If you&#x27;re not using TXT, your full disk encryption is completely useless if an attacker can get access to your laptop for 5 minutes¹. They can just backdoor the bootloader (or, on Linux, your kernel&#x2F;initramfs which are not encrypted) to get a foot into your system at the highest level of privileges.<p>If you&#x27;re using TXT, maybe the NSA can still do that by getting the ACM signing keys from Intel. But that&#x27;s still an improvement from just the standard FDE setup most people use, which could be trivially hacked by someone with the skill of an average university student.<p>¹ Make that 15min if you have a BIOS password and a static boot order that disallows booting on any kind of external device. It just requires a bit more preparation, but on most laptops it&#x27;s not hard to put a clip on the NVRAM that stores BIOS settings and reset what needs to be reset.