1

Windows 11 requiring a TPM of some sort seems more like a DRM preventing me from duplicating a W11 Virtual Machine on multiple systems and distributing it versus any tangible benefit to the end-user.

What benefits does the TPM bring to the end-user, and are these justifiably enough to make the OS not even function if there isn't one present?

Am I missing something?

Joseph Michael
  • 43
  • 5
  • 2
    `What benefits does the TPM bring to the end-user` - that's the wrong question. `Trusted` here means `trusted by the vendor`, not `trusted by the user`. – Haukinger Jan 19 '22 at 15:59
  • @Haukinger, I meant are there actual benefits of TPM to the end-user that I am missing that would make my classification of this as DRM unjustified. – Joseph Michael Jan 19 '22 at 16:01

1 Answers1

2

What benefits does the TPM bring to the end-user, and are these justifiably enough to make the OS not even function if there isn't one present?

OS can function perfectly fine without TPM. What you are seeing is a design choice, not a functional requirement.

TPM allows the vendor to make sure its OS will not run on non-approved devices. It can block non-approved kernel modules from being executed. It can charge third party vendors for allowing their hardware or software to be loaded. It's not all on the interest of the user, but on the vendor.

But TPM can help the user too. TPM can protect the full disk encryption key, so it's very difficult (or even impossible) to execute an Evil Maid Attack. TPM attestation will detect a modified bootloader, and Secure Boot will (in theory) not let it load.

There are some caveats, some implementation issues and bypasses, so TPM isn't viewed as perfect solution, but another defense layer.

ThoriumBR
  • 50,648
  • 13
  • 127
  • 142
  • I am glad you linked to the Evil Maid Attack page, because my mind immediately went to [Mega-Maid](https://spaceballs.fandom.com/wiki/Mega_Maid), not at all what that term actually refers to. – Joseph Michael Jan 19 '22 at 16:43
  • But back to the issue at hand, TPM can benefit the user by storing the encryption keys, but isn't necessary, those could be stored outside the TPM if it didn't exist. So requiring it still boils down to DRM over everything else at the moment. – Joseph Michael Jan 19 '22 at 16:45
  • Yes, it's basically a DRM thing now. The vast majority of users will not manage to configure TPM for full disk encryption. – ThoriumBR Jan 19 '22 at 16:58