their page to link accounts to it was not a real webapp, it was a novnc page that would connect to an ubuntu vm that runs chrome with no sandboxing and basic password store under fluxbox wmsomeone dumped the home directory from it
you shouldn't need to disable tpm