4 ms·

> when I say "trustworthy", it is very easy to interpret this in a cynical manner and assume that "trust" means "trusted by someone I do not necessarily trust t

> when I say "trustworthy", it is very easy to interpret this in a cynical manner and assume that "trust" means "trusted by someone I do not necessarily trust to act in my best interest". I want to be absolutely clear that when I say "trustworthy" I mean "trusted by the owner of the computer" [...] > Of course, simply measuring the fact that verified boot was enabled isn't enough - what if someone replaces the CPU with one that has verified boot enabled, but trusts keys under their control? We also need to measure the keys that were used The motivation for this stuff has always seemed pretty weird to me. Out of the box, secure boot means your PC only boots things signed by Microsoft. Microsoft has deigned to sign a 'shim' which lets you boot Linux - so long as your kernel is signed by a vendor with Microsoft's blessing, like Canonical. Otherwise, you've got to go into the BIOS and disable Secure Boot - or enrol your own MOK, a similarly manual process, with similar security impact. I get why this stuff is useful for big corporations making TiVo-ized products, wanting to lock out the device owners. For them, I get that this tech is great. But if you're a human being - this seems like a whole lot of hassle to... protect against evildoers breaking into your hotel room and replacing your CPU?

hardware2win 3y ago
A lot of hassle?
mschuster91 3y ago
> But if you're a human being - this seems like a whole lot of hassle to... protect against evildoers breaking into your hotel room and replacing your CPU? Secure Boot - if done right - also prevents malware that gains root access by whatever mechanism of privilege escalation from persisting within the kernel address space. Another, more ethically questionable requirement is RF laws. Basically some jurisdictions require as part of certification criteria that a transmission-capable device be protected against someone overriding legal limitations for frequency bands or transmission strengths. There's no way out for device manufacturers other than a complete chain of trust including a trusted way to provide a location (to prevent the user from setting a location with higher transmission limits).
- electroly 3y ago
  > RF laws ... There's no way out for device manufacturers other than a complete chain of trust ... You make the baseband processor physically separate from the app processor and run it off of firmware that the application processor can't reflash. All phones do this. Then it doesn't matter what boots up on the app processor, and only the baseband processor has to be certified. Nobody is trying to obey RF laws using Secure Boot on the application processor. There are other reasons for Secure Boot on the AP but this isn't one of them.
  - immibis 3y ago
    There are more laws than RF laws, anyway. Why don't we trust application processors to obey RF laws, but we trust them to obey copyright laws and port scanning laws?
    - electroly 3y ago
      RF laws have teeth and enforcement and the other laws don't. You get in actual trouble if your device violates FCC broadcast regulations, and you have to get your device certified before you're allowed to sell it. There's no law that gets you, the device manufacturer, in trouble if someone hacks your device and gets it to port scan or violate copyright, and no mandatory certification that those things are impossible on your device. Hell, you won't even get in trouble for doing the copyright infringement yourself (e.g. GPL violations). Ditto for literally shipping app-side malware from the factory (e.g. sketchy Chinese phones).
      - gary_0 3y ago
        Also, knowing whether copyright or the CFAA has been violated might require a lengthy court case between the accused and the purported legitimate owner. RF violations are an FCC guy with an antenna telling you to cut it out. Everything is explicitly licensed by the Feds ahead of time, copyright and computer access usually isn't.
  - mschuster91 3y ago
nonameiguess 3y ago
The use cases for this should largely not be considered individual users. Presumably, a lot, if not most, personal computing devices, and certainly enterprise-grade networking equipment, is owned by companies that either 1) issue equipment directly to users who are not necessarily trusted, or 2) put it out somewhere where it might be accessible to untrusted individuals. Probably the most obvious example is something like WiFi access points for shops and hotels, which are often just sitting in a hallway mounted to the ceiling where anybody can get to them. I guess from the perspective of laptop and desktop PC makers who primarily ship devices with Windows preinstalled, they just don't want to bother with separate product lines for business versus personal use. For what it's worth, I can't speak to what is common versus not without real data, but at least from my own perspective, every non-laptop PC I have in my house is a machine I built myself from parts, and no motherboard I have ever purchased came with secure boot enabled by default. This is separate, of course, from Microsoft's decision to make Windows 11 only run on devices with a TPM.
JohnFen 3y ago
I just turn all that stuff off in the BIOS and be done with it. So far, anyway, I haven't encountered a motherboard that doesn't let me disable it.

hardware2win 3y ago

A lot of hassle?

mschuster91 3y ago

> But if you're a human being - this seems like a whole lot of hassle to... protect against evildoers breaking into your hotel room and replacing your CPU? Secure Boot - if done right - also prevents malware that gains root access by whatever mechanism of privilege escalation from persisting within the kernel address space. Another, more ethically questionable requirement is RF laws. Basically some jurisdictions require as part of certification criteria that a transmission-capable device be protected against someone overriding legal limitations for frequency bands or transmission strengths. There's no way out for device manufacturers other than a complete chain of trust including a trusted way to provide a location (to prevent the user from setting a location with higher transmission limits).

electroly 3y ago
> RF laws ... There's no way out for device manufacturers other than a complete chain of trust ... You make the baseband processor physically separate from the app processor and run it off of firmware that the application processor can't reflash. All phones do this. Then it doesn't matter what boots up on the app processor, and only the baseband processor has to be certified. Nobody is trying to obey RF laws using Secure Boot on the application processor. There are other reasons for Secure Boot on the AP but this isn't one of them.
- immibis 3y ago
  There are more laws than RF laws, anyway. Why don't we trust application processors to obey RF laws, but we trust them to obey copyright laws and port scanning laws?
  - electroly 3y ago
    RF laws have teeth and enforcement and the other laws don't. You get in actual trouble if your device violates FCC broadcast regulations, and you have to get your device certified before you're allowed to sell it. There's no law that gets you, the device manufacturer, in trouble if someone hacks your device and gets it to port scan or violate copyright, and no mandatory certification that those things are impossible on your device. Hell, you won't even get in trouble for doing the copyright infringement yourself (e.g. GPL violations). Ditto for literally shipping app-side malware from the factory (e.g. sketchy Chinese phones).
    - gary_0 3y ago
      Also, knowing whether copyright or the CFAA has been violated might require a lengthy court case between the accused and the purported legitimate owner. RF violations are an FCC guy with an antenna telling you to cut it out. Everything is explicitly licensed by the Feds ahead of time, copyright and computer access usually isn't.
- mschuster91 3y ago

nonameiguess 3y ago

The use cases for this should largely not be considered individual users. Presumably, a lot, if not most, personal computing devices, and certainly enterprise-grade networking equipment, is owned by companies that either 1) issue equipment directly to users who are not necessarily trusted, or 2) put it out somewhere where it might be accessible to untrusted individuals. Probably the most obvious example is something like WiFi access points for shops and hotels, which are often just sitting in a hallway mounted to the ceiling where anybody can get to them. I guess from the perspective of laptop and desktop PC makers who primarily ship devices with Windows preinstalled, they just don't want to bother with separate product lines for business versus personal use. For what it's worth, I can't speak to what is common versus not without real data, but at least from my own perspective, every non-laptop PC I have in my house is a machine I built myself from parts, and no motherboard I have ever purchased came with secure boot enabled by default. This is separate, of course, from Microsoft's decision to make Windows 11 only run on devices with a TPM.

JohnFen 3y ago

I just turn all that stuff off in the BIOS and be done with it. So far, anyway, I haven't encountered a motherboard that doesn't let me disable it.