3 ms·
Sorry, I don't understand how this prioritizes despotic governments over phishing rings. Could you please clarify that? I think the goal here is two things:
by illumin8 9y ago
Sorry, I don't understand how this prioritizes despotic governments over phishing rings. Could you please clarify that?
I think the goal here is two things:
1. Allow organizations that want a trusted execution environment to refuse to boot if the OS is not signed properly, to prevent risk of unapproved software execution.
2. Prevent attackers with physical access to the device from booting an unapproved OS that might be meant to extract encryption keys, or otherwise extract or tamper with data.
These are very specific attack vectors that large enterprise customers are asking for to protect their data from malicious insiders, or just anyone with physical access to the datacenter and bad intentions.
That it might be used to prevent Linux from loading is simply an unintended consequence.
- daxorid 9y agoI believe points 1 and 2 could be addressed by implementing a trust-on-first-use model whereby the customer can set an initial signing public key for the PSP, which is then used to sign specific boot parameters. That way, as the customer, I can tell the PSP that I'd like to either require PSP-mediated secure boot, or permit boot if the PSP is disabled. OEMs and vendors selling to enterprise customers can pre-sign it for convenience, and tinfoil hats like me can disable it. Everybody wins. But we don't even have the choice.