4 ms·

What about the scenario where your laptop is stolen and the attacker reads your data off the disk? All modern mobile devices protect against this scenario by de

by shawnz 5y ago

What about the scenario where your laptop is stolen and the attacker reads your data off the disk? All modern mobile devices protect against this scenario by default, but Windows devices required additional configuration to be protected. And in fact Secure Boot does protect against Grandma being infected by boot-time malware. And when has it ever been the case that it prevented you from installing Linux?

ChuckNorris89 5y ago
>And in fact Secure Boot does protect against Grandma being infected by boot-time malware. And how can grandma get boot time malware at Home? IIRC those were common back in the days when people were plugging in infected floppy disks or thumb drives everywhere and you'd try to boot off them. Can't remember last time I saw this type of malware in the wild as phishing and ransomware is a lot more profitable for malicious actors than boot time malware. >And when has it ever been the case that it prevented you from installing Linux? This was always the case ever since secure boot launched and any OS that didn't have it's first stage bootloader signed by Microsoft could not boot. Even To this day, to install arch or puppy on my XPS i had to disable secure boot. Ubuntu and other major distros are fine here though but this gate keeping doesn't make it ok in my book.
- shawnz 5y ago
  > Can't remember last time I saw this type of malware in the wild. That's exactly because widespread secure boot has made it impractical! As for niche Linux distros, it's been mandated since the beginning that you can install your own Secure Boot keys on Microsoft certified desktop platforms.
  - yjftsjthsd-h 5y ago
    That branch of malware was already rare when uefi secure boot was introduced. > it's been mandated since the beginning that you can install your own Secure Boot keys on Microsoft certified desktop platforms. ...on x86; on ARM they mandated that the user couldn't install their own keys, which shows that they will lock users out as much as they think they can get away with.
    - Jiro 5y ago
      It hasn't been mandated at all. A number of years ago, Microsoft made headlines by changing their policy to get rid of that mandate. See https://arstechnica.com/information-technology/2015/03/windows-10-to-make-the-secure-boot-alt-os-lock-out-a-reality/ https://arstechnica.com/information-technology/2015/03/windo... . Microsoft's page at https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/disabling-secure-boot https://docs.microsoft.com/en-us/windows-hardware/manufactur... says that you can "usually" disable it, so I don't think they've changed their policy since then.
- vladvasiliu 5y ago
  > This was always the case ever since secure boot launched and any OS that didn't have it's first stage bootloader signed by Microsoft could not boot. Even To this day, to install arch or puppy on my XPS i had to disable secure boot. Ubuntu and other major distros are fine here though but this gate keeping doesn't make it ok in my book. But this is kind of a circular problem, isn't it? If everyone's bootloader is signed and recognized by every Secure Boot implementation, then signing is useless since it doesn't afford discrimination between "known good" and "dubious" bootloaders. I'm not familiar with XPS computers, but to me what's important, as another sibling says, is that the user be able to load their custom keys with which they sign their own bootloader. This is how I run Arch on my HP computers. This way, I can be reasonably sure that when I boot my arch linux, it's actually mine, and not some random live medium based of arch's (or whoever's) install disk that will sniff my passwords or whatever. To me, this is what SecureBoot is supposed to offer, and I don't see how you would implement this if you could easily get anything signed and accepted by most PCs.
  - ChuckNorris89 5y ago
    >to me what's important, as another sibling says, is that the user be able to load their custom keys with which they sign their own bootloader. This is how I run Arch on my HP computers. Like I said above, this and stuff like management engine and TPM makes perfect sense in the enterprise environment where the owner of the device (the employer) is different than the user (the employee), so IT needs to strictly control what's running on the devices they trust on their infrastructure, but why should we expect home users to have to sign bootloders to use whatever software they want as they're both the users and the owners of the devices and the network infrastructure in their homes?
    - vladvasiliu 5y ago
      I agree that the process could be more straight-forward, especially as, from what I read, some computers may need some coaxing into changing the keys. But the thing is that, like it or not, most people simply don't care enough, so they'll just use Windows. I remember a while ago, when there were many live CD-based distros and there was no such thing as SecureBoot, people wouldn't even be curious to give Linux a spin. All it would have taken was to pop a CD in the drive and boot up. To paraphrase another commenter, I think many people feel the same way about their PC as their washing machine: just another appliance. Of course, lock-down platforms don't help instill curiosity in people... So you get, roughly-speaking, two populations: those who care and those who don't. And usually, those who do care are curious enough to follow a few simple steps to disable SecureBoot for the installation and then set up their own signing process. But I stand by what I said earlier: the process cannot be fully automatic, or it defeats the purpose. But I do think that willingly making it a pain is wrong.
- tata71 5y ago
  > And how can grandma get boot time malware at Home? Depending on the demographic, they can: get caught up in during some (possibly unrelated, likely automated) attack, click the wrong ad, or load the wrong common page with JS.
  - ChuckNorris89 5y ago
    Can you please provide some sources for JS ad-based boot time malware you mentioned that one can get off the web?
    - SXX 5y ago
      Usually JS part it's just exploit that is just a first step. After there is compiled and native "loader" malware that required to setup actual trojan / rootkit.
vetinari 5y ago
> And when has it ever been the case that it prevented you from installing Linux? There was a window, when shim.efi was not signed. > And in fact Secure Boot does protect against Grandma being infected by boot-time malware. When it was the case that grandma was infected by boot-time malware? One-half-like malware happened decades ago, and under windows they need administrator rights anyway.

