| ▲ | lakeviewterrace 3 hours ago | ||||||||||||||||||||||||||||
The TPM generates a strong, non-exportable key in hardware that is far less susceptible to brute-force attacks. As opposed to accidentally creating your own key of "4", for instance. A PIN can be used to protect the TPM from unlocking. Even if you set a PIN of "1234" — it would still be far more secure if the disk and laptop were ever to become separated, because the TPM will have generated a strong key anyway. The TPM is basically a smart card soldered to the motherboard. > How will you decrypt if the laptop goes bust or if you move the drive elsewhere Windows and Apple both generate a recovery key as part of the enrollment process which you can store offline. | |||||||||||||||||||||||||||||
| ▲ | hparadiz 3 hours ago | parent | next [-] | ||||||||||||||||||||||||||||
When you format LUKS you can add multiple decryption keys in case the TPM is hosed for some reason like the mobo failing. Can even use a Yubikey instead of a TPM. Or both. Or none. It's really up to you. | |||||||||||||||||||||||||||||
| ▲ | bubblethink 3 hours ago | parent | prev [-] | ||||||||||||||||||||||||||||
That's a minor convenience to not type passphrases and a fairly high risk of you losing the backup key. Not to mention, the entirely separate problem of storing the backup key securely. It doesn't pass the xkcd "correct horse battery staple" test for me. | |||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||