this post was submitted on 19 Feb 2024
33 points (97.1% liked)
Linux
48328 readers
641 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
The point is to have the system automatically unlock without the need for a boot password. This provides decent security if secure boot is enabled, but requires very little from the user. It isn't a stopper for high threats, but a simple theft will mean the data is safe. It also ensures that if the drive is separated from the host machine, it is useless without a copy of they key. It doesn't stop all threats, but stops a lot of them, and all of the most common.
Oh ok so the use case here is if this casual linux user asking this question has only their harddrive stolen from their pc or their laptop in their home or apartment or workplace, not their whole pc.
Mhm that seems likely.
I guess this maybe makes sense if youre running like a server room, but chances are low thats the actual context of this question.
Why would you run PopOS on a large operation's servers?
While i am personally also not a huge fan of TPM for FDE it is still a valid use. Why? In order to access data on the disk you would still need to bypass the login screen which is non trivial. Also another use case is encrypting the drive so when you sell it or dispose of it you do not need to worry about wiping it at least once to get rid of all data.
TPM has its weaknesses but pls don't talk down to someone who wants to use it when you do not understand his use case.
It should stop issues with full device theft as well, if done correctly, because if secure boot isn't on and working, it will refuse to give the key. Which means, if it was setup correctly, the computer cannot be accessed without know the users name and password. This is the general accepted stack for Microsoft's BitLocker. It becomes completely transparent to the user, but puts a decent blocker to access in cases of theft. There are ways around it like freezing RAM or packet sniffing an external TPM, but those are high level attacks.
If the TPM is not integrated in the CPU and rather a separate Chip on the MB, the communication can be easily sniffed since it's not encrypted. See here https://youtu.be/wTl4vEednkQ?si=26A0NK-cVtP3uKgk
Shown how cheap it is i would not say it is high level.
Here is an alternative Piped link(s):
https://piped.video/wTl4vEednkQ?si=26A0NK-cVtP3uKgk
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I'm open-source; check me out at GitHub.
Thx for your answer tho. I liked reading it.