4 ms·

My problem with the position of the "MS is bad" crowd here is that the security reasons are outright dismissed. It's even in the article: > The second is that

by sgift 4y ago

My problem with the position of the "MS is bad" crowd here is that the security reasons are outright dismissed. It's even in the article: > The second is that this is predicated on the idea that removing the third-party bootloaders and drivers removes all the vulnerabilities. In fact, there's been rather a lot of vulnerabilities in the Windows bootloader. A broad enough vulnerability in the Windows bootloader is arguably a lot worse than a vulnerability in a third-party loader, since it won't change the PCR 7 measurements and the system will boot happily. Removing trust in the third-party CA does nothing to protect against this. Why is it 'all'? Why not 'some' vulnerabilities? Because then it's rather obvious that having one less bootloader allowed by default means less potential for vulnerabilities. And then the whole point breaks down.

AshamedCaptain 4y ago
> Because then it's rather obvious that having one less bootloader allowed by default means less potential for vulnerabilities. Even if this was true, the fact that this defaults to having the MS signature enabled by default (and the other signatures have to enabled manually) should already make any security-oriented person shiver extensively, considering MS's vulnerability record. At least, it is clearly an (anti-)trust issue, which is already grounds to dismiss the entire idea. Second, the fact that it may reduce the attack surface by an infinitesimal amount, and not even in paper (since the attack surface is still theoretically the same), is really an argument for it? By the same logic, I can always argue for having 40+-character length passwords and other rather dubious practices, which by definition also improve security -- and these ones at least do so on paper. It's just that security people already know that this infinitesimal improvement just does not warrant the other can of worms that such an approach opens, i.e. it is not worth the trade-off. And third, there are better ways to reduce the attack surface to an even lower level; ways that do not put a single vendor in control of the security of the entire ecosystem. Claiming "this is one way, we should do it!" is textbook politician's fallacy. I will note that this crap hasn't worked for Apple when arguing why they should remain an steward of the entire Apple software ecosystem , and it shouldn't work for MS, either.
ahartmetz 4y ago
Bootloader attacks are neither common, nor does it seem likely that "secure boot" keeps out a really determined attacker. Why spend so much effort on such a relatively useless feature unless there is another reason for it?
- Avamander 4y ago
  > Why spend so much effort on such a relatively useless feature unless there is another reason for it? Because it's not only Secure Boot really. It's just one part of a larger set of firmware hardening methods called Device Guard (since 2016), which is also a part of Secured Core. (which was mentioned in the article). > Bootloader attacks are neither common, nor does it seem likely that "secure boot" keeps out a really determined attacker. Because an increasing amount of PC's have Secure Boot enabled and few attacks really are conducted by a "really determined attacker".
  - ahartmetz 4y ago
    > Because an increasing amount of PC's have Secure Boot enabled and few attacks really are conducted by a "really determined attacker". But these few attacks are the only ones against which "secure boot" might help, and it probably doesn't. Bootloader attacks were extremely rare to nonexistent even before "secure boot".
    - cesarb 4y ago
      > Bootloader attacks were extremely rare to nonexistent even before "secure boot". Playing devil's advocate: boot sector viruses were common back then. Secure Boot completely avoids both them and their UEFI equivalent, which is probably why we don't see them anymore.
      - Avamander 4y ago
        It's not really devil's advocate. It's no longer trivial and is increasingly less so, for random malware that has acquired high privileges to compromise the entire boot sequence.
pdonis 4y ago
> it's rather obvious that having one less bootloader allowed by default means less potential for vulnerabilities. Ok, so why not allow me to remove the Windows bootloader and just have the third party one that I trust more?
- Joker_vD 4y ago
  Because Microsoft doesn't trust it more, and they know better what's good for you.

by sgift 4y ago

AshamedCaptain 4y ago

> Because then it's rather obvious that having one less bootloader allowed by default means less potential for vulnerabilities. Even if this was true, the fact that this defaults to having the MS signature enabled by default (and the other signatures have to enabled manually) should already make any security-oriented person shiver extensively, considering MS's vulnerability record. At least, it is clearly an (anti-)trust issue, which is already grounds to dismiss the entire idea. Second, the fact that it may reduce the attack surface by an infinitesimal amount, and not even in paper (since the attack surface is still theoretically the same), is really an argument for it? By the same logic, I can always argue for having 40+-character length passwords and other rather dubious practices, which by definition also improve security -- and these ones at least do so on paper. It's just that security people already know that this infinitesimal improvement just does not warrant the other can of worms that such an approach opens, i.e. it is not worth the trade-off. And third, there are better ways to reduce the attack surface to an even lower level; ways that do not put a single vendor in control of the security of the entire ecosystem. Claiming "this is one way, we should do it!" is textbook politician's fallacy. I will note that this crap hasn't worked for Apple when arguing why they should remain an steward of the entire Apple software ecosystem , and it shouldn't work for MS, either.

ahartmetz 4y ago

Bootloader attacks are neither common, nor does it seem likely that "secure boot" keeps out a really determined attacker. Why spend so much effort on such a relatively useless feature unless there is another reason for it?

Avamander 4y ago
> Why spend so much effort on such a relatively useless feature unless there is another reason for it? Because it's not only Secure Boot really. It's just one part of a larger set of firmware hardening methods called Device Guard (since 2016), which is also a part of Secured Core. (which was mentioned in the article). > Bootloader attacks are neither common, nor does it seem likely that "secure boot" keeps out a really determined attacker. Because an increasing amount of PC's have Secure Boot enabled and few attacks really are conducted by a "really determined attacker".
- ahartmetz 4y ago
  > Because an increasing amount of PC's have Secure Boot enabled and few attacks really are conducted by a "really determined attacker". But these few attacks are the only ones against which "secure boot" might help, and it probably doesn't. Bootloader attacks were extremely rare to nonexistent even before "secure boot".
  - cesarb 4y ago
    > Bootloader attacks were extremely rare to nonexistent even before "secure boot". Playing devil's advocate: boot sector viruses were common back then. Secure Boot completely avoids both them and their UEFI equivalent, which is probably why we don't see them anymore.
    - Avamander 4y ago
      It's not really devil's advocate. It's no longer trivial and is increasingly less so, for random malware that has acquired high privileges to compromise the entire boot sequence.

pdonis 4y ago

> it's rather obvious that having one less bootloader allowed by default means less potential for vulnerabilities. Ok, so why not allow me to remove the Windows bootloader and just have the third party one that I trust more?

Joker_vD 4y ago
Because Microsoft doesn't trust it more, and they know better what's good for you.