5 ms·
I strongly disagree on the Secure Boot front. It's necessary for FDE to have any sort of practical security, it reduces malicious/vulnerable driver abuse (makin
by arcfour 6mo ago
I strongly disagree on the Secure Boot front. It's necessary for FDE to have any sort of practical security, it reduces malicious/vulnerable driver abuse (making it nontrivial), bootkits are a security nightmare and would otherwise be much more common in malware typical users encounter, and ultimately the user can control their secure boot setup and enroll their own keys if they wish.
Does that mean that Microsoft doesn't also use it as a form of control? Of course not. But conflating "Secure Boot can be used for platform control" with "Secure Boot provides no security" is a non-sequitur.
- kelseyfrog 6mo agoAnything that restricts user freedom is entirely bad, even if it's at the expense of security.
- deleted 6mo ago[deleted]
- arcfour 6mo agoBut...it doesn't restrict user freedom. If the user wishes to do so, they can disable SB.
- kelseyfrog 6mo agoThey shouldn't _have_ to do anything. The point is that no demands should be placed upon users. Same problem with age gating. It's fine, as long as zero additional demands are placed upon users.
- UrMomsRobotLovr 6mo agoAre the demands that users become experts in provider their own security against more advanced actors not significantly worse? The control part is unfortunate but the defaults should make it so users can focus on sharing pictures of cats without fear or need for advanced cyber security knowledge.
- robotresearcher 6mo agoFreedom from the consequences of malware is more valuable than the low cost of turning SecureBoot off if you don’t want it. We shouldn’t need the hassle of locks on our home and car doors, but we understand they are probably worthwhile for most people.
- thisislife2 6mo agoDo you lock your house or car and permanently handover the keys to some stranger, who you then have to depend on always to lock or unlock it for you?
- dwattttt 6mo agoNo? I have locks on my house and car that I have the keys for. That an argument _for_ secure boot.
- jrm4 6mo agoIt is absolutely not. It's a decent one for "locks on an apartment building that someone else owns." But no, purchasing a house ought not include by default "a set of locks that you must work around, permission-wise."
- robotresearcher 6mo agoFunnily enough, when you buy a house, the first task is to change all the locks. Y’know, for security.
- jrm4 6mo agoSure. Now, of the people who buy houses -- how many of them would find this a difficult or onerous task? And then, do computers. Apples and oranges here, for this point.
- 6mo ago
- bigfatkitten 6mo agoUsers who care enough to do so can enrol their own keys using the extremely well documented process to do that. Users who don’t care about the runtime integrity of their machine can just turn it off. Both options are so easy that you could’ve learned how to do them on your machine in the time that you spent posting misinformation in this thread.
- CodesInChaos 6mo agoAnd will then be locked out from an increasing amount of Applications, Media, and eventually even Websites.
- arcfour 6mo agoI run Linux with Secure Boot and I don't feel locked out of any media, applications, or websites. My mom uses Secure Boot with Windows and doesn't know or care that it's enabled at all.
- heavyset_go 6mo agoThe OP is describing the status quo on mobile phones and tablets. On mobile Secure Boot, and systems like it, are used to lock out the user. If the boot path integrity is altered, some apps won't work or will provide degraded experiences. What's happening the article is what has already happened on mobile: it requires vendor signing to run anything on mobile OS and the vendor locks out 3rd party drivers from their OS entirely. It's yet another step towards desktop computing converging with mobile when it comes to software/firmware/boot/etc integrity attestation, app distribution and signing, and the ability to use your own bootloader and system drivers. When Secure Boot was first rolled out on laptops, it was used by Microsoft to lock the user out of the boot process before it was adapted to let users register their own keys, it can always be used for its original purpose, and how it's currently used on mobile, again.
- brookst 6mo agoSo like banks requiring you to have a PIN on your ATM card, even if you don’t want one… that’s bad? Seatbelt laws are bad?
- serf 6mo ago>It's necessary for FDE to have any sort of practical security why? do you mean because evil maid attacks exist? anyone that cared enough about that specific vector just put their bootloader on a removable media. FDE wasn't somehow enabled by secure boot. >bootkits are a security nightmare and would otherwise be much more common in malware why weren't they more common before? serious question. Back in the 90s viruses were huge business, BIOS was about as unprotected as it would ever possibly be, and lots of chips came with extra unused memory. We still barely ever saw those kind of malware.
