Yes siree, the excitement never stops!

  • 0 Posts
  • 69 Comments
Joined 10 months ago
cake
Cake day: December 7th, 2023

help-circle



  • This person asked if they can make PopOS secure via TPM.

    I am saying that while yes, you can, there isnt much point, because setting up LUKS to work with TPM is inconvenient, easy to fuck up, and basically offers no additional protection against all but extremely implausible security scenarios for basically everyone other than bladed server room admins worried about corporate espionage who are for some reason running bare metal PopOS on their server racks.

    Like the only actual use case I can see for this is /maybe/ having a LUKS encrypted portable backup drive, but even then you can still base the encryption key in the actual main pc’s harddrive without using tpm, though at /that and only that point/ are we approaching parity between the difficulty of using or not using tpm to accomplish this.


  • Oh ok so the use case here is if this casual linux user asking this question has only their harddrive stolen from their pc or their laptop in their home or apartment or workplace, not their whole pc.

    Mhm that seems likely.

    I guess this maybe makes sense if youre running like a server room, but chances are low thats the actual context of this question.

    Why would you run PopOS on a large operation’s servers?





  • Ok… so… if you have TPM… and LUKS…

    You still have a scenario where the encryption key is still on your physical device, LUKS with or without TPM, or … some kind of TPM based Linux encryption solution I have never heard of?

    Does Windows Secure Boot work on Linux via the TPM?

    No…

    Am I missing something?

    Theres no point in involving TPM in securing a linux computer.

    In a scenario where you’ve physically lost your computer, using TPM or not it wont matter if your pc gets into the hands of someone who can attempt to brute force the keys.

    If your pc is remotely compromised to the point it has something on it that can grab your keys, it also will not matter if you are using TPM in some way.

    The only practical use of full disk encryption is if your linux pc and or laptop gets stolen and falls into the hands of a non tech savvy person, and in that scenario, going through the trouble of correctly binding LUKS to TPM will have just been a waste of time.

    Thus, you should probably just use LUKS and not bother routing it through TPM.


  • Sure but you dont need to use TPM at all to use LUKS.

    You can store the encryption key on the harddrive, in the LUKS partition layer.

    Like thats the default of how LUKS works.

    Im really confused why people think TPM needs to be involved in anyway when using LUKS.

    Generally speaking you have to go out of your way to correctly cajole TPM v1 or v2 to actually correctly interface with LUKS.









  • Is… is the thing in front a … an MT-LB, with basically a bunch of random crap taped onto it, and because the turret doesnt turn, they took out the gun … and built what i can only describe as the hobo version of a machine gun pit for a Dshk … on top of it?

    Good fucking god. Hobo-ified MTLB.

    EDIT: Derp, I mean MT-LB, originally had a stroke and confused the btr 60 with that.


  • As a sort of most horrifying and most ludicrous means possible of population control of the operating force employing this tactic anywhere near frontlines, or in areas that do not have air defence suitable to stop drones or aircraft, yes.

    As a means of stopping anything that would not otherwise be stopped by the vehicle’s armor, no.

    Unless it turns out the vehicle is actually made of aluminum instead of steel. Then… maybe yes for 50 cal rounds coming from beyond about a kilometer, maybe less.