4 ms·

Question: how secure are BIOS passwords, really? If you have full-disk encryption anyway, is the BIOS password adding anything?

fortran77 7y ago
well, you could make the machine boot on another device and potentially trick someone into entering their credentials on a "phishing" screen.
Galanwe 7y ago
The BIOS does control the boot order sequence for instance. I guess if you have access to it, you could force boot from a malicious USB stick, or the network, that would simulate the disk decryption prompt. I guess you could also remove security measures that your company put in place to e.g. prevent the usage of USB to prevention information leak.
- jasonhansel 7y ago
  But to do that you could also just (say) clone the disk drive and install the fake prompt on the disk drive itself, right?
  - Galanwe 7y ago
    Not if secure boot is enabled, your boot loader most likely would not have a trusted signature.
Avery3R 7y ago
If you have physical access and a flash programmer they're not secure at all. If you're trying to stop a random passerby from messing with your firmware settings they're great.
unnouinceput 7y ago
They are not secure at all. Full disk encryption is the only way to protect your data in case a stranger has physical access to your device.
- akvadrako 7y ago
  That doesn’t help. If they have physical access they can make the system boot into a fake login screen and capture your password. Securing the bios is necessary.
  - faceplanted 7y ago
    If someone has that much physical access to your machine they can capture your password far more easily with a physical keylogger assuming you use an external keyboard like one time.
    - criddell 7y ago
      Or apply rubber hose cryptanalysis. https://xkcd.com/538/ https://xkcd.com/538/
      - faceplanted 7y ago
        That's not really the same situation, if someone's trying to bug you they don't want to be caught, if they were willing to do illegal violence they'd probably do it first, or if they're a government, you have way bigger problems.
mehrdadn 7y ago
One is supposed to prevent access to the hardware, one is supposed to prevent access to the data. They're not meant to solve the same problem. But that say, you can only block access to hardware so well, so it's worse in that regard.

fortran77 7y ago

well, you could make the machine boot on another device and potentially trick someone into entering their credentials on a "phishing" screen.

Galanwe 7y ago

The BIOS does control the boot order sequence for instance. I guess if you have access to it, you could force boot from a malicious USB stick, or the network, that would simulate the disk decryption prompt. I guess you could also remove security measures that your company put in place to e.g. prevent the usage of USB to prevention information leak.

jasonhansel 7y ago
But to do that you could also just (say) clone the disk drive and install the fake prompt on the disk drive itself, right?
- Galanwe 7y ago
  Not if secure boot is enabled, your boot loader most likely would not have a trusted signature.

Avery3R 7y ago

If you have physical access and a flash programmer they're not secure at all. If you're trying to stop a random passerby from messing with your firmware settings they're great.

unnouinceput 7y ago

They are not secure at all. Full disk encryption is the only way to protect your data in case a stranger has physical access to your device.

akvadrako 7y ago
That doesn’t help. If they have physical access they can make the system boot into a fake login screen and capture your password. Securing the bios is necessary.
- faceplanted 7y ago
  If someone has that much physical access to your machine they can capture your password far more easily with a physical keylogger assuming you use an external keyboard like one time.
  - criddell 7y ago
    Or apply rubber hose cryptanalysis. https://xkcd.com/538/ https://xkcd.com/538/
    - faceplanted 7y ago
      That's not really the same situation, if someone's trying to bug you they don't want to be caught, if they were willing to do illegal violence they'd probably do it first, or if they're a government, you have way bigger problems.

mehrdadn 7y ago

One is supposed to prevent access to the hardware, one is supposed to prevent access to the data. They're not meant to solve the same problem. But that say, you can only block access to hardware so well, so it's worse in that regard.