Update on Windows 11 minimum system requirements

kjoerden · Aug 4, 2021

I'm concerned about this reliance on TPM and would just as soon stick to 2FA for most. Please see arstechnica.com "Trusted platform module security defeated in 30 minutes, no soldering required" by Dan Goodin 08/3/2021. Ordinary users don't need to go there and enterprises and government need something more!!!

Berton · Aug 4, 2021

Helped a client today with a lightning-damaged desktop buy a new Desktop, seems to meet the requirements including TPM 2.0 and a free Upgrade to Win11. $640 with sales tax

bobkn · Aug 4, 2021

kjoerden said:
I'm concerned about this reliance on TPM and would just as soon stick to 2FA for most. Please see arstechnica.com "Trusted platform module security defeated in 30 minutes, no soldering required" by Dan Goodin 08/3/2021. Ordinary users don't need to go there and enterprises and government need something more!!!

The link: TPM defeated

Requires physical access to the CMOS chip (where the BIOS settings are stored). It appears that the "firmware TPM" data are saved in the CMOS, rather than the BIOS EEPROM.

I wonder whether a discrete TPM would be any harder to crack?

johnlgalt · Aug 5, 2021

I wondered the same thing after reading that article.

Dru2 · Aug 5, 2021

kjoerden said:
I'm concerned about this reliance on TPM and would just as soon stick to 2FA for most. Please see arstechnica.com "Trusted platform module security defeated in 30 minutes, no soldering required" by Dan Goodin 08/3/2021. Ordinary users don't need to go there and enterprises and government need something more!!!

That article is nothing but click bait, and didn't say anything most don't know - anything can be thwarted if given enough resources and technical know-how. That's the nature of the business.

I see the article as nothing more than click bait.

My two cents.

barman58 · Aug 6, 2021

The discreet TPM is, as far as I am aware, mostly a removable item, so the simple removal would, you would think, defeat the system.

Of course any encryption, If used and the key stored in the TPM, would not be defeated so the TPM system would have worked.

I had reason to reset the bios back to factory on my Desktop a few days ago, which also cleared the on chip and discrete TPM,

Although I am running Windows 10 I had to reset some windows security items such as the logon pin so TPM is already adding to security.

I use a pin to log-in to my systems as the coding is designed to be totally separate from the network system so only working on the local keyboard

Smalltown · Aug 6, 2021

I've been trying to read all I can about fTPM. The main thing that bothers me is not fully understanding the encryption.
I guess I'm nervous that something will occur such as equipment failure, and all my data will be encrypted, and I will not be able to access it.
Granted I don't remember ever having a CPU failure, however just the thought of loosing my data gives me pause!

Certainly there will be users that upgrade their CPU's after running Windows 11 won't their key reside in the old CPU etc.
If there is anything to read about this please post a link.

What if I had an NAS to which I saved all my data wouldn't all the data on the external NAS be encrypted ? I'm thinking it would be. What happens to another Win user on my local network they don't have my key ?

barman58 · Aug 6, 2021

The use of data encryption via bitlocker or other encryption system has to be managed, whether the encryption key is held digitally within the TPM system or on a piece of paper - the access to this key must be protected from the people who would wish to steal the data but tho need to also ensure that the key itself is protected by the use of redundancy.

For example when traveling a copy of the unencrypted data should be held in secure physical storage and updata from the encrypted data on return. This can be a burden for the user so would likely only be required for small amounts of data in any scenario apart from security delicate data

The user needs to keep unencrypted backups of important information offline, as they should do with current security regimes that do not use TPM or data encryption.

If data is important enough to a user to use a secure system then they should never rely on one system only

Smalltown · Aug 6, 2021

I thought everything you would do in Win 11 will be encrypted automatically. So how do I save unencrypted files to a backup device ?

barman58 · Aug 6, 2021

The software to encrypt data is the same Bitlocker app that's been in the pro versions of Windows for a while now, it is optional and to be honest It's not the sort of thing that the average home, or even small business users, would need to use, Financial, Military, Government, and certain Medical or business types would benefit from it's use.

The TPM system is used to encrypt and store the passwords, licence keys, and other software protections that windows and the apps use to protect us from the criminal hackers and their like.

If your key or password is just stored in windows then it's simpler for the hacker to get access and steal them, and then use the data for their own purposes

the higher security and encryption (which is only accessible from the PC itself, not over the net ) means that data is more protected as the hacker needs to be physically at the PC and know the password to gain access

Smalltown · Aug 6, 2021

barman58 thanks for that info. I did not realize that the encryption was optional.

TooOld · Aug 6, 2021

ASUS Pushes First Wave Of Windows 11 BIOS Updates For These AMD And Intel Motherboards

ASUS is moving forward with early Windows 11 support on its AMD and Intel motherboards.

hothardware.com

Dru2 · Aug 6, 2021

barman58 said:
The discreet TPM is, as far as I am aware, mostly a removable item, so the simple removal would, you would think, defeat the system.

