--- Question: What are the exact risks of using TPM 2.0 or owning this integrated chip? In what circumstances?
What are the solutions to minimize risks?
Details: My primary goal was to try to find out, how could deeper level backdoors compromise nowadays disk/messaging "encryption" practices, and how to solve them.
I found the well known article where the German government practically says, that having windows 8/10 with TPM 2.0 is probably acceptable for the average customers but otherwise its not recommended for Federal use, because it is a potential source of backdoor. Now after that the Wannacry defeated their whole railway system, exploiting an already known, but intentionally undisclosed Win security hole, their worries seem to be legit. But other firmware security developers like Guido Stepken (also in Germany) say if the computer is bought with preinstalled Win, the Endorsement Key is already signed by US authorities, than its practically enforcable by US law to insert any backdoor into MS products, or provide these keys, and then of course anyone with knowledge can practically have control over any machine (there were several successful attacks demonstrated too).
In this case, its not enough to wipe the hdd/ssd, and install a Linux distro, and ignore propriatery firmware installs (which may also be a risk). The next what we can do is to disable TPM and UEFI - how can we trust than that it really happens? This leaves the system more vulnerable to attack, therefore we need to find a way to make Linux work with UEFI - can it be trusted in a previously Win certified machine? Can we secure the system so the data is not tied to the TPM? (data loss due to physical error.
I searched for a few days, and I didn't find any clear answer, most of the articles are either infinitely paranoid or simply ignore the risk side, or MS advertisement. I need a rational balance between.
If I'm not exact enough, or you need sources, I react upon demand. Thanks for the effort, trying to reply.