Privacy issues - TPM required by DNF

The Water Cooler
1

Windows 11 requires a TPM (Trusted Platform Module) chip because it needs it to by-pass software privacy systems and to correctly and uniquely identify your computer.

The TPM attestation key is unique (world-wide across systems) and NOT changable, its permanent like the IMEI serial number on mobile phones.

Windows 11 TPM attenstation runs via the Azure cloud and all TPM keys are stored there. Every time an app is run, the TPM API is being used to match the app with the PC.

I’m worried that Fedora is being led towards a similar future, I now see that the ‘tpm2*’ packages can’t be removed from the system (they are hard dependencies) and even if removed via “rpm –nodeps -e …” then DNF stops working completely.

Does this imply that DNF, now or in the future, will use TPM attenstation to uniquely identify our PCs?

Thank you.

2

TPM is not use for its UID features in Fedora and nothing is reported to external systems, as is required for attestation to work.

TPM is a place to store unlock keys for encrypted disks on your system for example. TPM is used always at the users request, never without.

A lot of security tools have optional TPM support in them.
I think it’s the GPG library that is used by DNF for signature checks is one of them.

3

No, DNF → rpm → sequoia-pgp does not involve a TPM for OpenPGP operations.

Correct - including RPM itself, which supports using TPM backend for signing packages, or GnuPG, which has an optional TPM backend too. Neither should affect DNF, but I’m not sure if just ripping out the libraries without considering dependencies won’t just break your system (dynamic linking is … complicated).

1 Like
4

TPM in itself is not a privacy issue

2 Likes
5

Your right, I saw lots of GPG and plasma stuff that would be uninstalled,
and assumed it was the GPG that was the issue.

Not sure why the OP sees DNF fail.

6

I don’t understand what stops Microsoft to indentify each single Windows installation and to record any activity even if the said chip did not exist.

7

Source? I’m certain MS doesn’t tout a TPM requirement for spyware :stuck_out_tongue:

I’ve kept TPM disabled for years Windows 10, every Linux, and FreeBSD no problem (even F43); Linux dmesg has this (if dnf isn’t a contender, other parts of Linux/kernel/security probably already rely on a TPM):

ima: No TPM chip found, activating TPM-bypass!