7 ms·
So they are protecting your ordinary everyday users, while still giving any of us who need to boot from a USB stick or another partition the ability to do that
by Stratoscope 4y ago
So they are protecting your ordinary everyday users, while still giving any of us who need to boot from a USB stick or another partition the ability to do that with a simple BIOS setting.
It doesn't seem much different from the F12 menu that lets you select an alternate boot device.
How exactly does this mean they "prevent booting alternative operating systems"?
- mjg59 4y agoHow are ordinary everyday users protected by this?
- contravariant 4y agoDepends how hard it is to change the bios setting I suppose. At this rate it prevents someone from booting in a 'malicious' OS quickly.
- mjg59 4y agoChanging the setting and booting an OS signed with the 3rd party signing key will result in a different PCR 7 measurement, which will result in the TPM refusing to release any secrets that would be required for the system to boot.
- ncmncm 4y agoBut can you password-protect the access to the setting for whether it allows booting from j random fob?
- Avamander 4y agoAnyone enabling BitLocker or any FDE really, should know to back up their recovery key so that they can access their data, should automatic unlocking fail.
- contravariant 4y agoWell yeah, but you asked about ordinary everyday users. And the best I can come up with is that it's marginally harder to load a foreign OS and access an unencrypted drive. You can't just plug in a USB stick and power cycle the thing. Though I'm not sure if it's worth it, especially not if changing the bios is just a matter of seconds anyway (ordinary users probably won't put a password on it).
- mjg59 4y agoWindows enables TPM-backed Bitlocker by default on initial boot these days.
- AshamedCaptain 4y agoAnd most OEMs have enabled/pre-provisioned it by default for almost a decade, since Windows 8 times.
- Jenk 4y agoBecause now a random fob jammed into your laptop won't be loaded on boot without the explicit choice to load it. This is defense-in-depth level stuff.
- vetinari 4y agoIt cannot be a random fob; it has to be a fob signed by Microsoft's 3rd Party UEFI CA key. They do not sign everything nilly-willy; they refused to sign grub, that's why linux distros use shim.efi.
- laumars 4y agoThat's the point the GP was making
- vetinari 4y agoThen he did it wrong, because the point of the article is that systems signed with exactly this key are not trusted anymore. Only different key is trusted, and that key is used to sign Windows only and nothing else.
- laumars 4y agoYes, we all already understand the context. One could argue that distrusting platforms signed with MS's 3rd party certificate offers marginal additional security but that doesn't contradict the original point made about defence in depth.
- raxxorraxor 4y agoNo "ordinary" user was ever compromised by accidentally installing Linux making his computing less safe. This is complete fantasy. Of course this is a mechanism to further advertise locking down general computing and nothing else. It is not new and security is a bad excuse.
- Avamander 4y ago> No "ordinary" user was ever compromised by accidentally installing Linux making his computing less safe. This is complete fantasy. That's incorrect. There is malware out there that can only work if you don't have Secure Boot enabled. The setting OP didn't disable, Device Guard, prevents the abuse of 3rd party signed bootloaders, another attack vector basically. This is a step up for most people that ever stay on Windows and doesn't affect the slightest someone who wants to install Linux, they still have to boot from an external device or wish to change a few UEFI settings. > Of course this is a mechanism to further advertise locking down general computing and nothing else. It is not new and security is a bad excuse. Framing Secure Boot as some kind of Secure Boogeyman is not conducive, brings the discussion into tinfoil scenarios without any potential practical outcome (nobody is going to remove SB or DG). As long as Linux vendors or people can get or enroll their own keys and disable any potential presets, it's a step up in security for everyone.
- mjg59 4y agoCould you please describe the attack vector that permitting third party boot loaders allows?
- vetinari 4y ago"Protecting" exactly how? Giving the user more hops to jump through, when they want to try alternate (signed!) operating systems? Like, you have nice encrypted disk here, are you willing to lose it, when you flip the setting?
- peoplefromibiza 4y agocomputers should never boot by default from USB sticks or external storage in general. it's a very dangerous attack vector. EDIT: writing from a Lenovo laptop where Linux it's the sole OS installed. Allowing Linux to boot was a hundred times simpler than allowing DOOM to run on my 486 with 4MB of RAM.
- vetinari 4y agoHow is it a dangerous attack vector? The signature is checked anyway, so it does not matter where the binary came from. And you need that for recovery purposes, at least.
- peoplefromibiza 4y ago> How is it a dangerous attack vector? The signature could come from a stolen certificate or a malevolent actor (are we sure the famous three letter agency has no way of signing binaries?). Not trusting external and/or removable storage as a valid bootable source is a sensible default. p.s. writing from a Lenovo laptop where Linux it's the sole OS installed.
- vetinari 4y agoSo they steal different certificate from the same subject instead? (Both CAs are Microsoft's, and only Microsoft is signing). The default for years was to boot from external storage, when the internal is not bootable. To change it, you would have to change boot priorities or manually use the built-in boot selector.
- 4y ago