Hacker News Reader

I have FDE with keys in the TPM. It's pretty smooth bit required a one time additional step in Fedora. It's also probably not very secure, but my threat model is simple theft.

View on HN

What's the benefit of using the TPM compared to a simple passphrase at boot, in that scenario?

A person wouldn't be able to pull the disk to get at the information

Assuming that the person pulling the disk doesn't have the passphrase, what's the difference?

Assuming things are configured correctly, the TPM would only provide the key to unlock the drive if the correct OS has been booted. Attempting to boot from a live usb to have a look at the data wouldn't work, since the TPM wouldn't present the key required.

You can see https://wiki.archlinux.org/title/Trusted_Platform_Module#PCR... for an example of doing so

Sorry for the late answer: the benefit is that I don't have to enter my passphrase at boot.

Reply on news.ycombinator.com