Security Expert Explains TPM 2.0 & Secure Boot | Ask A PC Expert

With the recent announcement that Windows 11 will require TPM 2.0 and Secure Boot to be enabled, many of us are confused and left feeling frustrated. Luckily Adam called up his friend and security professional Mike Danseglio to help explain it all, along with offering practical advice and his thoughts on if Microsoft will keep this requirement.

00:00 - Intro
00:57 - What is TPM?
01:36 - The different forms of TPM
02:55 - What is Secure Boot?
04:37 - Why is TPM and Secure Boot important?
06:13 - TPM and Secure Boot vs anti-malware software
07:35 - What does TPM guard against?
08:27 - TPM and Secure Boot requirements in Windows 11
10:45 - Is Microsoft going to keep these requirements?
15:11 - How do you find out if you have TPM
17:05 - How to find out if your PC support Secure Boot
18:15 - What to do if you don't have TPM
21:40 - Does TPM and Secure Boot impact gaming?

Follow PCWorld for all things PC!
------------------------------­----

#Windows11 #TPM #SecureBoot

[kristianau]

Would like to see more of this person in the future, great conversation!

[EagleEye-MJG]

Way too many Tech Channels are overlooking this level of USEFUL dialog & communication.👏👏 They're way too engrossed in the next expensive gadget to push.🙄

[KubeSquared]

Are there any TPM modules with RGB on them? This is a very important question!

[PimptatoPCs]

TPM is responsible for countless people thinking they had a USB 3.0 header on their circa 2010 mobo.

[MasterKoala]

I’m only 5 minutes into the video and already learned a lot. Awesome interview and guest!

[SinisterPuppy]

Thing that gets me about this requirement. Even if your keys are secured in the TPM; for say Bitlocker; once you're in userland those keys become memory resident. Most exploits are software based; its not that hard to execute manage-bde -protectors C: -get or various powershell commands to get the recovery key.

For me in the past 20yrs maybe only 5% of security breaches have been physical thief. Most are like hafnium; an exploit on an already running (unlocked) system. I 100% get this for HIPPA/PCI compliance, business clients, and mobile devices. For home desktop users though, hmmm.

[thomaspedersen]

It looks like Microsoft didn't back down on their requirements for security features after all.

[JaquesBobe]

Gotta love how the expert carefully and clearly explains what those technologies are, just to pull the rug and say with 100% confidence that Microsoft is not gonna require them 😂

[Trifler]

16:15 - Note that you do need to be logged in as an administrator for the TPM Console to work. It will say so if you're not.

[adgarza]

If you go to the Advanced or Security options in the BIOS of your DIY computer, and you are using, let's say, 8th Gen Intel, chances are that you will be able to turn on the Intel PTT (Platform Trust Technology, equivalent to TPM) functionality. It depends much more on firmware/BIOS settings than in own processor's settings.

[johnstancliff]

right now, TPM modules are extremely hard to buy. I have a MSI motherboard, and when I bought mine in 2011, I added the TPM module at that time. Now 10 years later, windows 11 come out and the module is outdated. I tried to check to see if the newer module was available, and it wasn't. when I enable the existing TPM, windows 10 doesn't see it. can't tell if the module is good or not. for a lot of computers, the TPM module is missing, its was offered as an option and was available until; now. MSI, Asus, and others are having issues with this requirement. a lot of people don't even know what this is all about...this is really causing issues with consumers.

[DangerGnom]

it should be an option, not mandatory. A very good interview, thanks for doing it. Helped me understanding it better.

[yamilabugattas]

This was a really nice interview, you should have him on again!

[eukariootti]

In your BIOS/UEFI, there might be this kind of options to choose from:
* Firmware TPM (with the help of your CPU)
* Dedicated TPM (done by external Module on the motherboad)
* Nothing.

Firmware TPM:
* AMD: *fTPM* (at least *Zen+* i.e. 2000-series Ryzen Desktop from 2018)
* Intel: *PTT* (at least *8th Gen* i.e. Core ix-8xxx Desktop from 2017 & 2018)


One way to check TPM's status: Run > *tpm.msc*

[kwl]

With or without tpm or secure boot, I for one will not be updating to windows 11 no matter what. Nothing ever works properly when released by corporations these days. I’m fed up with paying top dollar for shit that doesn’t work as advertised and to a standard that I agreed to when making my purchasing decision.

[synthwave]

Yes, no need for a hardware TPM module for Win11. Simply enable TPM in the BIOS [FTPM] - several videos on YT to show you how to do this.

[SamsMediaCenter]

This was an excellent video. I didn't expect to enjoy this video as much as I did. 24 minutes just flew by. I never felt the need to move forward in the video manually, which I usually do on other YouTube videos. Excellent & conversation between the two individuals. Both interviewer and interviewee were great.

[randomgeocacher]

TPM also supports authentication, remote attestation etc. so it is a very important building block for WebAuthn TPM variants, Microsoft Azure Attestation, etc. if you want to increase the level of services provided securely, with some percent of clients malware infected, you have to have a trusted computing base to only release keys and attests to correctly booted OS:es.

[williammurdock]

how can TPM 2.0 protect us from microsoft

[jamest]

Secure boot is going to cause a lot of problems. Once you turn it on, now it might not recognize your your drives, your GPU or even your memory. And you won't even be able to boot into BIOS to turn it back off. In essence rendering your mother board into a paper weight. And the solution by Microsoft will be to replace your computer with one that has windows 11 already loaded! I suggest to anyone trying to make these adjustments in their BIOS to have a dual BIOS board such as gigabyte so when you destroy one BIOS you have another one left to try to run windows 11 or switch back to windows 10.