I don't like identifiers. I keep TPM disabled due to the exploitation of the TPM endorsement key, particularly on Windows (even though Windows hasn't touched any of my PCs for over a year now). But I recently learned that the serial number is accessible with sudo and poses largely the same problem.
Does anyone know how to safely modify or restrict access to them, even with sudo?
The short answer is "no" and I must point out - if the threat vector has access to sudo, you really have far more to worry about than EK certificates. No, it... really does not "pose largely the same problem."
That said; masking hardware identifiers (MB) from root will break the system.
Much obliged. I'm not worried about a threat like malware as much as I am about general tracking from corporate software.
Could something installed via apt or deb packages automatically inherit sudo permissions during install if they wanted? Or would they need to request it directly from the installed app?
No, when you install, you are providing the apt package manager the sudo privileges, not the application itself.
Installed applications do not inherit access to the sudo program.
And you will notice this with any software you install that later needs elevated privileges when you run them. For example; Bleachbit or Synaptic - you must authenticate it every time.
Yes, some packages can include a PolKit rule that allows them to access information in root.
However, these are system packages, rare and vetted. I cannot imagine you finding, much less installing some kind of malware that has it.
And for good reason...
The TPM Endorsement Key is very different from a motherboard serial number. It stored only in TPM and never transmitted. It is cryptographically stored.
Instead, for access, Microsoft would need to match the Endorsement Key Certificate - not the key itself. Even they do not get access to the key itself.
The TPM module can be used as a backdoor by Microsoft - but only if you are running Microsoft Windows. If you are not, then they cannot. Nothing in the firmware nor in GnuLinux has the software to allow it.
Motherboard serial (is your DMI) and is is readable via /sys or dmidecode
It serves no function other than as a unique identifeir for warranty purposes.
Could a coprorate entity track you based on it?
Only if...
You install a corporate supplied software which you authenticate, allow network access and authenticate it every time it launches. This is highly improbable... since it is so complex and prone to being easily caught.
A MAC address is easier to track.
A persistent client identifier file is easier to track (This again, requires you to enroll into a program and install software...).
Browser fingerprinting is easier.
Account login is easier if you are logging into a website service.
Makes trying to track a serial number superfluous and risky.
Interesting, thank you. So in a nutshell, TPM on Linux is basically just as irrelevent to tracking as the serial number assuming I'm cautious with sudo permissions, since Linux doesn't provide the same lax capabilities as Windows? It would be nice to re-enable TPM, since it does provide some security benefits.
I have a feeling you are already more cautious than most.
And yes, you can reenable TPM if you are not dual booting with Windows OS.
Yeah. Yeah I am, lol. Thank you for the help!
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.