4 ms·

So is there any reason for secure boot to exist, other than to make it harder to boot an operating system other than Windows? I am all for verified boot (like i

So is there any reason for secure boot to exist, other than to make it harder to boot an operating system other than Windows? I am all for verified boot (like implemented on some smartphones like Pixels), but UEFI secure boot doesn't seem particularly useful to me.

gruez 4y ago
In theory it would make bootkits (ie. malware that installs themselves as the bootloader, thereby being able to compromise/remain undetected for every subsequent step) harder to pull off. It's not part of my threat model though, because if malware made it onto my machine I'd be doing a full wipe. Also, this xkcd is pertinent: https://xkcd.com/1200/ https://xkcd.com/1200/
- tormeh 4y ago
  > Also, this xkcd is pertinent: https://xkcd.com/1200/ https://xkcd.com/1200/ Pretty much. The mainframe security model used by desktop OSes is fundamentally broken.
- pilif 4y ago
  The type of malware secure boot protects against can be made completely undetectable by the running OS and can be made to persist a full wipe.
  - gruez 4y ago
    >and can be made to persist a full wipe. Are you confusing a bootkit (ie. malware that's in the boot loader) with malware that's in the firmware itself? If it's just in the boot loader, that's still stored on the hdd/ssd itself, and therefore can be wiped.
    - pilif 4y ago
      I said "can be made to persist" and I meant, yes, that the malware could be compromising the firmware. And by "can" I implied that not all of it does, but the possibility of it doing it does exist. Secure boot is indeed designed to protect against bootkits too.
Koom88 4y ago
It's part of killing plaintext exe's, Secure boot is anti piracy tech they are killing win32/Dos16 EXE model that enabled mass piracy, it's all about anti-piracy you can read about it here: https://www.cl.cam.ac.uk/~rja14/tcpa-faq.html https://www.cl.cam.ac.uk/~rja14/tcpa-faq.html https://www.notcpa.org/about.html https://www.notcpa.org/about.html Windows 11 and TPM are about locking down the PC and turning it into a mobile device. What do you think MMO's and steam were for the last 23 years? There's been a war on local exe's and your file system, driver signing in hte windows 2000 and XP days was Microsoft and hardware vendors working out the bugs of moving us to encrpyted input output. They are selling it as "trusted computing" but its all for enforcing software licenses so you can't access the files. That's what NTFS was for in reality, it was about the return of mainframe computing, that's why windows 10/11 is a client-server OS and why windows 10 has forced updates. The whole thing is to turn the PC into a console where app developers can update the firmware/bios with new encrpytion keys if the exe's get cracked. That was the whole point of Secure boot, it was first used in consoles and the same tech in phones. Apple, google, and the entire industry has wanted to kill piracy and enforce copyright ruthlessy. Ever notice the rental ad on Youtube? Google would like to turn files into bits of property you can sell via encrpytion and can't accesss. The big lockdown is coming because they saw the profits of locked down computing devices. So no Secure boot is about killing Win32 EXE's and moving us to win 3, with Denuo levels of protection on executables. With Trusted computing microsoft can force update security policy over all EXE's with the new exectuable model and the mmo/steam generaiton enabled all this over the last 23+ years starting from 1997 with ultima online and everquest in 1999. That's why basic features like multiplayer game hosting inside local apps (like quake 3 and Unreal tournament 2004) disappeared. The whole point was to move us back to mainframe computing of the 60's with draconian copyright enforcement.
joerichey 4y ago
One thing that makes Secure Boot nice is how it (in theory) works _with_ measured boot. You get a measurement into the TPM that contains the public signing key that was used to verify the signature on your bootloader. This means if you update from one signed bootloader to a newer signed bootloader, you don't need to change any disk encryption or sealing. Of course blocking execution is orthogonal to verifying the boot chain, but unfortunately those issues are conflated in the UEFI spec.
somat 4y ago
The fundamental problem is that someone somewhere decided that setting up signing keys was too hard, and that because of this the manufacturer should be in charge of setting up the keys. so now instead of you owning your hardware and setting up the keys on first boot, Microsoft owns your hardware and the keys are theirs. And in a case of self fulfilling prophecy, because they decided that initializing and owning your own keys was not going to be a normal part of the user experience, it is now hard(almost impossible) to do. If instead the decision had been made to have the user set up some keys and authorize the OS, the process would have to be streamlined and easy. In conclusion, signing your operating system is too hard, unless you are in the happy path where your OS is signed by Microsoft it is far easier to just disable the infernal subsystem as it gets in the way.
- Foxboron 4y ago
  > And in a case of self fulfilling prophecy, because they decided that initializing and owning your own keys was not going to be a normal part of the user experience, it is now hard(almost impossible) to do. This is false. The issue is that nobody has written user-friendly tooling to manage keys and sign stuff. Not that actually implementing this is hard. https://github.com/Foxboron/sbctl https://github.com/Foxboron/sbctl
  - somat 4y ago
    Oh wow, very cool, now I am going to have to try and install my own keys again.