- arcfour 6mo ago> anyone that cared enough about that specific vector just put their bootloader on a removable media. FDE wasn't somehow enabled by secure boot. Sure, but an attacker could still overwrite your kernel which your untouched bootloader would then happily run. With SB at least in theory you have a way to validate the entire boot chain. > why weren't they more common before? Because security of the rest of the system was not at the point where they made sense. CIH could wipe system firmware and physically brick your PC - why write a bootkit then? Malware then was also less financially motivated. When malware moved from notoriety-driven to financially-driven in the 2000s, bootkits did become more common with things like Mebroot & TDL/Alureon. More recently, still before Secure Boot was widespread, we had things like the Classic Shell/Audacity trojan which overwrote your MBR: https://www.youtube.com/watch?v=DD9CvHVU7B4 https://www.youtube.com/watch?v=DD9CvHVU7B4 and Petya ransomware. With SB this is an attack vector that has been largely rendered useless. It's also a lot more difficult to write a malicious bootloader than it is to write a usermode app that runs itself at startup and pings a C2 or whatever.
- AnthonyMouse 6mo ago> Sure, but an attacker could still overwrite your kernel which your untouched bootloader would then happily run. Except that it's on the encrypted partition and the attacker doesn't have the key to unlock it since that's on the removable media with the boot loader. They could write garbage to it, but then it's just going to crash, and if all they want is to destroy the data they could just use a hammer.
- whatevaa 6mo agoFull disk encryption protects from somebody yanking a hard drive from running server (actually happens) or stealing a laptop. Calling it useless because it doesn't match your threat model... I hate todays security people, can't threat model for shit.
- AnthonyMouse 6mo ago> Full disk encryption protects from somebody yanking a hard drive from running server (actually happens) or stealing a laptop. Both of these are super easy to solve without secure boot: The device uses FDE and the key is provided over the network during boot, in the laptop case after the user provides a password. Doing it this way is significantly more secure than using a TPM because the network can stop providing the key as soon as the device is stolen and then the key was never in non-volatile storage anywhere on the device and can't be extracted from a powered off device even with physical access and specialized equipment.
- tremon 6mo ago> the device uses FDE and the key is provided over the network during boot An example of such an implementation, since well before TPMs were commonplace: https://www.recompile.se/mandos https://www.recompile.se/mandos
- mschuster91 6mo ago> The device uses FDE and they key is provided over the network during boot, in the laptop case after the user provides a password. Sounds nice on paper, has issues in practice: 1. no internet (e.g. something like Iran)? Your device is effectively bricked. 2. heavily monitored internet (e.g. China, USA)? It's probably easy enough for the government to snoop your connection metadata and seize the physical server. 3. no security at all against hardware implants / base firmware modification. Secure Boot can cryptographically prove to the OS that your BIOS, your ACPI tables and your bootloader didn't get manipulated.
- AnthonyMouse 6mo ago
- fsflover 6mo agoInstead of proprietary SecureBoot controlled by megacorps, you can use TPM with Heads based entirely on FLOSS with a hardware key like Librem Key. Works for me and protects from the Evil Maid attack.
- arcfour 6mo agoYou can also use SB with your own keys (or even just hashes)...just because Microsoft is the default included with most commercially sold PCs—since most people use Windows on their PCs—doesn't mean SB is controlled by them. You can remove their signing cert entirely if you want. I have done this and used my own. Plus they signed the shim loader for Linux anyways so they almost immediately gave up any "control" they might have had through SB.
- jasomill 6mo agoWon't removing the Microsoft key prevent UEFI option ROMs from PCIe cards from loading when Secure Boot is enabled? Is it even possible to install firmware containing an oprom resigned with a custom key onto, say, a modern Nvidia GPU, without the entire firmware bundle being signed by Nvidia's own key?
- jrm4 6mo agoSecure Boot provides no useful security for an individual user on the machine they own, and as such should be disabled by default. If you want to enable it for enterprise/business situations, thats fine, but one should be clear about that. Otherwise you get the exact Microsoft situation you mentioned and also no one knows about it.
- arcfour 6mo agoSo everyday users should be vulnerable to bootkits and kernel-mode malware...why, exactly? That is useful security. The fact that people do not pursue this type of malware very frequently is an effect of SB proliferation. If it were not the default then these attacks would be more popular.
- jrm4 6mo ago[flagged]
- burnt-resistor 6mo agoYou're arguing for not wearing seatbelts because no evidence has been shown that anyone has ever been saved by wearing one has been presented. That's just stupid by refuting ubiquitously understood data and facts. SecureBoot ensures a valid, signed OS is installed and that the boot process generally hasn't been completely compromised in a difficult-to-mitigate manner. It provides a specific guarantee rather than universal security. Talking about "many vectors" has nothing to do with SecureBoot or boot-time malware.
- 6mo ago