3 ms·

> After all, at that point someone could just take your hard drive anyway right? With full-disk encryption, taking the hard drive is not that useful. Firmware

by zokier 3y ago

> After all, at that point someone could just take your hard drive anyway right? With full-disk encryption, taking the hard drive is not that useful. Firmware passwords are one link in securing the boot chain; secure boot is meaningless if attacker can just modify firmware or its config. So the password should offer protection against evil maid style attacks.

willis936 3y ago
I'm not sure why this would be the case. Secret keys never leave security processors or data drives. The BIOS does very little here.
- zokier 3y ago
  From firmware config you can potentially enroll new keys, or just disable sb completely, both which enable injecting malicious code in the boot chain
  - willis936 3y ago
    When changing security processors the secure boot drive requires the entry of the secret key again. If a user enters the secret key on a compromised system then the game would be up. You would need to wait until the user decided to change the security processor to intercept quietly.