Preparing for Insider Preview Builds of Windows 11 - ***UPDATED 6/28***

i think TPM 2.0 is a waste of money for windows 11 it not going to make computer saver ...any good hacker will find a way in to any computer if they want to .

Sorry but for now Wiondows 11 does not supprt "discrete" TPM2.0 chips, only "firmware TPM" using UEFI BIOS firmware using a single security profile, and storing the secured keys inside some non-volatile and protected memory of the processor.

Plug any discrete (and more powerful and more secure) TPM2.0 chip on any system using even one of the "supported" processors, this won't work: you still MUST disable the discrete TPM and only use the "fTPM" inside the processor... even if it is also less performant (implemented by code running in a "UEFI capsule" using CPU ressources). TPM chips (which may be connected ion a dedicated LPC port of the motherboard, or inside a fast USB or Firewire or other PCI express adapter, or inside SSD and RAID controlers, or could even be made inside DRAM modules), have dedicated hardware and have hardware better protection than CPU; and they are more easily replacable when needed (without having to change the CPU and/or motherboard, which is costly and requires resintalling the system and buying new licences for everything.

When will Microsoft stop this stupidity for supporting windows 11 only with a "fTPM" inside CPUs? This design was just made for smartphones and small tablets (or very small iOT devices and Raspberry things), just becuase it allowed a reduction of size and manufacturing costs if manufacturer can avoid an extra connector, not for desktops, servers, and high-end notebooks. But "fTPMs" are weak, and easily attackable by side-channel attacks based on time/performance of software or scripts running in any process or thread.

Side-channel attacks are very complex to avoid inside the CPU itself (and avoiding them with mitigation in kernels or in the CPU microfirmware is generally costly in terms of performance on large servers). It's much easier to isolate a discrete TPM which already has builtin and external hardware defenses. a fTPM inside a CPU (and running only on specific cores with NUMA) even at if this is a TPM2.0, is LESS secure than any discrete TPM (even if the latter implements only TPM1.2).

In addition the fTPM has severe problems in terms of deployment: future PCs will have many TPM banks and if needed you'll had more TPM devices to support specific applications notably containers and lamda functions.

Support dev channel