TPM integrated/embedded to the CPU is the most common way of having one and they are not vulnerable to this exploit.

I disagree. Is locking your front door worthless security theater if a thief can just smash the window? Some actors are more opportunistic (or stupid) than others and not everyone can have (or wants) bars across their windows.

Similarly, BitLocker with a TPM may not be impenetrable, but it does stop a kid from booting Hiren's and running ntpasswd to change the local admin password and install Roblox on mom's work laptop. Or the employee dumping the SSD of company data before leaving for a competitor.

Not every security measure needs to address every threat entirely. This is why we have risk assessments and defense in depth. This exploit may change some people's calculations or it may still be worthwhile based on the balance of security to convenience. But that isn't worthless.

Even in the older hardware from which this example that allowed this to occur, the threat to the "consumer" is the driver whose Uber you left your laptop in, for whom this attack is still out of the realm of plausibility.

I don't think this applies to ones embedded in CPUs?

...but but but they are ISO certified!!!

The only thing that TPM prevents from reading your hard drive is jealous coworkers. Everyone else just steals your laptop and gets access anyways.

Even the BIOS passwords are utterly useless because you can google the master passwords based on Laptop and model number these days. And if you can't, just flash a BIOS without a password on the memory chip via a 5$ ch341 adapter.

As long as all hardware has backdoors for everything and nothing relies on real cryptography, there is no point in assuming it is secure.

Embedded TPMs are the exception, for now, until one finds the next backdoor of broken undocumented CPU instructions. TPM was claimed to be secure so often in the past, at this point you must assume that every implementation is broken by default.

Ah yes, because everything that doesn't solve every problem imaginable is instantly worthless.

Sorry for the snark, but I'm getting tired of the pervasive cynicism. The situation got so much better since tpm and fde got commonplace. Laptop thieves no longer get your data, people no longer unwillingly expose their data when they sell their used disks, boot loader attacks got from easy to almost impossible.

Yes, the CIA will still be able to read your disk, and maybe even just a motivated hacker. But that doesn't mean everything is useless.

Worthless? Really? Laptops stolen every day are breached by all those thousands of thieves with logic analyzers bitbanging TPMs?