7 ms·
There is such a firmware setting, hence "by default". That doesn't make it acceptable - the default security settings on a general purpose PC should not prevent
by mjg59 4y ago
There is such a firmware setting, hence "by default". That doesn't make it acceptable - the default security settings on a general purpose PC should not prevent booting alternative operating systems that don't compromise the security model.
- throw1230 4y agoI think it's perfectly acceptable that a device ships with a secure default as long as it lets you override it
- mjg59 4y agoWhat's the difference in security here?
- simiones 4y agoSecure Boot ensures that it's impossible to run a rootkit, even if the user accidentally installs one. Instead of booting into corrupted Windows, the system would fail to boot.
- Avamander 4y agoThis current scenario is very likely Device Guard that limits the CA's that may be used, that it's not Secure Boot with its defaults. So the security benefit would be avoiding 3rd party and signed, but potentially vulnerable "bootloaders"
- zinekeller 4y agoIt's definitely harder, but not impossible. The Realtek signing driver was stolen multiple times already, and I personally know that certificate management practices (in Asia in general) is abysmal.
- mjg59 4y agoThe switch doesn't disable secure boot, it merely allows files signed using the Microsoft 3rd Party UEFI CA to boot. (Context: I wrote a significant portion of the infrastructure used to support Linux booting on systems with UEFI Secure Boot)
- yesbut 4y agoThat's easy. It securely sends the users data to Microsoft.
- mjg59 4y agoSome additional context: when the system boots, the secure boot key that was used is recorded into PCR 7[1] in the TPM. This means that booting an OS signed with the Windows signing key will result in a different PCR 7 value to booting an OS signed with the 3rd party signing key. If you care about which signing key was used, you can provide a secret to the TPM and ask the TPM to only release (or make use of) that secret if PCR 7 has a specific value. This means it's possible to configure an OS such that it will only be able to access its secrets if PCR 7 has the expected value. An attacker who intercepted the laptop before it was delivered to its owner could obviously subvert this by sealing the secret to the incorrect PCR 7 value, but such an attacker could also just reconfigure the firmware to trust the 3rd party CA before the owner received it. There isn't a clear description of what threat model this design is intended to protect against, or why alternative approaches weren't used to achieve the same goal. [1] Modern TPMs have 24 PCRs that can be used to measure different parts of the boot process, but the general expectation is that only 0-7 will be used by the firmware. On UEFI systems, PCR 7 contains information about what the platform's secure boot policy is, and which keys were used to verify the boot process. Booting something signed with a different key will result in PCR 7 having a different value, which is something that can be detected by tying encryption keys to specific PCR values.
- zinekeller 4y agoNo contest, but if you are actually a person who is paranoid about this but still requires to have access to Windows software (in an enterprise setting), you would actually check the UEFI and reinstall Windows. If you're actually being attacked by state-sponsored actors the risk management is so different that I don't think it can be discussed here fairly (mainly because it's a case-by-case matter).
- mattashii 4y agoI generally agree with that, but I don't think that holds for Lenovo. Wasn't it Lenovo that compromised the security of Windows by installing a keys-included general purpose root certificate?
- pmoriarty 4y agoYou could argue that Windows is the less secure default here.
- bogantech 4y ago
- rollcat 4y agoFrom TFA: > [...] the firmware defaults to not trusting bootloaders or drivers signed with the Microsoft 3rd Party UEFI CA key. The whole point of secure boot was that there is a known set of "good actors" who are trusted by default, so that you can boot 1. Windows 2. common Linux distros - without any fuss, and 3. Any other system - with a few extra steps to prove you know what you're doing. They've de-ranked the set #2 and threw it in the bag with #3, which doesn't really do much at all to improve security, but it does inconvenience and disincentivise the users from using a Linux distro on this hardware. It's most likely an honest mistake, a sign of incompetence, or a dick move. Write them an angry letter and carry on.
- iso1631 4y agoIt's interesting as Thinkpads have always been a reliable laptop for linux users - I'm typing this on linux on a t470 (my previous t410 had given up the ghost), but I bought my first thinkpad back in 2000ish, with a pcmcia wireless card.
- letmeoknmmm 4y agoReliable Linux laptops in spite of Lenovo.
- dellIsBetter 4y agonot
- Avamander 4y ago> They've de-ranked the set #2 and threw it in the bag with #3, which doesn't really do much at all to improve security, but it does inconvenience and disincentivise the users from using a Linux distro on this hardware. Well no, it's not Lenovo really, it's Microsoft and its Device Guard / Secured Core that has done so. You can disable that just as easily as you can boot from an USB stick.
- Stratoscope 4y agoSo they are protecting your ordinary everyday users, while still giving any of us who need to boot from a USB stick or another partition the ability to do that with a simple BIOS setting. It doesn't seem much different from the F12 menu that lets you select an alternate boot device. How exactly does this mean they "prevent booting alternative operating systems"?
- mjg59 4y agoHow are ordinary everyday users protected by this?
- contravariant 4y agoDepends how hard it is to change the bios setting I suppose. At this rate it prevents someone from booting in a 'malicious' OS quickly.
- mjg59 4y agoChanging the setting and booting an OS signed with the 3rd party signing key will result in a different PCR 7 measurement, which will result in the TPM refusing to release any secrets that would be required for the system to boot.
- ncmncm 4y agoBut can you password-protect the access to the setting for whether it allows booting from j random fob?
- mjg59 4y agoOh yeah absolutely. Any docs advising people to set a password for security should also advise people to set the "Trust the Microsoft 3rd Party UEFI CA" parameter appropriately.
- 4y ago
- tasuki 4y agoI'm a Linux fanboy. I don't mind having to change a thing in bios once. I care more about the standby sleep instead of S3 and other shenanigans messing my daily experience.
- Cthulhu_ 4y ago> that don't compromise the security model. Key quote here; a good practice is to never trust e.g. USB sticks.
- deleted 4y ago[deleted]
- rob_c 4y agoThen there is no story and this is just stiring up the community.
- pjmlp 4y agoWhich only became such because IBM failed to stand in court against Compaq.
- otabdeveloper4 4y agoI've never had a computer in the last 10 years that didn't have the "secure boot only Windows" setting on by default. What's the news here?