3 ms·

why not just a UEFI menu where you can implicitly authorize the private key by simply entering a public key of choice? 1024 bit = 128 bytes = 256 hexadecimal di

• derefr 8y ago
  Because that’s still something an MITM in your hardware logistics chain could do to keylog you, which is what the trusted-boot sequence is designed to prevent. It might make sense to have a the ability to enter a UEFI key that would disable the dangerous “press to erase” prompt, but I don’t think it would ever make sense to make such a modified machine boot completely silently and “out-of-the-box like” (unless you don’t believe they should have secure boot as a design goal in the first place.) Probably the most burning in a UEFI key would do is change the “this is a dev-mode laptop” warning to a “this is a customized deployment; if you were expecting a device direct from Google, you are being attacked!” warning.
• knodi123 8y ago
  > 128 bytes = 256 hexadecimal digits. Totally feasible to enter manually... This looks like a job for QR codes!