This is a completely imaginary scenario. I'd be amazed to see it pulled off.
EDIT: I hear Amazon is still getting pitches for Hacker 2. You might have a shot.
This doesn't really mesh well with what the TPM-TOTP idea is trying to solve: trust in the machine you’re using.
Hyperbolic or fairly extreme-sounding scenarios are common when discussing this kind of thing, partly because it makes discussion about a fairly boring topic a little bit more interesting. Don’t get distracted by that.
That being said, using a TPM-based TOTP is pretty extreme sounding in and of itself.
It's not. They are very much intended to derail serious discussions around threat models.
> That being said, using a TPM-based TOTP is pretty extreme sounding in and of itself.
It's not. It's trivial to implement.
https://www.windowscentral.com/how-disable-windows-10-fast-s...
Of course, it's much easier to just pop the original laptop open and interpose on the keyboard. Even easier: use acoustics to snoop the keystrokes. The snooper could even be 5g/wifi/gps, assuming it's easy to steal some power from the mainboard. I guess fingerprint + camera ID make that attack harder. Still, the hypothetical device could stream HDMI at a few FPS if it was easy to splice into the display panel cable. (I haven't cracked a laptop recently, but those used to be socketed + unencrypted.)
Miniaturization is weird. The latter attack is probably easier to pull off these days than the former. If you wanted to swap my laptop, you'd need to replicate the dents and stickers. Good luck doing that!