2 ms·

> Microsoft can get around this problem because their root keys are preloaded into almost every secure boot capable device you can find. They can pre-sign a boo

> Microsoft can get around this problem because their root keys are preloaded into almost every secure boot capable device you can find. They can pre-sign a bootloader and distribute it to hundreds of millions of computers, whereas every Linux distro has to jump through hoops and use the Microsoft-signed loader as an inbetween stage or have the user set up their own keys and signature system. But then, they can also (technically) sign a bogus bootloader if asked nice-enough, like by a state agency. > On Linux, there is a wide variety of tools, but as far as I can tell, you can only choose between "unlock the disk from the TPM" or "unlock the disk with your passphrase". You can also have TPM + PIN since a few versions of systemd ago. I have set this up on my work laptop and seems to work well enough.

jeroenhd 4y ago
> But then, they can also (technically) sign a bogus bootloader if asked nice-enough, like by a state agency. Definitely! However, the chance of them doing that is relatively small and the usability problem is a lot bigger than the risk of falling victim of an NSA red letter order. > You can also have TPM + PIN since a few versions of systemd ago. I have set this up on my work laptop and seems to work well enough. That's great! Do you happen to know a guide on how to set that up? The guides I can find use TPM to auto-unlock OR provide a PIN/password.
- vladvasiliu 4y ago
  > Do you happen to know a guide on how to set that up? Here's the Arch Wiki, but since this depends on systemd, it should be universal. The man page of systemd-cryptenroll is actually quite helpful. https://wiki.archlinux.org/title/Trusted_Platform_Module#systemd-cryptenroll https://wiki.archlinux.org/title/Trusted_Platform_Module#sys...