by shawnz 5y ago

ChuckNorris89 5y ago

>And in fact Secure Boot does protect against Grandma being infected by boot-time malware. And how can grandma get boot time malware at Home? IIRC those were common back in the days when people were plugging in infected floppy disks or thumb drives everywhere and you'd try to boot off them. Can't remember last time I saw this type of malware in the wild as phishing and ransomware is a lot more profitable for malicious actors than boot time malware. >And when has it ever been the case that it prevented you from installing Linux? This was always the case ever since secure boot launched and any OS that didn't have it's first stage bootloader signed by Microsoft could not boot. Even To this day, to install arch or puppy on my XPS i had to disable secure boot. Ubuntu and other major distros are fine here though but this gate keeping doesn't make it ok in my book.

shawnz 5y ago
> Can't remember last time I saw this type of malware in the wild. That's exactly because widespread secure boot has made it impractical! As for niche Linux distros, it's been mandated since the beginning that you can install your own Secure Boot keys on Microsoft certified desktop platforms.
- yjftsjthsd-h 5y ago
  That branch of malware was already rare when uefi secure boot was introduced. > it's been mandated since the beginning that you can install your own Secure Boot keys on Microsoft certified desktop platforms. ...on x86; on ARM they mandated that the user couldn't install their own keys, which shows that they will lock users out as much as they think they can get away with.
  - Jiro 5y ago
    It hasn't been mandated at all. A number of years ago, Microsoft made headlines by changing their policy to get rid of that mandate. See https://arstechnica.com/information-technology/2015/03/windows-10-to-make-the-secure-boot-alt-os-lock-out-a-reality/ https://arstechnica.com/information-technology/2015/03/windo... . Microsoft's page at https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/disabling-secure-boot https://docs.microsoft.com/en-us/windows-hardware/manufactur... says that you can "usually" disable it, so I don't think they've changed their policy since then.
vladvasiliu 5y ago
> This was always the case ever since secure boot launched and any OS that didn't have it's first stage bootloader signed by Microsoft could not boot. Even To this day, to install arch or puppy on my XPS i had to disable secure boot. Ubuntu and other major distros are fine here though but this gate keeping doesn't make it ok in my book. But this is kind of a circular problem, isn't it? If everyone's bootloader is signed and recognized by every Secure Boot implementation, then signing is useless since it doesn't afford discrimination between "known good" and "dubious" bootloaders. I'm not familiar with XPS computers, but to me what's important, as another sibling says, is that the user be able to load their custom keys with which they sign their own bootloader. This is how I run Arch on my HP computers. This way, I can be reasonably sure that when I boot my arch linux, it's actually mine, and not some random live medium based of arch's (or whoever's) install disk that will sniff my passwords or whatever. To me, this is what SecureBoot is supposed to offer, and I don't see how you would implement this if you could easily get anything signed and accepted by most PCs.
- ChuckNorris89 5y ago
  >to me what's important, as another sibling says, is that the user be able to load their custom keys with which they sign their own bootloader. This is how I run Arch on my HP computers. Like I said above, this and stuff like management engine and TPM makes perfect sense in the enterprise environment where the owner of the device (the employer) is different than the user (the employee), so IT needs to strictly control what's running on the devices they trust on their infrastructure, but why should we expect home users to have to sign bootloders to use whatever software they want as they're both the users and the owners of the devices and the network infrastructure in their homes?
  - vladvasiliu 5y ago
    I agree that the process could be more straight-forward, especially as, from what I read, some computers may need some coaxing into changing the keys. But the thing is that, like it or not, most people simply don't care enough, so they'll just use Windows. I remember a while ago, when there were many live CD-based distros and there was no such thing as SecureBoot, people wouldn't even be curious to give Linux a spin. All it would have taken was to pop a CD in the drive and boot up. To paraphrase another commenter, I think many people feel the same way about their PC as their washing machine: just another appliance. Of course, lock-down platforms don't help instill curiosity in people... So you get, roughly-speaking, two populations: those who care and those who don't. And usually, those who do care are curious enough to follow a few simple steps to disable SecureBoot for the installation and then set up their own signing process. But I stand by what I said earlier: the process cannot be fully automatic, or it defeats the purpose. But I do think that willingly making it a pain is wrong.
tata71 5y ago
> And how can grandma get boot time malware at Home? Depending on the demographic, they can: get caught up in during some (possibly unrelated, likely automated) attack, click the wrong ad, or load the wrong common page with JS.
- ChuckNorris89 5y ago
  Can you please provide some sources for JS ad-based boot time malware you mentioned that one can get off the web?
  - SXX 5y ago
    Usually JS part it's just exploit that is just a first step. After there is compiled and native "loader" malware that required to setup actual trojan / rootkit.

vetinari 5y ago

> And when has it ever been the case that it prevented you from installing Linux? There was a window, when shim.efi was not signed. > And in fact Secure Boot does protect against Grandma being infected by boot-time malware. When it was the case that grandma was infected by boot-time malware? One-half-like malware happened decades ago, and under windows they need administrator rights anyway.