7 ms·
Secure boot certificate rollover is real but probably won't hurt you
- fennec-posix 1y agoyeah, that sounds about right for UEFI
- M95D 1y ago> [...] systems that only trust the new certificate and not the old one would refuse to boot older Linux, wouldn't support old graphics cards, and also wouldn't boot old versions of Windows. Nobody wants that [...] EVERYBODY wants that! And I mean ABSOLUTELY EVERYBODY! Updates are now mandatory everywhere, in both Windows and Linux, and GPU manufactureres would LOVE to make the old cards obsolete, even if technically the new cards aren't much better. So expect to see the old certificate invalidated quickly and automatically, in the name of security, of course!
- michaelt 1y agoEven if this did happen, there's a trivial workaround available: Just go into your BIOS and switch 'Secure Boot' off. Secure Boot is a fine thing if you're a huge corporation and want to harden laptops against untrustworthy employees, or you've got such a huge fleet of servers they go missing despite your physical security controls, or you're making a TiVo style product you want to harden against the device owners. But when the user is the device owner? Doesn't do much.
- trelane 1y ago> you're making a TiVo style product you want to harden against the device owners. This sentence just makes me so sad
- observationist 1y agoThis should be illegal, and anyone caught doing it fined twice the total cost of amortized ownership per each device owner over the total duration of ownership in addition to completely refunding every customer. Throw in jail time for decision makers. Lets make markets honest with real incentives.
- necovek 1y agoFor a start, stop buying those products: vote with your wallet. Do you own a phone that's easily rooted? Who else does? What about your WiFi routers? Internet modem? AirTags? Smart home appliances?
- esseph 1y agoRooting a phone fails certain security checks that prevent a lot of banking apps from working on your device.
- necovek 1y agoYes, it's equivalent to running a computer with admin access, and most banking web sites have no issue with that. Still, my point was not about running a rooted phone with unlocked bootloader (secure boot disabled on a pc equivalent), but whether if this is possible accounts in your purchasing decision.
- tsimionescu 1y agoBefore we had secure phones, we used to get hardware gadgets from banks in order to secure access. Now that phones are secure enough, the phones act as the root of trust (and, unfortunately, SMS does as well...).
- necovek 1y agoYes, and phones are full of vulnerabilities because vendors provide security updates only for 2-5 years (high end being rare), thus making this a moot point.
- charcircuit 1y agoThe security measures do not need to be perfect. As long as fraud remains at a reasonable level it should be fine.
- M95D 1y agoYou won't be able to switch it off for long. See how many phones still have that option! [1] In the end what matters is always money. Always. What brings more money? TiVo or buyer-owned device? You think 5% of technically competent potential buyers would make a difference when the 95% illiterate users will just replace the product no questions asked? It started as a fight against piracy and half-competent users that break their own systems (and the company's systems too, like you said). But slowly the industry sees that there's more money to be made if the same technology can provide a belivable argument in right to repair and planned obsolescence court cases. [1] https://github.com/melontini/bootloader-unlock-wall-of-shame https://github.com/melontini/bootloader-unlock-wall-of-shame
- II2II 1y agoGet back to me when it actually happens, because I've been hearing that line for about 15 years now and it has not happened. The reality is that PC's address the needs of a fundamentally different market than "TiVo"s or even mobile phones. While most could, and probably should, be using secure boot noone seems to be eager to take away the option to disable it.
- Lammy 1y ago> Get back to me when it actually happens Hello from 2013, and here you go! https://wiki.ubuntu.com/ARM/SurfaceRT#Secure_Boot https://wiki.ubuntu.com/ARM/SurfaceRT#Secure_Boot https://openrt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot https://openrt.gitbook.io/open-surfacert/common/boot-sequenc...
- LeoPanthera 1y agoThis is only true if you count ARM tablets as "PCs", which most people don't.
- Lammy 1y agoNo, UEFI Secure Boot is UEFI Secure Boot. The fact that Microsoft exercised this ability twelve entire years ago on a platform where they thought they could get away with it makes it worse, not better.
- supportengineer 1y agoI'm surprised more huge corporations don't move towards a "Chromebook only" by default. Now you don't have to manage anything. We're all doing our work in browsers anyway.
