, cards of all flavors, and fans, so many fans. But PSU have been rare except needing to replace the fan. I don't think I've had any NVME M.2 fail yet, and no cases failing, but they're just boxes made of metal if you exclude the drive backplane, which of course fail plenty.

 

[Post Reply]

I hate Recall because it's yet another useless thing that'll clog my OS drive up if I forget to disable it. I barely care about the privacy concerns anymore. I just don't like bullshit clogging my OS drive up.

Embrace the last good Windows release, LTSC IoT.