Yes siree, the excitement never stops!

  • 0 Posts
  • 68 Comments
Joined 10 months ago
cake
Cake day: December 7th, 2023

help-circle

  • This person asked if they can make PopOS secure via TPM.

    I am saying that while yes, you can, there isnt much point, because setting up LUKS to work with TPM is inconvenient, easy to fuck up, and basically offers no additional protection against all but extremely implausible security scenarios for basically everyone other than bladed server room admins worried about corporate espionage who are for some reason running bare metal PopOS on their server racks.

    Like the only actual use case I can see for this is /maybe/ having a LUKS encrypted portable backup drive, but even then you can still base the encryption key in the actual main pc’s harddrive without using tpm, though at /that and only that point/ are we approaching parity between the difficulty of using or not using tpm to accomplish this.


  • Oh ok so the use case here is if this casual linux user asking this question has only their harddrive stolen from their pc or their laptop in their home or apartment or workplace, not their whole pc.

    Mhm that seems likely.

    I guess this maybe makes sense if youre running like a server room, but chances are low thats the actual context of this question.

    Why would you run PopOS on a large operation’s servers?





  • Ok… so… if you have TPM… and LUKS…

    You still have a scenario where the encryption key is still on your physical device, LUKS with or without TPM, or … some kind of TPM based Linux encryption solution I have never heard of?

    Does Windows Secure Boot work on Linux via the TPM?

    No…

    Am I missing something?

    Theres no point in involving TPM in securing a linux computer.

    In a scenario where you’ve physically lost your computer, using TPM or not it wont matter if your pc gets into the hands of someone who can attempt to brute force the keys.

    If your pc is remotely compromised to the point it has something on it that can grab your keys, it also will not matter if you are using TPM in some way.

    The only practical use of full disk encryption is if your linux pc and or laptop gets stolen and falls into the hands of a non tech savvy person, and in that scenario, going through the trouble of correctly binding LUKS to TPM will have just been a waste of time.

    Thus, you should probably just use LUKS and not bother routing it through TPM.


  • Sure but you dont need to use TPM at all to use LUKS.

    You can store the encryption key on the harddrive, in the LUKS partition layer.

    Like thats the default of how LUKS works.

    Im really confused why people think TPM needs to be involved in anyway when using LUKS.

    Generally speaking you have to go out of your way to correctly cajole TPM v1 or v2 to actually correctly interface with LUKS.





  • Well even then, if you actually looked into this sort of thing, its been obvious for a while.

    Historically, as studied by anthropologists, historians, sociologists, its been known for a while that civilizations collapse due to:

    Massive Famines

    Unexpected Broad, Rapid Climate Shifts

    Massive Internal Political/Civil Unrest

    Foreign Invasion

    Massive Plagues

    Insulated Ruling Class making absurd decisions to maintain their own power at the cost of the actual stability of their society

    Collapse of Vital Trade Routes

    Neglect and Failure of Vital Infrastructure

    Financialization of the Economy, writ large

    Now sometimes it can be just one of these, but usually its a few.

    Most current societies/nation states are currently experiencing or will very soon be facing nearly all of these combined.

    I suggest you read John Michael Greer’s Catabolic Collapse book or watch some of the videos about it for an overview of the basic idea that complex societies tend to respond to crises by becoming more complex, which is the exact opposite of what you would want to do from a big picture, hindsight perspective, but is more or less unavoidable due to human psychology and socio/political/economic dynamics of human organized societies.

    You are right that the vast majority of people will be surprised by the speed of collapse, logarithmic vs linear basically.

    But the people who have been in charge of our societies either did, do, or should know or should have known about this.








  • I dont really know what to say other than, no, historically we are very, very good at accidentally /as well as intentionally/ setting off metaphorical powder kegs, in situations where large segments of the population believes in the inherent stability of society, either ignorant of or in spite of actual history.

    Specifically in regards to cold war era nuclear weapons… beyond the cuban missile crisis having, very, very easily gone out of control, take some time and look up the numerous instances where, due to basically either an overzealous command being issued, or a rational decision being made with imperfect information led to an actual order to use a nuclear weapon that was actually stymied by a single individual disobeying a direct command.

    Or look at the numerous instances that basically a mechanical failure, intelligence failure, maintenance failure, something like that, led to a nuclear weapon basically being accidentally used, where it was basically down to dumb luck that further failures, or heroic actions from unsung heroes, prevented a nuclear blast from going off that could have easily spiraled into a full fledged nuclear exchange.

    But more to the actual point of discussion: Saying that nukes exist and we have not obliterated each other yet, so that implies that a totally different scenario with totally different relevant factors at play is not likely to result in a mass armed civil conflict of some kind… thats basically not even a useful analogy.

    EDIT: also for what its worth, im not the one who downvoted you. I generally only downvote people who are extremely abusive or very obviously unable to actually understand the words people say and then also refuse to understand them when explained another way, things like that, at least in the context of fairly serious and complex topic like this.

    I actually think its more important that people be able to have a genuine discussion involving disagreement, and also for others to view such discussions, than it is to be angry and downvote some words i dont agree with, but seem to be written in good faith.