Re:From stolen laptop to inside the company network
by teddyh on Wednesday July 28, 2021 @09:56PM
(#27991975)
You could get almost the same benefits and none of the drawbacks of a TPM by using a password hash function with enough complexity to inherently limit the number of checks possible per second.
Re:From stolen laptop to inside the company network
by Sanzig on Wednesday July 28, 2021 @10:30PM
(#27992159)
I can't think of a key derivation function which would reliably make, say, a 6 digit PIN tough to crack while also not painfully impacting user experience waiting for the machine to unlock at boot. For a 6 digit PIN it's only 10 million iterations to exhaust all possible options, and the attacker gets to parallelize their guesses if they're willing to throw hardware or cloud resources at it.
Re:From stolen laptop to inside the company network
by frutiger on Thursday July 29, 2021 @02:27AM
(#27993462)
> For a 6 digit PIN it's only 10 million iterations to exhaust all possible options
Isn’t it one million?
Re:From stolen laptop to inside the company network
by Sanzig on Thursday July 29, 2021 @08:01AM
(#27995421)
Er... yep. Oops. That's embarassing, don't know how I made that mistake.
Re:From stolen laptop to inside the company network
by teddyh on Wednesday July 28, 2021 @10:42PM
(#27992228)
I did say “almost”; one of the requirements is that you have to set an actually secure password; i.e. not a 6 digit PIN.
Re:From stolen laptop to inside the company network
by Sanzig on Wednesday July 28, 2021 @10:52PM
(#27992286)
Totally! And for a user that knows the importance of a secure password, that's fine. But the average user in an organization picks terrible passwords. A random 5 or 6 digit PIN generated by the IT department (to avoid the user picking their daughter's birthday) used to lock a TPM is generally easy to remember and secure, especially if a lockout policy is set on the TPM.
I agree that for the user who would pick a secure passphrase, it's comparable security either way and thus really comes down to preference. I like tapping a quick PIN on the numpad rather than typing out a passphrase, but I can definitely see the advantages to the passphrase approach: you don't have to depend on a piece of hardware specific to the machine, and the attack surface for a potential backdoor is a lot smaller, especially if you're using FOSS full disk encryption software like Veracrypt.
Re:From stolen laptop to inside the company network
by dkdk8283 on Wednesday July 28, 2021 @11:06PM
(#27992371)
> especially if a lockout policy is set on the TPM.
what happens at lockout?
Re:From stolen laptop to inside the company network
by tgsovlerkhgsel on Thursday July 29, 2021 @03:15AM
(#27993750)
Recovery with the escrow key held by IT, typically.
Re:From stolen laptop to inside the company network
by WhyNotHugo on Thursday July 29, 2021 @10:04AM
(#27996682)
Exactly. Using _just_ TPM is like locking the front door to your house, and leaving the key in the keyhole.
Sure, the door is locked, but it's still very easy to open.
Re:From stolen laptop to inside the company network
by belorn on Thursday July 29, 2021 @08:34AM
(#27995684)
Pins vs passwords are not something I have seen much discussion on in the software security space. The only general criticism I have heard of pins is that people tend to pick dates when asked to use a random 4-6 digit sequence, which makes them often trivial to guess. Personally I have always leaned towards the now classic xkcd method of combining 3 random words, which can often lead towards funny and memorable passwords with great length. The only major drawback is that they take long time to type, is a pain with touch keyboards, and are prone to miss clicks in low light conditions.
TPM is fine, but you need to set a PIN to unlock the TPM. If you have a TPM without a PIN, somebody can just swipe the whole machine. PIN guesses are rate-limited by the hardware itself, so the PIN can generally be faster and easier to enter than a complex passphrase without compromising security.
IMO: TPM+reasonably random PIN offers comparable security to a strong password without a TPM, and better security than a weak password without a TPM. I prefer TPM+PIN since it's easier to enter 5-6 digits at boot versus a big complicated passphrase, but it's personal preference. TPM without a PIN is pretty useless though.