FOFoxboron·Jun 6, 2024
`tpm2-totp` defeats the entire "replace the laptop" threat scenario.
https://github.com/tpm2-software/tpm2-totp
In TPM GPIO fail: How bad OEM firmware ruins Intel TPM securitytpm2-software
tpm2-totp
C2021–2024
tpm2-software / tpm2-totp
tpm2-totp
Attest the trustworthiness of a device against a human using time-based one-time passwords
4Distinct people
5Mentions
0Explicit recommenders
203GitHub stars
What to know before exploring
What it is
Attest the trustworthiness of a device against a human using time-based one-time passwords
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year5 dated mentions
Observed mentions: 2021-08-06 08:39:37 UTC to 2024-06-06 09:46:58 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 2 | 1 | 1 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 1 | 0 | 1 |
What Hacker News says
5 sourcesYou need a TPM 2.0 compatible CPU, but something like this sounds really excellent: https://github.com/tpm2-software/tpm2-totp
This means your laptop itself would be your hardware device, the TOTP secret would be stored in the TPM and theoretically impossible to steal/copy. Of course this means you will probably want a mobile device (possibly a second laptop also) as a backup.)
In TOTP tokens on my wrist with the smartest dumb watchCheck out tpm2-totp. I stumbled across it while looking for a way to store totp secrets in my tpm, and was really impressed with the clever use of totp to verify a boot chain.
https://github.com/tpm2-software/tpm2-totp
In Mullvad: Diskless infrastructure using stboot in beta>But okay, you may extend my attack by saying that you exchange the motherboard between the victim and the attacker laptop, so that you don't need to replicate the chassis.
Modern computers has tamper detection and if you open them you'll need to type the BIOS password.
However, replacing the motherboard is going to replace the TPM. This is easily detectable with something like tpm2_totp in the bootchain.
https://github.com/tpm2-software/tpm2-totp
In Authenticated Boot and Disk Encryption on LinuxAttest computer secure boot state to phone via time-based OTP and TPM
1 points · Open discussion