Why Windows 11 is forcing everyone to use TPM chips(theverge.com)
theverge.com
Why Windows 11 is forcing everyone to use TPM chips
https://www.theverge.com/2021/6/25/22550376/microsoft-windows-11-tpm-chips-requirement-security
37 comments
This is bullshit. I have a custom gaming desktop with an i7-6700k. It's still a very powerful system that can play AAA games on high or ultra settings. There's no good reason to drop support other than forcing people to upgrade.
In a few years, I can imagine governments mandating that all computing devices come with these chips, ostensibly for cyber-security purposes.
The question is, what happens after that? Do they mandate that your connection to your ISP be secured with the TPM too? That way they can also require that your OS provide remote attestation that it is has applied all the relevant security patches.
By the end of the decade, I predict that it will be almost impossible to run "unapproved" software on any computer connected to the internet. I also suspect that "unapproved" software will include any software that supports End-to-End encryption, or even anonymity online.
The question is, what happens after that? Do they mandate that your connection to your ISP be secured with the TPM too? That way they can also require that your OS provide remote attestation that it is has applied all the relevant security patches.
By the end of the decade, I predict that it will be almost impossible to run "unapproved" software on any computer connected to the internet. I also suspect that "unapproved" software will include any software that supports End-to-End encryption, or even anonymity online.
How do we know for certain that TPM chips do not have any lawful intercept code that permit an entity to bypass disk encryption and possibly even authentication should MS decide to tie authentication caching to TPM?
Unless you have nation-state level resources I don't think that's a question you can answer for certain. You can inspect the source code, but then you have to trust the compiler and underlying hardware as well (a la "Trusting Trust": https://dl.acm.org/doi/10.1145/358198.358210)
How do you know for certain that there isn't another non-TPM chip on the device doing the same thing?
How do you know for certain that the CPU microcode does not have any lawful intercept code?
How do you know for certain that the Windows kernel does not have any lawful intercept code?
How do you know for certain that the reason that Windows disks were not encrypted by default for decades was that the government asked them to make it that way? There's a whole industry of digital forensics that's been able to make a copy of your secret files on every MS operating system from DOS onwards. Why didn't DOS come with disk encryption?
How do you know for certain that the CPU microcode does not have any lawful intercept code?
How do you know for certain that the Windows kernel does not have any lawful intercept code?
How do you know for certain that the reason that Windows disks were not encrypted by default for decades was that the government asked them to make it that way? There's a whole industry of digital forensics that's been able to make a copy of your secret files on every MS operating system from DOS onwards. Why didn't DOS come with disk encryption?
All valid points, I share these concerns as well.
As a side note the price of TPM chips just doubled. [1]
[1] - https://www.cnx-software.com/2021/06/26/tpm-2-0-modules-quad...
As a side note the price of TPM chips just doubled. [1]
[1] - https://www.cnx-software.com/2021/06/26/tpm-2-0-modules-quad...
Welcome to the year of Linux on the (older) desktops?
That's what I'll likely end up doing with my desktop. Not immediately, but in a couple years when Windows 10 is EOL. Microsoft is worlds better than Apple when it comes to supporting older hardware/software but this is still unacceptable. New machines are better but the improvement is much more incremental than it used to be.
Cutting off anything earlier than an 8th gen Intel CPU is hardly "worlds better than Apple".
Three year old PCs that can't run the current version of Windows? That's just crazy.
https://www.tomshardware.com/news/windows-11-leaves-computer...
Three year old PCs that can't run the current version of Windows? That's just crazy.
https://www.tomshardware.com/news/windows-11-leaves-computer...
Windows 10 is still going to be supported until 2025. That's a full ten years after it's initial release. How much longer do you think Apple is going to support Intel Macs now that they're releasing them with ARM chips? I had a Core 2 Duo Macbook once upon a time that got left in the dust less than five years after it was released because Apple didn't feel like supporting it anymore.
>How much longer do you think Apple is going to support Intel Macs now that they're releasing them with ARM chips?
The next version of MacOS is slated to still work on 8 year old Intel Macs.
The next version of Windows is going to cut off machines less than half as old.
The next version of MacOS is slated to still work on 8 year old Intel Macs.
The next version of Windows is going to cut off machines less than half as old.
Chip hoarders in China seem go have bought all TPM 2.0 stock on the market.
Now there will be no new TPM chips at least for a year because of extreme 12 months+ backlog at chip foundries.
So, Win 11 is delayed at least for a year.
Now there will be no new TPM chips at least for a year because of extreme 12 months+ backlog at chip foundries.
So, Win 11 is delayed at least for a year.
I wonder whether this will block Windows 11 on Apple devices running Bootcamp.
According to Microsoft's Windows health check tool on the Windows 10 installation on my Macbook Pro 16" it would not be supported under Windows 11. no TPM module is present on that system.