Of course any encryption, If used and the key stored in the TPM, would not be defeated so the TPM system would have worked.

I had reason to reset the bios back to factory on my Desktop a few days ago, which also cleared the on chip and discrete TPM,

Although I am running Windows 10 I had to reset some windows security items such as the logon pin so TPM is already adding to security.

I use a pin to log-in to my systems as the coding is designed to be totally separate from the network system so only working on the local keyboard

I know you didn't mention BitLocker, but...

When you say you had reason to clear the BIOS, which also cleared the on chip and discrete TPM, did that include BitLocker?

I ask because it's been my experience as a BitLocker user that clearing the BIOS results in my having to re-input my BitLocker key to access my BitLockered drive. That even moving the drive to another machine will still require a BL key to unlock it. This says there is also coding on the drive.

Point is, for a BitLocker (encrypted) drive per my experience does auto decrypt an encrypted drive during a BIOS reset or even clearing the CMOS (also includes BIOS updates).

Unfortunately, one of my experiences was the fact that I lost a BitLocker key for one of my drives; resetting/clearing the BIOS, and even moving the drive to another machine did NOT allow me to unlock the drive without a key. In the end I had to reformat the drive, thus loosing all the data on it in order to use the drive again. And be aware Microsoft will be of no help in thwarting their security measures for someone who lost a key

johnlgalt · Aug 6, 2021

Yeah. I ran into something similar with a 3rd aprty encryption. I now make redundant backups of the stupid keys lol.

Never again.

barman58 · Aug 6, 2021

I have no need for the level of protection Bitlocker gives, I use a regular backup routine to provide my protection against accidental loss of data. As I said in the original post Encryption is a solution suited to major systems in critical systems

When I have been involved with data encryption in business and industry, the system of unencrypted backups held in offsite secure locations provided security for the data, the keys were held in multiple locations by multiple staff members, local copies were kept in secured server rooms with any data not on the system in walk in fire safes Obviously we also used variations of GFS [Grandfather-Father-Son] systems to allow for rollback to several years previous data

Josey Wales · Aug 6, 2021

Winuser said:
Back in 2009 I was going to buy a Harley as my retirement toy. Even the used Harleys were out of my price range. I finally decided to go with a 2009 Kawasaki and the only work It has needed were normal maintenances. Oil changes, valves adjusted and just recently two new tires. The tires were the originals and had just over 13,000 miles on them.

I rode a Kawasaki 550 LTD for 5 years in Arizona, I would have gotten a Harley but they were owned by AMF at the time. Never had a Problem with the 550.

Anibor_11 · Aug 6, 2021

I have never seen a reason to encrypt the OS. I keep the data separated from the OS, and only part of the data is "sensitive" information. This I keep encrypted in VeraCrypt containers, of which I keep several backups. As for passwords, I use a password manager, I only remember three or four passwords. After doing this for years, I have found no problems.
No TPMs, no papers, no "BIOS" passwords. And I con mount the VeraCrypt containers in any computer.

Dru2 · Aug 6, 2021

In addressing this point....

barman58 said:
I have no need for the level of protection Bitlocker gives, I use a regular backup routine to provide my protection against accidental loss of data. As I said in the original post Encryption is a solution suited to major systems in critical systems

I do regular backups, but I still encrypt some of my drives should the unfortunate happen where my PC's are stolen. If that happens, I at least have some comfort in knowing the drive is locked from prying eyes.

Is there a "guarantee" the scheme won't be hacked, no, there isn't, but something is better than nothing. That's me.

Josey Wales · Aug 6, 2021

martyfelker said:
I used the following hack to install on myiSShack-bypass-tpm-windows-11/

This registry hack lets you bypass the TPM 2.0 requirement and install Windows 11

As excitement builds around the launch of Windows 11, eager computer users are scrambling to use utilities such as WhyNotWin11 and Win11SysCheck to see if their system is compatible and up to the job.

betanews.com

MS can talk all they want about security - this is just the latest in Microsoft quest to sell more hardware. Still waiting for the "new features" before RTM. At least the taskbar is more consistent with Gnome 40!

I think MS can figure that out pretty quick.

barman58 · Aug 6, 2021

I look at it slightly differently the hardware is Insured for replacement in kind and as new, the data, which is the important thing, is kept backed up off the computer. My data relating to finance and related is kept at the Bank so my data is valuable to me but not likely to others. We see a lot of post discussing Hacking of user information, but to be the victim of this type of theft the user has to have something worth the hacker stealing, not a lot of private users have enough to make it worthwhile compared to businesses

In saying all this my home is locked alarmed and monitored by cameras 24/7/365 anyway :plead: