Yes siree, the excitement never stops!

  • 0 Posts
  • 106 Comments
Joined 11 months ago
cake
Cake day: December 7th, 2023

help-circle





  • This person asked if they can make PopOS secure via TPM.

    I am saying that while yes, you can, there isnt much point, because setting up LUKS to work with TPM is inconvenient, easy to fuck up, and basically offers no additional protection against all but extremely implausible security scenarios for basically everyone other than bladed server room admins worried about corporate espionage who are for some reason running bare metal PopOS on their server racks.

    Like the only actual use case I can see for this is /maybe/ having a LUKS encrypted portable backup drive, but even then you can still base the encryption key in the actual main pc’s harddrive without using tpm, though at /that and only that point/ are we approaching parity between the difficulty of using or not using tpm to accomplish this.


  • Oh ok so the use case here is if this casual linux user asking this question has only their harddrive stolen from their pc or their laptop in their home or apartment or workplace, not their whole pc.

    Mhm that seems likely.

    I guess this maybe makes sense if youre running like a server room, but chances are low thats the actual context of this question.

    Why would you run PopOS on a large operation’s servers?





  • Ok… so… if you have TPM… and LUKS…

    You still have a scenario where the encryption key is still on your physical device, LUKS with or without TPM, or … some kind of TPM based Linux encryption solution I have never heard of?

    Does Windows Secure Boot work on Linux via the TPM?

    No…

    Am I missing something?

    Theres no point in involving TPM in securing a linux computer.

    In a scenario where you’ve physically lost your computer, using TPM or not it wont matter if your pc gets into the hands of someone who can attempt to brute force the keys.

    If your pc is remotely compromised to the point it has something on it that can grab your keys, it also will not matter if you are using TPM in some way.

    The only practical use of full disk encryption is if your linux pc and or laptop gets stolen and falls into the hands of a non tech savvy person, and in that scenario, going through the trouble of correctly binding LUKS to TPM will have just been a waste of time.

    Thus, you should probably just use LUKS and not bother routing it through TPM.


  • Sure but you dont need to use TPM at all to use LUKS.

    You can store the encryption key on the harddrive, in the LUKS partition layer.

    Like thats the default of how LUKS works.

    Im really confused why people think TPM needs to be involved in anyway when using LUKS.

    Generally speaking you have to go out of your way to correctly cajole TPM v1 or v2 to actually correctly interface with LUKS.




  • Well even then, if you actually looked into this sort of thing, its been obvious for a while.

    Historically, as studied by anthropologists, historians, sociologists, its been known for a while that civilizations collapse due to:

    Massive Famines

    Unexpected Broad, Rapid Climate Shifts

    Massive Internal Political/Civil Unrest

    Foreign Invasion

    Massive Plagues

    Insulated Ruling Class making absurd decisions to maintain their own power at the cost of the actual stability of their society

    Collapse of Vital Trade Routes

    Neglect and Failure of Vital Infrastructure

    Financialization of the Economy, writ large

    Now sometimes it can be just one of these, but usually its a few.

    Most current societies/nation states are currently experiencing or will very soon be facing nearly all of these combined.

    I suggest you read John Michael Greer’s Catabolic Collapse book or watch some of the videos about it for an overview of the basic idea that complex societies tend to respond to crises by becoming more complex, which is the exact opposite of what you would want to do from a big picture, hindsight perspective, but is more or less unavoidable due to human psychology and socio/political/economic dynamics of human organized societies.

    You are right that the vast majority of people will be surprised by the speed of collapse, logarithmic vs linear basically.

    But the people who have been in charge of our societies either did, do, or should know or should have known about this.