> Shouldn't this be an non-issue in any sane setup (ie. secureboot + TPM + FDE)? A sane setup might not be using TPM because, e.g.: they don't need it. I don'

> Shouldn't this be an non-issue in any sane setup (ie. secureboot + TPM + FDE)? A sane setup might not be using TPM because, e.g.: they don't need it. I don't use TPM for FDE, just a passphrase. Using TPM means that if my motherboard dies, I can no longer access my disk. Far from ideal. > a bad guy could easily disable secureboot inside bios settings Can this be usually reconfigured without the firmware passphrase? > use shim loader to bypass it. They'd need to get it signed with the key trusted by the local firmware.