4 ms·
How are ordinary everyday users protected by this?
by mjg59 4y ago
How are ordinary everyday users protected by this?
- contravariant 4y agoDepends how hard it is to change the bios setting I suppose. At this rate it prevents someone from booting in a 'malicious' OS quickly.
- mjg59 4y agoChanging the setting and booting an OS signed with the 3rd party signing key will result in a different PCR 7 measurement, which will result in the TPM refusing to release any secrets that would be required for the system to boot.
- ncmncm 4y agoBut can you password-protect the access to the setting for whether it allows booting from j random fob?
- Avamander 4y agoAnyone enabling BitLocker or any FDE really, should know to back up their recovery key so that they can access their data, should automatic unlocking fail.
- contravariant 4y agoWell yeah, but you asked about ordinary everyday users. And the best I can come up with is that it's marginally harder to load a foreign OS and access an unencrypted drive. You can't just plug in a USB stick and power cycle the thing. Though I'm not sure if it's worth it, especially not if changing the bios is just a matter of seconds anyway (ordinary users probably won't put a password on it).
- mjg59 4y agoWindows enables TPM-backed Bitlocker by default on initial boot these days.
- AshamedCaptain 4y agoAnd most OEMs have enabled/pre-provisioned it by default for almost a decade, since Windows 8 times.
- Jenk 4y agoBecause now a random fob jammed into your laptop won't be loaded on boot without the explicit choice to load it. This is defense-in-depth level stuff.
- vetinari 4y agoIt cannot be a random fob; it has to be a fob signed by Microsoft's 3rd Party UEFI CA key. They do not sign everything nilly-willy; they refused to sign grub, that's why linux distros use shim.efi.
- laumars 4y agoThat's the point the GP was making
- vetinari 4y agoThen he did it wrong, because the point of the article is that systems signed with exactly this key are not trusted anymore. Only different key is trusted, and that key is used to sign Windows only and nothing else.
- laumars 4y agoYes, we all already understand the context. One could argue that distrusting platforms signed with MS's 3rd party certificate offers marginal additional security but that doesn't contradict the original point made about defence in depth.