3 ms·
Nice. Wasn't aware that was possible. Would you opt for encrypting boot partitions over isolating them on a USB?
by dpiz 10y ago
Nice. Wasn't aware that was possible. Would you opt for encrypting boot partitions over isolating them on a USB?
- fulafel 10y agoDepends on the implementation of encrypted /boot. If the bootloader itself is loaded from the host disk[1], your adversary could always just overwrite /boot and GRUB with something that is actually unencrypted and just pretends to ask for the password. I guess ideally the system should authenticate itself to the user somehow. Maybe by presenting its own user-facing password from a list of one time passwords. (Of course all this is moot if the bad guy reflashes your bios to execute everything in a hostile VM or does other shenanigans that physical access enables... but this requires slightly more sophistication/effort). [1] I can't tell from the article which device this guy installs GRUB on. Of course allowing direct boot from USB will have the downside of making it easier for your adversary to run his own tools.