3 ms·

To me it seems Secure Boot has always been a near-zero-value bullshit invented and pushed by Microsoft to make life of dual-booters harder.

ohazi 5y ago
The only theoretical value I see in Secure Boot is if you're trying to build a tamper-resistant laptop. You'd have to only run Linux, you'd have to disable everything except your own signing keys (rather than using the shim, or anything else signed by Microsoft, because they'll sign (or can be coerced into signing) basically anything), you'd probably want to skip GRUB and boot an EFI executable directly without editable kernel arguments, and you'd have to manually sign every kernel update or module that you wanted to load. But even then, I see no reason to trust that a given UEFI implementation won't quietly accept some secret hard-coded key even after all of the defaults have been removed, so now I guess we're stuck with older machines that can be flashed with Coreboot? Yeesh. The number of people who can get this to work has got to be vanishingly small...
lostmsu 5y ago
Every single cloud provider uses Secure Boot as an additional layer of security for machines.
fomine3 5y ago
Secure boot and corresponding protection is just like security protection on Mac/iPhone/Android by Secure Enclave / TrustZone. Maybe users something like using FOSS phone don't like them, but it seems to better to have it in general.
smileybarry 5y ago
On Windows 10, turning on Secure Boot then requires every boot driver to be manually signed by Microsoft themselves, in addition to the dev's code signing cert. This is a significant security boundary, given that most malicious actors won't go through the process of EV registration with Microsoft to gain this. (I guess netfilter is an interesting exception) If they compromise someone's credentials and still get a driver signed, Microsoft have a copy of the driver and when/where it was signed. In addition, Secure Boot prevents malware from changing the bootloader (and helps stop boot-time ransomware). It's just a good sense fix to many attack vectors left alone for years.

ohazi 5y ago

The only theoretical value I see in Secure Boot is if you're trying to build a tamper-resistant laptop. You'd have to only run Linux, you'd have to disable everything except your own signing keys (rather than using the shim, or anything else signed by Microsoft, because they'll sign (or can be coerced into signing) basically anything), you'd probably want to skip GRUB and boot an EFI executable directly without editable kernel arguments, and you'd have to manually sign every kernel update or module that you wanted to load. But even then, I see no reason to trust that a given UEFI implementation won't quietly accept some secret hard-coded key even after all of the defaults have been removed, so now I guess we're stuck with older machines that can be flashed with Coreboot? Yeesh. The number of people who can get this to work has got to be vanishingly small...

lostmsu 5y ago

Every single cloud provider uses Secure Boot as an additional layer of security for machines.

fomine3 5y ago

Secure boot and corresponding protection is just like security protection on Mac/iPhone/Android by Secure Enclave / TrustZone. Maybe users something like using FOSS phone don't like them, but it seems to better to have it in general.

smileybarry 5y ago

On Windows 10, turning on Secure Boot then requires every boot driver to be manually signed by Microsoft themselves, in addition to the dev's code signing cert. This is a significant security boundary, given that most malicious actors won't go through the process of EV registration with Microsoft to gain this. (I guess netfilter is an interesting exception) If they compromise someone's credentials and still get a driver signed, Microsoft have a copy of the driver and when/where it was signed. In addition, Secure Boot prevents malware from changing the bootloader (and helps stop boot-time ransomware). It's just a good sense fix to many attack vectors left alone for years.