- keyringlight 1y agoI think at some point there will gradually be a line that divides consumer type devices and Workstation with a capital W type devices. If nothing else it'll encourage the PC market to really decide for each use-case how much they value having a huge range of laptop or pre-built configurations or being able to assemble from parts. There's a lot of momentum in the PC mindset, but I also think a lot of people would be satisfied with less 'personal' so long as they were able to identify what they need and match it to capabilities of a model. 20 years ago the idea of a phone/table as the personal computer for most people and not a PC/laptop would be silly, yet here we are
- immibis 1y agoIs there not one already? Having a laptop or desktop puts you firmly in workstation category; the consumer type devices are smartphones (and they make up about 90% of all devices so we should probably stop treating mobile web pages as an afterthought).
- citizenpaul 1y agoMy experience with mobile vs desktop web pages is that the mobile ones are stuffed full of ads and "engagement" sinks. Not that the mobile version is second class.
- citizenpaul 1y agoIf you are issued a chromebook to me it signal that they consider you a replaceable cog. Its one of my interview questions these days. What device will I be issued? If its a chromebook I know that no matter what they say they don't really care about the postion.
- tux3 1y agoGo in the BIOS and switch it off? Certainly. Just one problem: Modern consumer BIOS interfaces are graphical and your GPU is off.
- ThePowerOfFuet 1y agoThat's not how it works; Secure Boot kicks in once EFI hands over control.
- mjg59 1y agoThe driver that initialises your plug-in GPU is shipped in flash on the card, is signed by Microsoft, and won't run unless that signature validates.
- tsimionescu 1y agoDoesn't that happen only after UEFI starts the boot process, and only if Secure Boot is enabled?
- mjg59 1y agoI don't understand what "UEFI starts the boot process" means? The firmware is what initialises the hardware. If the code needed to initialise your GPU doesn't have a trusted signature then it won't be executed, and you won't have any working graphics, so you won't have a UI to let you disable secure boot. If secure boot isn't enabled in the first place then yes this isn't a problem.
- ThePowerOfFuet 1y agoI am reticent to argue with someone of your reputation, but AFAIK UEFI can initialize a basic framebuffer (and write to it) in a standardized manner without needing any ROM on the card. https://wiki.osdev.org/GOP https://wiki.osdev.org/GOP
- mjg59 1y ago
- tpoacher 1y agoBitlocker
- mschuster91 1y ago> But when the user is the device owner? Doesn't do much. A decent Secure Boot implementation together with a BIOS/EFI password at least makes the life of US CBP or similar thugs wanting to use my devices against me much more difficult. And no, that's not an imaginary threat, certainly not under this administration which has come under fire multiple times for first detaining and then deporting random tourists.
- swagmoney1606 1y agoYou can't play many videogames if you do this, as anticheat won't let the game run unless secure boot is turned on
- a96 1y agoFor values of many being less than one in a million. Yes, the few that do are somewhat popular competitive ones, but they are very very rare in the sea of games that exist.
- xg15 1y agoEven if you can, there might be dark patterns to discourage you, such as showing a "boot screen of shame" if its turned off.
- jimmaswell 1y agoI certainly do not want old graphics cards to become ewaste for no good reason.
- tomhow 1y ago> EVERYBODY wants that! And I mean ABSOLUTELY EVERYBODY Please don't use uppercase for emphasis. If you want to emphasize a word or phrase, put asterisks* around it and it will get italicized.* https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- deleted 1y ago[deleted]
- dang 1y agoRecent and related: Linux and Secure Boot certificate expiration - https://news.ycombinator.com/item?id=44601045 https://news.ycombinator.com/item?id=44601045 - July 2025 (265 comments)
- Arnavion 1y agoThere is also the option of enrolling your own certs and resigning the bootloader and any Option ROMs you need, if you're really worried / expect to actually be broken by this.
- NelsonMinar 1y agoThis article notes that "nobody actually enforces these expiry dates". So this is another way that secure boot is proven to be nowhere as secure as it claims to be. Coupled with LogoFAIL and most hardware shipping with insecure debug keys.. has Secure Boot ever provided meaningful security? It sure causes all sorts of practical problems. https://arstechnica.com/security/2023/12/just-about-every-windows-and-linux-device-vulnerable-to-new-logofail-firmware-attack/ https://arstechnica.com/security/2023/12/just-about-every-wi... https://arstechnica.com/security/2024/07/secure-boot-is-completely-compromised-on-200-models-from-5-big-device-makers/ https://arstechnica.com/security/2024/07/secure-boot-is-comp...
- OsrsNeedsf2P 1y agoWas Secure Boot supposed to increase security? I thought Microsoft was using it to make it near impossible to install Linux
- mjg59 1y agoLinux distributions have been shipping with secure boot support since 2012, so if that was the goal it had already failed over a decade ago.
