4 ms·

Does secure boot matter if you never turn the computer off?

fsflover 6y ago
And you never update your kernel? Ans you never ever have downtime?
raxxorrax 6y ago
No. You can also turn of secure boot and I would recommend it. It is mostly a scam and was probably introduced to try to lock down PCs like mobile devices. Microsoft being the usual offender here. Security benefits are questionable. There is no scenario where non-technical users boot into a malignant OS. They open mails with strange attachments. The security analysis leading to this initiative is some kind of fantasy novel.
- hvdijk 6y ago
  > There is no scenario where non-technical users boot into a malignant OS. According to the report there is, and I believe the report is correct, when the "malignant OS" is not actually a full OS, but rather a rootkit. This rootkit might have been the result of a non-technical user opening a mail with a strange attachment.
  - raxxorrax 6y ago
    Right, there are such scenarios, but it comes with disadvantages that are also relevant to security, to a larger degree in my opinion, and the mechanism is not excluding every form of rootkit. If you open a malignant attachment and execute it, there is just so much you can do.
    - shawnz 6y ago
      There are no security disadvantages that come with enabling Secure Boot. Doing so doesn't give anyone any additional control over your workstation.
  - eeZah7Ux 6y ago
    The secure boot "solution" requires trusting a huge amount of closed software and hardware. It's supposed to protect from a very theoretical risk.
    - vlowther 6y ago
      Boot time pre-OS malware is not a theoretical risk. At all.
      - eeZah7Ux 6y ago
        No. The attack is real. The risk is just not there. Most systems have valuable data on the current OS rather than a future one.
- jart 6y ago
  Linux distros are now required to ship their kernel builds as Windows EXE files that are digitally signed by Microsoft. Talk about a branding iron. It amazes me how no one talks about this. Or maybe there's just some NSA gravy train for online commentators I haven't found yet :(
  - Avamander 6y ago
    They are not "required", that claim is simply false and that's why "nobody's talking about it".
  - vladvasiliu 6y ago
    Do you have a source for that? I'm running Arch on a "professional" HP ProBook with secure boot activated. This laptop has no official linux support whatsoever from HP. It's fairly recent, too – 2018 I think. The bios allowed me set up my own keys which I use to sign the kernel. A fun fact is that with the way it is setup currently, I refuses to boot windows because of the... wrong signature!
    - dooglius 6y ago
      > The bios allowed me set up my own keys which I use to sign the kernel Not all manufacturers allow this, and even then, it adds considerable user complexity to have to do this to install Linux, as opposed to a normal liveUSB GUI flow, not to mention that it screws up dual-boot, as you said. So, it is practically a requirement, even if it is technically possible to work around it with good technical skills on specialized hardware.
      - vladvasiliu 6y ago
        The HP has a box to tick in the UEFI where it loads the MS keys. I never tried it, so I don't know if that is in addition to whatever keys are configured or if it replaces the custom keys. As there's a different option to clear all keys, I would hope it's the former. I think in this case there are two problems, more related to the hardware and SecureBoot implementation rather than secureboot itself. 1. Shoddy hardware that doesn't allow the user to control it. 2. A process that is relatively involved, although I'm not sure how you could go about providing an "easy way" for people without technical skills. One way or another, the keys have to get in the UEFI. It's technically possible to configure them from inside Linux (while it's running) – this worked on an HP EliteDesk – but the UEFI SecureBoot has to be disabled. I suppose that's relatively simple to do, certainly simple enough for someone interested in trying linux (as opposed to people who don't care what os they use as long as they can accomplish what they want with their computers). I guess a nice way would be for the UEFI to expose some sort of interface where the OS can change the keys and then, on reboot, asks the user if they really wanted to the change. But this would still be a problem for the initial setup, because, if booting linux (instead of the usual windows) you are actually booting a different OS than what the UEFI expects.

And you never update your kernel? Ans you never ever have downtime?

No. You can also turn of secure boot and I would recommend it. It is mostly a scam and was probably introduced to try to lock down PCs like mobile devices. Microsoft being the usual offender here. Security benefits are questionable. There is no scenario where non-technical users boot into a malignant OS. They open mails with strange attachments. The security analysis leading to this initiative is some kind of fantasy novel.

hvdijk 6y ago
> There is no scenario where non-technical users boot into a malignant OS. According to the report there is, and I believe the report is correct, when the "malignant OS" is not actually a full OS, but rather a rootkit. This rootkit might have been the result of a non-technical user opening a mail with a strange attachment.
- raxxorrax 6y ago
  Right, there are such scenarios, but it comes with disadvantages that are also relevant to security, to a larger degree in my opinion, and the mechanism is not excluding every form of rootkit. If you open a malignant attachment and execute it, there is just so much you can do.
  - shawnz 6y ago
    There are no security disadvantages that come with enabling Secure Boot. Doing so doesn't give anyone any additional control over your workstation.
- eeZah7Ux 6y ago
  The secure boot "solution" requires trusting a huge amount of closed software and hardware. It's supposed to protect from a very theoretical risk.
  - vlowther 6y ago
    Boot time pre-OS malware is not a theoretical risk. At all.
    - eeZah7Ux 6y ago
      No. The attack is real. The risk is just not there. Most systems have valuable data on the current OS rather than a future one.
jart 6y ago
Linux distros are now required to ship their kernel builds as Windows EXE files that are digitally signed by Microsoft. Talk about a branding iron. It amazes me how no one talks about this. Or maybe there's just some NSA gravy train for online commentators I haven't found yet :(
- Avamander 6y ago
  They are not "required", that claim is simply false and that's why "nobody's talking about it".
- vladvasiliu 6y ago
  Do you have a source for that? I'm running Arch on a "professional" HP ProBook with secure boot activated. This laptop has no official linux support whatsoever from HP. It's fairly recent, too – 2018 I think. The bios allowed me set up my own keys which I use to sign the kernel. A fun fact is that with the way it is setup currently, I refuses to boot windows because of the... wrong signature!
  - dooglius 6y ago
    > The bios allowed me set up my own keys which I use to sign the kernel Not all manufacturers allow this, and even then, it adds considerable user complexity to have to do this to install Linux, as opposed to a normal liveUSB GUI flow, not to mention that it screws up dual-boot, as you said. So, it is practically a requirement, even if it is technically possible to work around it with good technical skills on specialized hardware.
    - vladvasiliu 6y ago
      The HP has a box to tick in the UEFI where it loads the MS keys. I never tried it, so I don't know if that is in addition to whatever keys are configured or if it replaces the custom keys. As there's a different option to clear all keys, I would hope it's the former. I think in this case there are two problems, more related to the hardware and SecureBoot implementation rather than secureboot itself. 1. Shoddy hardware that doesn't allow the user to control it. 2. A process that is relatively involved, although I'm not sure how you could go about providing an "easy way" for people without technical skills. One way or another, the keys have to get in the UEFI. It's technically possible to configure them from inside Linux (while it's running) – this worked on an HP EliteDesk – but the UEFI SecureBoot has to be disabled. I suppose that's relatively simple to do, certainly simple enough for someone interested in trying linux (as opposed to people who don't care what os they use as long as they can accomplish what they want with their computers). I guess a nice way would be for the UEFI to expose some sort of interface where the OS can change the keys and then, on reboot, asks the user if they really wanted to the change. But this would still be a problem for the initial setup, because, if booting linux (instead of the usual windows) you are actually booting a different OS than what the UEFI expects.