4 ms·
I haven’t done any serious admin work on Windows machines for over a decade. Few weeks ago I went to reinstall Windows on a Dell desktop… I had no idea about Se
by themagician 3y ago
I haven’t done any serious admin work on Windows machines for over a decade. Few weeks ago I went to reinstall Windows on a Dell desktop… I had no idea about SecureBoot. I spent hours trying to figure out what was wrong and learning about SecureBoot and Intel RAID drivers necessary to reinstall Windows.
- luma 3y agoSecureBoot isn’t just for windows and it’s a damn nice feature for securing workloads in the datacenter.
- vaylian 3y agoWhat is the threat model that this protects against?
- pricci 3y agoSomeone booting something on your computer without you consent. You can add your own keys and sign the bootloaders of your OSs/LiveCDs/Thumbdrives
- tryauuum 3y agoDo you use it in datacenter? Sounds like a huge investment of time with no reason E.g. if we want to protect from a datacenter employee plugging his usb stick with ubuntu and booting it on our server. We can probably solve it with UEFI with removing default keys and adding them for our OS. (Have never tried it so might be wrong). Also we need to set a BIOS password so that the attacker doesn't simply disable secure boot. This works, but the attacker can just remove BIOS password -- remember, he has physical access. It's for sure harder for him than plugging a usb stick. But if he anyway willing to risk and illegally mess with a customer's server while being monitored with cameras I think he would do it. Something feels off about all of this
- luma 3y agoYou’re thinking in terms of encryption, I’m thinking in terms of attestation. Eg, defend against root kits by way of validating all software components in the boot cycle.