- zahlman 1y agoThe Linux Mint support forums keep telling people to try turning it off to fix problems, but I installed Mint just fine with it enabled on my 8 (at the time) year old hardware, before I'd even heard that there was such a thing. Anyway, it's good to hear that I probably don't have anything to worry about.
- charcircuit 1y agoUnfortunately, hearing this is not surprising since desktop Linux users tolerate having poor security and rely on never ever running malware to keep themselves safe over having the operating system itself protect against malware.
- TacticalCoder 1y agoCan someone knowledgeable on the subject explain if I understand the following right: - on a mobo the motherboard provider signs the PK - there's only one PK - the PK signs one or more KEK, like "Microsoft Corporation UEFI CA 2011" If that understanding is correct, can I add myself the new "Microsoft Corporation UEFI CA 2023" (the one that expires in 2038: I think that its name) the same way I can enroll new keys in the dbx? (say my own signed keys?) If I add the new Microsoft key myself, shall it be as a KEK or in the dbx? Will motherboard manufacturer release new firmware, with the new Microsoft key already signed? In that case, shall be a KEK ? Basically instead of thinking, as TFA suggests: "Let's not worry about anything, everything shall be fine and keep working because keys expiration date aren't enforced", can I pro-actively enroll the new Microsoft key myself? P.S: I don't drink the SecureBoot kool-aid but something has to be said about having a Linux unikernel (kernel+initramfs) signed and enforced by SecureBoot. And SecureBoot does at least somehow work. Source: I modified on bit of my kernel and had a SecureBoot error and the kernel refused to boot. You can try it for yourself.
- mjg59 1y agoVouched for the parent because it's a reasonable question. As well as the new root certificates in db, which are used to decide whether signed code will execute or not, there will be a new signed Microsoft key for KEK. This isn't involved in the boot process, but is required for Microsoft to be able to sign further revocation updates. The article is discussing the db case, and if you want to ensure things signed only with the new key will boot on your system, you would want to add them to db. Microsoft can sign a db update themselves (since there's a valid Microsoft key in KEK and db updates need to be signed with a key in KEK), but KEK updates need to be signed with PK. Microsoft doesn't own PK, so adding the new KEK requires the system vendor produce an update signed with their PK. If you are in a position to enroll the new keys then you should enroll the new db keys if you want new binaries to be guaranteed to boot, and add the new KEK if you want to be able to apply future Microsoft-signed dbx updates.
- ethan_smith 1y agoYes, you can proactively enroll the new Microsoft UEFI CA 2023 certificate in the KEK database using `mokutil --import` on Linux or the UEFI firmware interface directly, though most distros will handle this automatically in upcoming updates.
- phkahler 1y agoThe moment I lose access to my computer or data due to this nonsense is the day I have a Stallman moment and refuse to play. I'll use a Chinese risc-v machine with 5 year old performance or whatever. This stuff has lived in the far background of my mind for years with thoughts like "fedora somehow handles this so I don't need to worry." But if it hits I'm done. Won't support such hardware ever.
- xg15 1y ago> So, uh, what's the story here? Why is there any engineering effort going on at all? [...] Microsoft will shortly start signing things with a new certificate that chains to a new root, and most systems don't trust that new root. [...] If something is signed purely with the new certificate then it won't boot on something that only trusts the old certificate (which shouldn't be a realistic scenario due to the above), but if something is signed purely with the old certificate then it won't boot on something that only trusts the new certificate. So, dumb question: If the expiry dates are not enforced, why rotate the certificates at all? The only consequences of Microsoft introducing new keys seems to be that compatibility with old software and systems will over time become worse. But what's the upside - or the actual threat model this is defending against?
- WhyNotHugo 1y agoI suspect new hardware will need to have only the new certificate if they want some sort of compatibility certification.
- xg15 1y agoThat's what I suspect as well. But would this have any actual security benefit or is it just a way to force people to abandon their old hardware like speculated in https://news.ycombinator.com/item?id=44748323 https://news.ycombinator.com/item?id=44748323 ?
- Harvesterify 1y agoThe rotation is not related to the UEFI capability to check/enforce the expiration, but the capability to sign future shim/OpROMs/drivers/bootloaders.
- slartibardfast0 1y agothe steps to import the new keys from microsoft are here: https://techcommunity.microsoft.com/blog/windows-itpro-blog/updating-microsoft-secure-boot-keys/4055324 https://techcommunity.microsoft.com/blog/windows-itpro-blog/... worked perfectly on a fully updated Windows 11 24H2 installed on an old Surface Pro LTE i5-7300U that is perhaps unlikely to receive another firmware update...