4 ms·

How many people are qualified to "verify there's no backdoor to your CPU"? Certainly not your average user. If you can't trust your CPU, what can you trust?

How many people are qualified to "verify there's no backdoor to your CPU"? Certainly not your average user. If you can't trust your CPU, what can you trust? Allowing Secure Boot to be bypassed is a backdoor in itself. Allowing the end-user to modify the firmware at all also allows malicious actors to do the same.

deno 11y ago
> How many people are qualified to "verify there's no backdoor to your CPU"? Certainly not your average user. I meant there are no backdoors in firmware. Some poor phrasing on my part, sorry. Backdoors in CPUs are obviously a completely different issue altogether. > Allowing Secure Boot to be bypassed is a backdoor in itself. You can have open source implementation of Secure Boot as a Coreboot payload. One such implementation is Tiano Core (UEFI). > Allowing the end-user to modify the firmware at all also allows malicious actors to do the same. Modifying firmware to flash Coreboot usually involves at least switching jumpers or actually physically flashing the memory chip. But even if there’s no hardware switch you are still free to implement whatever security you like in the firmware. Because you control the firmware. So if you want to have signed payloads that’s just fine!
zAy0LfpBZLC8mAC 11y ago
> How many people are qualified to "verify there's no backdoor to your CPU"? More than the manufacturer, if it's open, and that's the point. The manufacturer has an interest or can be pressured into having an interest in keeping backdoors secret. The point is not that every user will themselves audit the firmware, the point is that everyone in principle could either learn to do it themselves or hire someone with the neccessary knowledge to do the audit for them. Food safety also isn't achieved by having everyone test their food in their own labs, but by anyone being able to hire a lab of their choice to do tests they want to have done. > Allowing the end-user to modify the firmware at all also allows malicious actors to do the same. And allowing the end-user to swap out the lock to their house also allows malicious actors to do the same? Just because you can swap out a flash chip on your mainboard, doesn't mean anyone can come into your house and do the same.
chei0aiV 11y ago
> Allowing Secure Boot to be bypassed is a backdoor in itself. Like Ubuntu does? http://firmwaresecurity.com/2016/01/07/ubuntus-uefi-secure-boot-not-a-security-measure/ http://firmwaresecurity.com/2016/01/07/ubuntus-uefi-secure-b...

deno 11y ago

> How many people are qualified to "verify there's no backdoor to your CPU"? Certainly not your average user. I meant there are no backdoors in firmware. Some poor phrasing on my part, sorry. Backdoors in CPUs are obviously a completely different issue altogether. > Allowing Secure Boot to be bypassed is a backdoor in itself. You can have open source implementation of Secure Boot as a Coreboot payload. One such implementation is Tiano Core (UEFI). > Allowing the end-user to modify the firmware at all also allows malicious actors to do the same. Modifying firmware to flash Coreboot usually involves at least switching jumpers or actually physically flashing the memory chip. But even if there’s no hardware switch you are still free to implement whatever security you like in the firmware. Because you control the firmware. So if you want to have signed payloads that’s just fine!

zAy0LfpBZLC8mAC 11y ago

> How many people are qualified to "verify there's no backdoor to your CPU"? More than the manufacturer, if it's open, and that's the point. The manufacturer has an interest or can be pressured into having an interest in keeping backdoors secret. The point is not that every user will themselves audit the firmware, the point is that everyone in principle could either learn to do it themselves or hire someone with the neccessary knowledge to do the audit for them. Food safety also isn't achieved by having everyone test their food in their own labs, but by anyone being able to hire a lab of their choice to do tests they want to have done. > Allowing the end-user to modify the firmware at all also allows malicious actors to do the same. And allowing the end-user to swap out the lock to their house also allows malicious actors to do the same? Just because you can swap out a flash chip on your mainboard, doesn't mean anyone can come into your house and do the same.

chei0aiV 11y ago

> Allowing Secure Boot to be bypassed is a backdoor in itself. Like Ubuntu does? http://firmwaresecurity.com/2016/01/07/ubuntus-uefi-secure-boot-not-a-security-measure/ http://firmwaresecurity.com/2016/01/07/ubuntus-uefi-secure-b...