6 ms·

That works great for you and me. But the average person (or even the average IT dept) does not want to open their machine to update the BIOS. Essentially your

by ArnoVW 5y ago

That works great for you and me. But the average person (or even the average IT dept) does not want to open their machine to update the BIOS. Essentially your proposition comes down to 'no BIOS updates. And that has it's own problems, from a security pov and from a manufacturing recall pov.

cheese_van 5y ago
>But the average person (or even the average IT dept) does not want to open their machine to update the BIOS. I happily updated BIOS until I experienced a catastrophic failure that bricked the board, don't know how. Since then I'm terrified of updating BIOS. I've also experienced UEFI conflicts(?) loading linux to new boards that took forever to sort out. It seems BIOS development has not progressed as well or far as one might expect, but that may just be me and my klutzy bad luck.
- cesarb 5y ago
  > I happily updated BIOS until I experienced a catastrophic failure that bricked the board, don't know how. Since then I'm terrified of updating BIOS. My experience with BIOS updates has been mixed. The first time I did a BIOS update, it added an option to tell it that the HDD connection had 80 wires instead of 40 wires, which enabled a faster transfer mode. The second time I did a BIOS update (on that same machine), however, it made the realtime clock lose touch with reality, apparently running twice as fast, so I had to revert this update. That put me off from doing BIOS updates for a while. My latest laptop can be updated through LVFS (using UEFI capsule updates), and it's new and under warranty, so I decided to risk it. One of the first BIOS updates I did made, according to its release notes, an important-looking change to the battery management. Some time later, the laptop started crashing randomly (the crashes happened when the display turned off, but not every time). After a lot of searching, I found out that a later BIOS update made some unknown change which causes these crashes, unless you add "i915.enable_dc=0" to the kernel command line. For now, I'll keep risking it (at least while it's still under warranty), and hope no other obscure BIOS-update-caused bugs happen (and I'll probably keep using "i915.enable_dc=0" on this laptop forever, since there's no way to know whether a later BIOS fixed it).
derekp7 5y ago
How about this -- a jumper to update the firmware keys. System ships with third party certificate(s) (similar to the well-known certs your browser ships with). But with physical access you can update / supplement / remove keys as needed. Now that means normal users and IT depts can do all the updates they need, but if you have a need for your own private key you can do that too (after physically touching hardware). Oh and for bonus points, a motherboard switch can enable the keyboard on a physical designated USB slot to be able to authorize a cert modification. So you get convenience of not having to open the system, or if you want additional security then open the case and remove that jumper.
- phh 5y ago
  That's kinda what chromebooks do, though even better. There is a physical screw, that you can unscrew to rewrite the read-only part of firmware (which ofc contains secure boot keys)
dspillett 5y ago
Perhaps implement it as a touch button on the back plane of the motherboard rather than something completely internal? Or keep it as a jumper and leave case designers to decide where it goes, so it is just an extra thing to have a connector for like power and reset switches. For cases that don't support it, a switch could be put on an otherwise blank slot filler at the back of the case and connected the same way just like extra USB ports are (and extra serial/parallel ports used to be).
- buran77 5y ago
  Enterprises love security but they also love easy operations. Having to press a button on 15.000 computers, especially if they're laptops and people work from home can be a headache. And if you rely on the user pressing it for you then getting the same for a determined attacker like in this case is just one easy scam call away.

by ArnoVW 5y ago

cheese_van 5y ago

>But the average person (or even the average IT dept) does not want to open their machine to update the BIOS. I happily updated BIOS until I experienced a catastrophic failure that bricked the board, don't know how. Since then I'm terrified of updating BIOS. I've also experienced UEFI conflicts(?) loading linux to new boards that took forever to sort out. It seems BIOS development has not progressed as well or far as one might expect, but that may just be me and my klutzy bad luck.

cesarb 5y ago
> I happily updated BIOS until I experienced a catastrophic failure that bricked the board, don't know how. Since then I'm terrified of updating BIOS. My experience with BIOS updates has been mixed. The first time I did a BIOS update, it added an option to tell it that the HDD connection had 80 wires instead of 40 wires, which enabled a faster transfer mode. The second time I did a BIOS update (on that same machine), however, it made the realtime clock lose touch with reality, apparently running twice as fast, so I had to revert this update. That put me off from doing BIOS updates for a while. My latest laptop can be updated through LVFS (using UEFI capsule updates), and it's new and under warranty, so I decided to risk it. One of the first BIOS updates I did made, according to its release notes, an important-looking change to the battery management. Some time later, the laptop started crashing randomly (the crashes happened when the display turned off, but not every time). After a lot of searching, I found out that a later BIOS update made some unknown change which causes these crashes, unless you add "i915.enable_dc=0" to the kernel command line. For now, I'll keep risking it (at least while it's still under warranty), and hope no other obscure BIOS-update-caused bugs happen (and I'll probably keep using "i915.enable_dc=0" on this laptop forever, since there's no way to know whether a later BIOS fixed it).

derekp7 5y ago

How about this -- a jumper to update the firmware keys. System ships with third party certificate(s) (similar to the well-known certs your browser ships with). But with physical access you can update / supplement / remove keys as needed. Now that means normal users and IT depts can do all the updates they need, but if you have a need for your own private key you can do that too (after physically touching hardware). Oh and for bonus points, a motherboard switch can enable the keyboard on a physical designated USB slot to be able to authorize a cert modification. So you get convenience of not having to open the system, or if you want additional security then open the case and remove that jumper.

phh 5y ago
That's kinda what chromebooks do, though even better. There is a physical screw, that you can unscrew to rewrite the read-only part of firmware (which ofc contains secure boot keys)

dspillett 5y ago

Perhaps implement it as a touch button on the back plane of the motherboard rather than something completely internal? Or keep it as a jumper and leave case designers to decide where it goes, so it is just an extra thing to have a connector for like power and reset switches. For cases that don't support it, a switch could be put on an otherwise blank slot filler at the back of the case and connected the same way just like extra USB ports are (and extra serial/parallel ports used to be).

buran77 5y ago
Enterprises love security but they also love easy operations. Having to press a button on 15.000 computers, especially if they're laptops and people work from home can be a headache. And if you rely on the user pressing it for you then getting the same for a determined attacker like in this case is just one easy scam call away.