4 ms·
The root of trust is in Secure Boot, and you have control of those keys. That means you maintain control of your machine - it's always possible for you to boot
by mjg59 11y ago
The root of trust is in Secure Boot, and you have control of those keys. That means you maintain control of your machine - it's always possible for you to boot modified code that checks your signatures instead of any manufacturer's.
- vetinari 11y agoFor PCs you do control MOKs, for now. For mobile devices, or for devices like Chromebooks, you don't. It is only matter of time, until PCs change too, with apologies like 'nobody uses it anyway, why complicate things' etc. The frog must be boiled slowly, otherwise it backfires.
- mjg59 11y agoChromebooks are explicitly designed to permit re-keying, although it does require you to physically disassemble the machine[1]. And if anything, we're seeing more user-unlockable mobile devices now than we did in the past. At the high end, server vendors want to maintain control of their keys, and there are large companies who want to do the same for corporate desktops and laptops. At the current rate, the frog's going to die of old age before it notices anything. [1] The reasons for this design choice are understandable, even if I disagree with them
- gsnedders 11y agoNot all Chromebooks require physical modification for re-keying. (The Dell Chromebook 11 doesn't, for example.)