undefined | Better HN

0 pointsorf1y ago0 comments

OP is trying to say that this TPM TOTP approach doesn’t help verify a machine is legitimate if there is a possibility that the machine you’re using has been swapped with a malicious one.

This doesn't really mesh well with what the TPM-TOTP idea is trying to solve: trust in the machine you’re using.

Hyperbolic or fairly extreme-sounding scenarios are common when discussing this kind of thing, partly because it makes discussion about a fairly boring topic a little bit more interesting. Don’t get distracted by that.

That being said, using a TPM-based TOTP is pretty extreme sounding in and of itself.

0 comments

Foxboron1y ago

> Hyperbolic or fairly extreme-sounding scenarios are common when discussing this kind of thing, partly because it makes discussion about a fairly boring topic a little bit more interesting. Don’t get distracted by that.

It's not. They are very much intended to derail serious discussions around threat models.

> That being said, using a TPM-based TOTP is pretty extreme sounding in and of itself.

It's not. It's trivial to implement.

j / k navigate · click thread line to collapse