218
Windows 11 IoT LTSC 2024 arrives making TPM and Secure Boot optional — lower storage requirements, too
(www.tomshardware.com)
this post was submitted on 26 May 2024
218 points (97.4% liked)
Technology
59534 readers
3143 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Rats. Leaving TPM off in the BIOS is how I've been avoiding it nagging me to upgrade from 10.
This is for IoT.
16 GB just for an IOT OS is fucking bloated IMO.
It's obviously not intended to run on an Arduino or something.
Um.... then what is it intended for? ATMs and POS terminals don't really strike me as IoT devices.
I still have a laptop running a (old) full kde desktop in 192 MB of Ram from a 12GB disk with lots of space to spare.
It's been quite a while, but on an older system years ago I recall it slightly nagging me about how the computer wasn't W11-enabled.
I've been curious about people who have been disabling the TPM. Where are you storing your disk encryption keys?
I'm not using disk encryption. It's a desktop and if it's every stolen I've got bigger problems.
Also, I presume that disk encryption makes it so you can't just pop the drive in an adapter and pull stuff off it, which I sometimes need to do with old, retired drives.
veracrypt is a thing, encrypting drives does not need TPM.
Just boot using the good old Master Boot Record for a clean solution (The Veracrypt documentation gives a good overview). Veracrypt works with EFI too, but the EFI partition itself cannot be encrypted. You can even create a hidden OS, if you are forced to give out your password, theres still plausible deniability.
Thanks for the Veracrypt reminder. Adding that to my stuff to setup and document list.
Sometimes Bitlocker really pisses me off.
You can run bitlocker without TPM using a usb flash drive instead. I think you can also store the key in your mind as a password.
Yes, but when they're on USB the keys are much more accessible. You can just plug it in and dump them.
If you're only using a password, the keys are stored in an unencrypted part of the drive, which can again easily be dumped.
Once you've dumped the keys, you can brute-force the passphrase offline.
I found it was pretty easy to get rid of the nag. I installed a different OS. For my development stuff that needs windows and I can't run with wine (very few tools) - I have a VM running a windows version with 0 Internet access. Fuck that company sideways.