Microsoft uses TPM PCRs 7+11 for BitLocker which is more secure than the Linux implementations mentioned in the article.
PCR 7 is the Secure Boot measurement which means it can't be unlocked unless every signed boot component has not been tampered with up to the point of unlock by the EFI bootloader. PCR 11 is simply flipped from a 0 to a 1 by the bootloader to protect the keys from being extracted in user land from an already booted system.
The article is correct that most Linux implementations blindly following these kinds of "guides" are not secure. Without additional PCRs, specifically 8 and 9 measuring the grub commands (no single-user bypass) and initrd (which is usually on an unencrypted partition), it is trivial to bypass. But the downside of using these additional PCRs is that you need to manually unlock with a LUKS2 password and reseal the keys in TPM whenever the kernel and or initrd updates.
Of course to be really secure, you want to require a PIN in addition to TPM to unlock the disk under any OS. But Microsoft's TPM-only implementation is fairly secure with only a few advanced vulnerabilities such as LogoFAIL and cold boot attacks.
You can order it dipped, wet, or dry. Wet is the traditional so it usually just has one or two ladles of juice poured over it. Dipped is when they dunk the whole thing. But the bread is high quality so it can usually take it. I prefer wet myself (hehe).
Bitlocker is extra vulberable because it stores the key in the TPM and requires no password to boot. An attacker can extract the key even if the computer is off when they get it.
This is not true.
You would additionally need to bypass Secure Boot with a separate exploit such as the one in this article (which is mitigated by disabling USB boot) or LogoFAIL to put the TPM PCRs in a state where the keys can be released.
LUKS2 is no different here as either can be TPM-only or require a separate PIN.
An SSO-like payment system with tracking and revocation is a great idea and would be amazing for us consumers. I'm just not holding my breath waiting for the corpos to implement it.
While nowhere near perfect (far from it, really), as long as the sites you are shopping on are PCI-compliant (most should be), you don't have to worry too much about a compromised site leaking your payment details for use elsewhere.
Basically just use a password manager and don't worry about saving credit card (NOT debit card) details in the site as long as they aren't extra-sketchy.
I disagree. You should not immediately go and replace the OS as soon as you get it.
Most modifications to the root filesystem persist through updates just fine. You simply need to add the relevant exclusions for your customizations. See the Development and Modding section here.
I have a significant amount of modifications to Steam OS, including an encrypted home partition (while excluding the steamapps subdirectory via bind mount) protected by TPM.
The only time an update breaks anything is if the kernel or initramfs updates, requiring me to re-enter the LUKS password and reenroll a new TPM protector. And this is only because they don't support Secure Boot, so my PCR selection is limited. And I was on the Beta update channel for a while updating almost weekly without issue.
If you're willing to wait 2 weeks for shipping (with an added shipping cost of $0.40) you can just order that stuff directly from Aliexpress and cut out the middle man.
I'd be careful about completely trusting any AV to give you any certainty that you aren't infected.
As I mentioned in another comment, Pegasus is comprised of many different exploits. So just because Bitdefender can detect some older Pegasus variants, doesn't mean it can detect all of them.
In fact it's quite unlikely they can detect the latest variants.
Microsoft uses TPM PCRs 7+11 for BitLocker which is more secure than the Linux implementations mentioned in the article.
PCR 7 is the Secure Boot measurement which means it can't be unlocked unless every signed boot component has not been tampered with up to the point of unlock by the EFI bootloader. PCR 11 is simply flipped from a 0 to a 1 by the bootloader to protect the keys from being extracted in user land from an already booted system.
The article is correct that most Linux implementations blindly following these kinds of "guides" are not secure. Without additional PCRs, specifically 8 and 9 measuring the grub commands (no single-user bypass) and initrd (which is usually on an unencrypted partition), it is trivial to bypass. But the downside of using these additional PCRs is that you need to manually unlock with a LUKS2 password and reseal the keys in TPM whenever the kernel and or initrd updates.
Of course to be really secure, you want to require a PIN in addition to TPM to unlock the disk under any OS. But Microsoft's TPM-only implementation is fairly secure with only a few advanced vulnerabilities such as LogoFAIL and cold boot attacks.