Re:Installing Windows 11 on Legacy BIOS Without Secure Boot
by my123 on Saturday June 26, 2021 @07:32PM
(#27647003)
> because you have to extract them to use them
Nope, the thing is that you ask the TPM to sign something with the key/secret, but the TPM will not allow you by design to exfiltrate the secret.
Re:Installing Windows 11 on Legacy BIOS Without Secure Boot
by Dylan16807 on Saturday June 26, 2021 @07:58PM
(#27647154)
Doing that would not be a normal cookie, which is my point.
Re:Installing Windows 11 on Legacy BIOS Without Secure Boot
by staticassertion on Saturday June 26, 2021 @07:37PM
(#27647042)
You would have the TPM hold a secret that's used to repeatedly re-authenticate the session. Though today I don't know that this is often the supported workflow - for example, most of my TPM-based policies only enforce device-authentication on sign-in and not on every API call.
So the question is how a particular protocol works, and whether a site can still identify you after you've deleted your session cookie. As far as I understand it, if you were wantonly using webauthn for all your session cookies, it would be relatively easy for a site to check if you're the same person as before.