savvywolf, 1 year ago

I’ve heard that before, but there are two main problems that stick out to me:

• A lot of the marketing for TPM (at least when I was setting up bitlocker on Windows) suggests that it’s used to support decrypting drives without a password on boot. But that doesn’t seem to offer any protection from the devices being stolen. The bootloader may be safe but it’s not actually verifying that I’m the one booting the device.
• I can’t think of a situation where someone would be able to actually modify the bootloader without also having full access to the files and secrets. Especially in a single-boot environment where every time the system is running, the device is decrypted.

I’m not saying that it’s all just a scam or anything like that, but it really feels like I’m missing something important and obvious.