Kind of late to the TPM2 bandwagon, but I wholeheartedly believe that making it a requirement for Win11 is not only a good idea by itself, but the only working way for MS to force IBVs/OEMs to implement the firmware drivers and flows for it correctly.
Optional security tech is automatically underprioritized and undertested, then too often never gets enabled correctly because of that. IRL it's either "enabled by default" or "doesn't work", especially when OS vendor A needs to rely on HW vendor B to do the right thing.
That right thing is indeed hard to do, and the UX of physical presence check for TPM reset is often bad, and the fact that BIOS updates often require key recovery procedures due to mismanaging the PCRs is really sad, but if not dragged along, vendors will do *nothing* about that.
So I, for one, welcome our new TPM2 overlords.
If you aren't into that at all, somebody will soon write a DXE runtime driver that will store all your keys and PCRs in NVRAM and/or CMOS SRAM, while making Win11 perfectly happy with that emulated TPM2 device.
If you aren't into that at all, somebody will soon write a DXE runtime driver that will store all your keys and PCRs in NVRAM and/or CMOS SRAM, while making Win11 perfectly happy with that emulated TPM2 device.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
