3 ms·

Does this mean that I need to get the private key to Microsoft for them to sign? Can Microsoft then record my key and impersonate me? Or can Microsoft sing an

Does this mean that I need to get the private key to Microsoft for them to sign? Can Microsoft then record my key and impersonate me? Or can Microsoft sing an NSA backdored Linux so it appears that is "secure/genuine"? If the answer is yes to one of those then for me seems fair that someone would say that "it is not secure book if I can't remove Microsoft)NSA keys) and put my own and confirm it worked)" , seems to be a push for sanity that failed , like how we failed and we have now DRM into the browser.

nix23 5y ago
>Or can Microsoft sing an NSA backdored Linux so it appears that is "secure/genuine"? If you keep the default Microsoft keys a big YES. Just trust secure-boot if you absolutely believe that there is no chance that there is a hidden "non detectable but updatable" key ;)
p_l 5y ago
The answer is no to all of them, at least if you deal with hardware that... wants to pass Microsoft certification checks. Because one of them requires ability of device owner to delete any pre-existing platform keys and load their own set.
- Shared404 5y ago
  > Because one of them requires ability of device owner to delete any pre-existing platform keys and load their own set. On x86 based systems. My understanding is that Arm systems require the opposite.
  - voakbasda 5y ago
    Not require. But without a requirement, vendors are making their own choices. Some have gone with one-time programmable fuses to store the keys. Once programmed, only images signed with that key can be used. Otherwise, the device is a brick. Those vendors deserve to burn in hell (in my opinion as an embedded engineer that has implemented secure boot on a variety of platforms).
    - Shared404 5y ago
      Makes sense, thanks for the expert input! If you don't mind me asking, how did you get into embedded development? I'm trying to sample various types of development and see what I enjoy, and embedded development seems quite interesting to me though I've never done more than an arduino.
    - yuubi 5y ago
      MS definitely did require a few years ago. https://readwrite.com/2012/01/13/microsoft-says-no-to-disabling-2/ https://readwrite.com/2012/01/13/microsoft-says-no-to-disabl... . Has this changed?
      - p_l 5y ago
        MS has been slowly prepping Windows on ARM to be viable as "Enterprise" device and for that it needs owner-controlled Platform Keys (to comply with their own requirements for enterprise offerings)
    - p_l 5y ago
      There are very few ARM vendors that don't deserve Hell... (And I include ostensibly FLOSS in it as well, as shitty firmware can be worse than no firmware)

nix23 5y ago

>Or can Microsoft sing an NSA backdored Linux so it appears that is "secure/genuine"? If you keep the default Microsoft keys a big YES. Just trust secure-boot if you absolutely believe that there is no chance that there is a hidden "non detectable but updatable" key ;)

p_l 5y ago

The answer is no to all of them, at least if you deal with hardware that... wants to pass Microsoft certification checks. Because one of them requires ability of device owner to delete any pre-existing platform keys and load their own set.

Shared404 5y ago
> Because one of them requires ability of device owner to delete any pre-existing platform keys and load their own set. On x86 based systems. My understanding is that Arm systems require the opposite.
- voakbasda 5y ago
  Not require. But without a requirement, vendors are making their own choices. Some have gone with one-time programmable fuses to store the keys. Once programmed, only images signed with that key can be used. Otherwise, the device is a brick. Those vendors deserve to burn in hell (in my opinion as an embedded engineer that has implemented secure boot on a variety of platforms).
  - Shared404 5y ago
    Makes sense, thanks for the expert input! If you don't mind me asking, how did you get into embedded development? I'm trying to sample various types of development and see what I enjoy, and embedded development seems quite interesting to me though I've never done more than an arduino.
  - yuubi 5y ago
    MS definitely did require a few years ago. https://readwrite.com/2012/01/13/microsoft-says-no-to-disabling-2/ https://readwrite.com/2012/01/13/microsoft-says-no-to-disabl... . Has this changed?
    - p_l 5y ago
      MS has been slowly prepping Windows on ARM to be viable as "Enterprise" device and for that it needs owner-controlled Platform Keys (to comply with their own requirements for enterprise offerings)
  - p_l 5y ago
    There are very few ARM vendors that don't deserve Hell... (And I include ostensibly FLOSS in it as well, as shitty firmware can be worse than no firmware)