17 ms·
Certainly. Security is always a balancing act. My primary concern is laptop being taken when traveling by Air or stolen. Encrypted root covers that, even with b
by jeppesen-io 5y ago
Certainly. Security is always a balancing act. My primary concern is laptop being taken when traveling by Air or stolen. Encrypted root covers that, even with boot un-encrypted
Unencrypted boot leaves me vulnerable to a malicious actor taking my laptop, modifing grub and/or linux kernel to send and/or store my password to unlock the boot volume and then handing my laptop back and me typing in my un-lock password
Possible, but I view that threat as low
- est31 5y agoYeah, when someone has temporary physical access to your hardware you have lost anyways. They could perform hardware alterations and e.g. install hardware keyloggers into the device, etc.
- kevinmgranger 5y agoIsn't UEFI, if configured correctly, supposed to protect against this?
- jeppesen-io 5y agoCan you explain? How should UEFI be configured to do this, from a Linux perspective? I'd love to improve my security
- LeoPanthera 5y agoIn theory, secure boot checksums the bootloader and fails to boot if it has been modified. Using it with Linux can be a bit tricky. openSUSE has a tool to help sign your kernel, I don't know how other distributions do it. https://en.opensuse.org/openSUSE:UEFI#Secure_Boot https://en.opensuse.org/openSUSE:UEFI#Secure_Boot
- KingMachiavelli 5y agoThis is the "Evil maid attack" [1] but it is avoidable. If you have Secure Boot enabled and are properly signing your Bootloader + anything it launches then your machine would just refuse to boot if anyone tampered with critical files in /boot. The issue I have seen is that a LOT of BIOS (at least on desktop machines) seem to just let you reset the secure boot enforcement status via the BIOS reset jumper... which defeats the point although it does raise the physical access requirement to a longer duration.
- kadoban 5y agoEvil maid attack is really difficult anyway, because if nothing else they can just put in a hardware keylogger, or a hidden camera or a microphone if they really want to work for it, or etc.