3 ms·
Consider using Heads with TPM and Librem Key to detect possible compromise of your boot stage. It doesn't obey MS but you.
by fsflover 1y ago
Consider using Heads with TPM and Librem Key to detect possible compromise of your boot stage. It doesn't obey MS but you.
- flexagoon 1y agoWith Heads, the firmware measures itself and sends the results to the TPM. If an attacker flashes a modified firmware that simply lies about the measurement results, the entire security system will be bypassed.
- fsflover 1y agoThis is not true: https://forum.qubes-os.org/t/discussion-on-purism/2627/187 https://forum.qubes-os.org/t/discussion-on-purism/2627/187 https://forum.qubes-os.org/t/discussion-on-purism/2627/177 https://forum.qubes-os.org/t/discussion-on-purism/2627/177
- froh 1y agothat's still secure boot, isn't it? just not uefi but homegrown? fine with me. I read GP as rejecting the whole idea. to point at another elephant in the room: at some point I came to realize that the ME is a x468 running some BSD. that little bitch has full access to your machine. if trust and security is the objective, we're in for a hard ride to find trustworthy hardware.
- fsflover 1y agoME is disabled and neutralized on my Librem 15: https://puri.sm/learn/intel-me/ https://puri.sm/learn/intel-me/