I assume it will be possible to work around this, whatever Microsoft decides? Shouldn't a driver be able to emulate a TPM, for example? Or you could even have the bootloader patch the kernel, as is common on Hackintosh.
A driver by itself probably won't be sufficient. I think the Windows bootloader also talks to the TPM using the TCG EFI protocol.
With mass adoption of TPMs maybe there will be a serious effort to finally move away from text passwords?
To what? Biometrics arent available eveywhere.
WebAuthn and similar tech
Are bio less secure since they're somewhat easily reproducible and things like fingerprints are known to various companies (24 hour fitness, etc.)?
This movement is not about security. It's about control.
This is a decision that benefits their business and it doesn't matter if they need to force you into something.
The practical effect is they are forcing you to spend more money. They win and their business partners win.
This is a decision that benefits their business and it doesn't matter if they need to force you into something.
The practical effect is they are forcing you to spend more money. They win and their business partners win.
> The practical effect is they are forcing you to spend more money.
In the average case sure, in my case nope.
I currently dual boot windows 10 and Fedora with Windows 10 been strictly for gaming only.
I bought a windows 10 licence for that.
I won't buy a windows 11 license for that.
I'll game on Fedora where I can and will buy a console for everything else (and probably for the first time a PS not Xbox since I've owned every version of Xbox but the current one).
In the average case sure, in my case nope.
I currently dual boot windows 10 and Fedora with Windows 10 been strictly for gaming only.
I bought a windows 10 licence for that.
I won't buy a windows 11 license for that.
I'll game on Fedora where I can and will buy a console for everything else (and probably for the first time a PS not Xbox since I've owned every version of Xbox but the current one).
If you have a Windows 10 license, you already have a Windows 11 "license", since the update is free.
Today, a lot of steam games will run just fine on Proton with a few clicks. Windows is no longer an absolute requirement for gaming.
It all goes to shit when the game requires an anticheat on Windows like EAC.
I wish more game developers either provided a native port, or at least made sure the anticheat system wasn't tripped when running in /Proton.
I wish more game developers either provided a native port, or at least made sure the anticheat system wasn't tripped when running in /Proton.
When one buys a product one literally buys into the product vision of the vendor. But if you also win, then it's a win-win, isn't it?
The problem you never win and never will. Our economic system has a win-lose structure.
Big companies like Microsoft make billions not because they sell lots of good products and services that everyone buys, quite contrary. They sell shitty products and services and force them to buyers making sure to extract every single penny you have even when they are not providing value for you anymore.
Big companies like Microsoft make billions not because they sell lots of good products and services that everyone buys, quite contrary. They sell shitty products and services and force them to buyers making sure to extract every single penny you have even when they are not providing value for you anymore.
We use refurbished HP Xeon Workstations, Z240s, etc. and they only support TPM 1.2 and cannot be upgraded to TPM 2.0 according the what I can learn from HP's online support.
Unless I am missing something, our machines will not run Windows 11. It seems this will occur with many people using refurbished machines. So odd.
Unless I am missing something, our machines will not run Windows 11. It seems this will occur with many people using refurbished machines. So odd.
Chances are those CPUs have the Intel PTT which is a fully compliant TPM 2.0 module running in the Intel Management Engine firmware. AMD has a similar feature called fTPM. You should be able to enable that in the BIOS/UEFI. If there's no BIOS setting for that you may be out of luck unless HP releases an update.
>TPM
>Trusted Computing Group TPM Specification Version 1.2 (TPM 2.0 via Firmware Update)
https://support.hp.com/us-en/document/c04892038
>Trusted Computing Group TPM Specification Version 1.2 (TPM 2.0 via Firmware Update)
https://support.hp.com/us-en/document/c04892038
Unless I’m mistaken, what I’ve read is that Win11 actually supports TPM 1.2 but they’re saying that to be “logo certified”, new machines must come with TPM 2.0
Edit: apparently that was true but now they’re backpedaling and saying “TPM 2.0 is a hard requirement”, thank you for the reply
Edit: apparently that was true but now they’re backpedaling and saying “TPM 2.0 is a hard requirement”, thank you for the reply
No, they retracted that soft floor.
Currently: TPM 2.0 is mandatory. AND Intel CPUs >=8th gen OR >=Zen+.
Microsoft announced that they'll publish a post soon with the reasoning behind all that.
Currently: TPM 2.0 is mandatory. AND Intel CPUs >=8th gen OR >=Zen+.
Microsoft announced that they'll publish a post soon with the reasoning behind all that.
I wonder how related to Microsoft Pluton this change is. I suppose it's going to be very beneficial for Microsoft to have a security chip to rely on for all sorts of uses, beneficial to the end user or very much not. This change may or may not be a precursor. Personally, I've always disabled TPM on Windows machines — I've never seen any benefit in keeping it enabled and possibly letting applications use it against me, furthermore the decent-against-thefts-on-non-critical-devices BitLocker (in its GUI form, CLI doesn't need the registry fix) really wants you not to use a password to decrypt the drive.