gruez 4y ago

In theory it would make bootkits (ie. malware that installs themselves as the bootloader, thereby being able to compromise/remain undetected for every subsequent step) harder to pull off. It's not part of my threat model though, because if malware made it onto my machine I'd be doing a full wipe. Also, this xkcd is pertinent: https://xkcd.com/1200/ https://xkcd.com/1200/

tormeh 4y ago
> Also, this xkcd is pertinent: https://xkcd.com/1200/ https://xkcd.com/1200/ Pretty much. The mainframe security model used by desktop OSes is fundamentally broken.
pilif 4y ago
The type of malware secure boot protects against can be made completely undetectable by the running OS and can be made to persist a full wipe.
- gruez 4y ago
  >and can be made to persist a full wipe. Are you confusing a bootkit (ie. malware that's in the boot loader) with malware that's in the firmware itself? If it's just in the boot loader, that's still stored on the hdd/ssd itself, and therefore can be wiped.
  - pilif 4y ago
    I said "can be made to persist" and I meant, yes, that the malware could be compromising the firmware. And by "can" I implied that not all of it does, but the possibility of it doing it does exist. Secure boot is indeed designed to protect against bootkits too.

Koom88 4y ago

It's part of killing plaintext exe's, Secure boot is anti piracy tech they are killing win32/Dos16 EXE model that enabled mass piracy, it's all about anti-piracy you can read about it here: https://www.cl.cam.ac.uk/~rja14/tcpa-faq.html https://www.cl.cam.ac.uk/~rja14/tcpa-faq.html https://www.notcpa.org/about.html https://www.notcpa.org/about.html Windows 11 and TPM are about locking down the PC and turning it into a mobile device. What do you think MMO's and steam were for the last 23 years? There's been a war on local exe's and your file system, driver signing in hte windows 2000 and XP days was Microsoft and hardware vendors working out the bugs of moving us to encrpyted input output. They are selling it as "trusted computing" but its all for enforcing software licenses so you can't access the files. That's what NTFS was for in reality, it was about the return of mainframe computing, that's why windows 10/11 is a client-server OS and why windows 10 has forced updates. The whole thing is to turn the PC into a console where app developers can update the firmware/bios with new encrpytion keys if the exe's get cracked. That was the whole point of Secure boot, it was first used in consoles and the same tech in phones. Apple, google, and the entire industry has wanted to kill piracy and enforce copyright ruthlessy. Ever notice the rental ad on Youtube? Google would like to turn files into bits of property you can sell via encrpytion and can't accesss. The big lockdown is coming because they saw the profits of locked down computing devices. So no Secure boot is about killing Win32 EXE's and moving us to win 3, with Denuo levels of protection on executables. With Trusted computing microsoft can force update security policy over all EXE's with the new exectuable model and the mmo/steam generaiton enabled all this over the last 23+ years starting from 1997 with ultima online and everquest in 1999. That's why basic features like multiplayer game hosting inside local apps (like quake 3 and Unreal tournament 2004) disappeared. The whole point was to move us back to mainframe computing of the 60's with draconian copyright enforcement.

joerichey 4y ago

One thing that makes Secure Boot nice is how it (in theory) works _with_ measured boot. You get a measurement into the TPM that contains the public signing key that was used to verify the signature on your bootloader. This means if you update from one signed bootloader to a newer signed bootloader, you don't need to change any disk encryption or sealing. Of course blocking execution is orthogonal to verifying the boot chain, but unfortunately those issues are conflated in the UEFI spec.

somat 4y ago

The fundamental problem is that someone somewhere decided that setting up signing keys was too hard, and that because of this the manufacturer should be in charge of setting up the keys. so now instead of you owning your hardware and setting up the keys on first boot, Microsoft owns your hardware and the keys are theirs. And in a case of self fulfilling prophecy, because they decided that initializing and owning your own keys was not going to be a normal part of the user experience, it is now hard(almost impossible) to do. If instead the decision had been made to have the user set up some keys and authorize the OS, the process would have to be streamlined and easy. In conclusion, signing your operating system is too hard, unless you are in the happy path where your OS is signed by Microsoft it is far easier to just disable the infernal subsystem as it gets in the way.

Foxboron 4y ago
> And in a case of self fulfilling prophecy, because they decided that initializing and owning your own keys was not going to be a normal part of the user experience, it is now hard(almost impossible) to do. This is false. The issue is that nobody has written user-friendly tooling to manage keys and sign stuff. Not that actually implementing this is hard. https://github.com/Foxboron/sbctl https://github.com/Foxboron/sbctl
- somat 4y ago
  Oh wow, very cool, now I am going to have to try and install my own keys again.