3 ms·

Well, this project is literally about me circumventing/removing Boot Guard so I don’t know how it’s corporate authoritarianism. I’m literally getting rid of it.

Well, this project is literally about me circumventing/removing Boot Guard so I don’t know how it’s corporate authoritarianism. I’m literally getting rid of it. In doing so I get complete control of the BIOS/firmware down to the reset vector. I can disable ME. To me, that’s ultimate freedom. As a power user, do I want boot guard on my personal PC? Honestly, no. And we’re in luck because a huge amount of consumer motherboards have a Boot Guard profile so insecure it’s basically disabled. But do I want our laptops at work to have it, or the server I have at a colocation facility to have it? Yes I do. Because I don’t want my server to have a bootkit installed by someone with an SPI flasher. I don’t want my HR rep getting hidden, persistent malware because they ran an exe disguised as a pdf. It’s valuable in some contexts.

taneq 8mo ago
Some days you’re the anarchist, some days you’re the corporate authority. :D
fc417fc802 8mo ago
I want an equivalent of boot guard that I hold the keys to. Presented only with a binary choice certainly having boot guard is better than not having it if physical device security is in question. But that ought to be a false dichotomy. Regulation has failed us here.
- kachapopopow 8mo ago
  that defeats the point, having the "keys" allows malicious actors to perform the same kind of attacks... trust is protected by trusted companies... certificate companies sell trust, not certificates.
  - fc417fc802 8mo ago
    Me managing my own (for example) secure boot keys does not inherently enable malicious actors. Obviously unauthorized access to the keys is an attack vector that whoever holds them needs to account for. Obviously it's not risk free. There's always the potential that a user could mismanage his keys. There's absolutely no excuse for hardware vendors not to provide end users the choice. > trust is protected by trusted companies... The less control of and visibility into their product you have the less trustworthy they are.
    - kachapopopow 8mo ago
      the hardware is made by asus, asus signs with their key backed by a trusted company. asus gives out keys to sign bios firmware, now aliexpress can not only counterfeit, but provide tampered hardware. you can enroll your own secure boot keys so that's not really relevant.
      - fc417fc802 8mo ago
        Secureboot was being used as an example to illustrate the issue with your claim that a user controlling the keys must necessarily undermine security. I'll grant that if the user is given control then compromise within the supply chain does become possible. However the same hypothetical malicious aliexpress vendor could also enroll a custom secure boot key, install "definitely totally legit windows", and unless the user inspects he might well never realize the deception. Or the supply chain could embed a keylogger. Or ...
        kachapopopow 8mo ago
        you don't have to trust software, but you have to trust your firmware and hardware.

taneq 8mo ago

Some days you’re the anarchist, some days you’re the corporate authority. :D

fc417fc802 8mo ago

I want an equivalent of boot guard that I hold the keys to. Presented only with a binary choice certainly having boot guard is better than not having it if physical device security is in question. But that ought to be a false dichotomy. Regulation has failed us here.

kachapopopow 8mo ago
that defeats the point, having the "keys" allows malicious actors to perform the same kind of attacks... trust is protected by trusted companies... certificate companies sell trust, not certificates.
- fc417fc802 8mo ago
  Me managing my own (for example) secure boot keys does not inherently enable malicious actors. Obviously unauthorized access to the keys is an attack vector that whoever holds them needs to account for. Obviously it's not risk free. There's always the potential that a user could mismanage his keys. There's absolutely no excuse for hardware vendors not to provide end users the choice. > trust is protected by trusted companies... The less control of and visibility into their product you have the less trustworthy they are.
  - kachapopopow 8mo ago
    the hardware is made by asus, asus signs with their key backed by a trusted company. asus gives out keys to sign bios firmware, now aliexpress can not only counterfeit, but provide tampered hardware. you can enroll your own secure boot keys so that's not really relevant.
    - fc417fc802 8mo ago
      Secureboot was being used as an example to illustrate the issue with your claim that a user controlling the keys must necessarily undermine security. I'll grant that if the user is given control then compromise within the supply chain does become possible. However the same hypothetical malicious aliexpress vendor could also enroll a custom secure boot key, install "definitely totally legit windows", and unless the user inspects he might well never realize the deception. Or the supply chain could embed a keylogger. Or ...
      - kachapopopow 8mo ago
        you don't have to trust software, but you have to trust your firmware and hardware.