4 ms·
It's sad, because they did some cool things with SecureBoot on X64: you can install your own keys and sign your Linux payloads to prevent an evil maid attack us
by csdvrx 3y ago
It's sad, because they did some cool things with SecureBoot on X64: you can install your own keys and sign your Linux payloads to prevent an evil maid attack using a default Windows thumbdrive signed with Microsoft keys
And I don't mean just the old/BlackLotus affected ones: you have full control of what you allow your system to run.
Compare that with BootGuard which doesn't let you patch your Bios, like you'd want to do to fix PE32 modules :(
- hakfoo 3y agoFor systems where there's a real fear of physical compromise, you'd think there would be more physical mitigations. The crypto stuff is nice, but I feel like it's difficult to package in a way that non-technical audiences will understand it and not shoot their foot off somehow. I feel like PCs where the storage can be pulled like a video game cartridge would reduce the threat surface, while avoiding a lot of the crypto risk (lost keys, broken TPMs)