I used PopOS, but once they announced they’ll start focusing on their Cosmic desktop, I switched to Fedora KDE it worked to some degree until it crashed and I lost some data, now I’m on Ultramarine GNOME and it doesn’t seem to like my hardware ( fans are spinning fast )

my threat model involves someone trying to physically unlock my device, so I always enable disk encryption, but I wonder why Linux doesn’t support secure boot and TPM based encryption ( I know that Ubuntu has plans for the later that’s why I’m considering it rn )

I need something that keeps things updated and adobts newer standards fast ( that’s why I picked Fedora KDE in the first place ), I also use lots of graphical tools and video editing software, so I need the proprietary Nvidia drivers

Idk what to choose ಥ_ಥ ? the only one that seem to care about using hardware based encryption is Ubuntu, while other distros doesn’t support that… the problem with Ubuntu is there push for snaps ( but that can be avoided by the user )

security heads say: if you care about security, you shouldn’t be using systemd, use something like Gentoo or Alpine… yeah but do you expect me to compile my software after ? hell no

  • 𝕽𝖚𝖆𝖎𝖉𝖍𝖗𝖎𝖌𝖍@midwest.social
    1·
    3 months ago

    I was going off what you said:

    my threat model involves someone trying to physically unlock my device

    This doesn’t sound to me as if you’re concerned about espionage - repeated, covert, root access to your computer, for the purpose of installing software to capture your keys, so that they can steal your computer and have complete access. If someone has remote root access to your computer, you’re fucked, TPM or not; they’ll just read what they want whenever you’re logged in and using your computer.

    TPM is for when you might not have secured physical access to your computer. Like, you’re worried the NSA is going to sneak into your house while you’re out shopping, pull your HD, replace the boot loader, and re-install it before you get home.

    If you’re only worried about, say, losing a laptop, or a search & seizure at your house, an encrypted HD is good enough. TPM and a keylocked BIOS are belts-and-suspenders, but if they want to get at the data they’ll just pull the HD and run code-breaking software on it on and entirely different super-computer. TPM won’t help you at all in that case.

    Honestly, TPM is for a specific threat mode, which is much more like ongoing espionage, than simple opportunity theft. Your stated use case sounds more like the latter than the former.

    • ᥫ᭡ 𐑖ミꪜᴵ𝔦 ᥫ᭡@feddit.orgOPEnglish
      1·
      3 months ago

      but if they want to get at the data they’ll just pull the HD and run code-breaking software on it on and entirely different super-computer. TPM won’t help you at all in that case.

      You make it sound so easy and doable, but the reality is that without meeting certain conditions such as the existence of the original TPM chip, a brute force attack will render the data irretrievable… And even if I’m wrong in the last part, that would still be a pain in the butt for the attacker… and it’ll buy me time… like you said … belts-and-suspenders

      This doesn’t sound to me as if you’re concerned about espionage

      Because i don’t have second chances, which is why I wish there’s way to erase everything by entering a key combination… somehow… Idk… like Android has that…