3 ms·

It is only two or three days since I first heard about the "evil maid" attack. While this could be a preoccupation for some kind of environment, and most probab

by temac 14y ago

It is only two or three days since I first heard about the "evil maid" attack. While this could be a preoccupation for some kind of environment, and most probably very few, it is very easy to come with a scheme that both protects against that and allows other operating systems to be installed. Given that this has not been done, and given the small number of people this scenario interests, given that thoses people are unlikely to be interested by Windows 8 to begin with, and even less by Windows RT, Secure Boot has not been designed by MS to prevent that, but really to prevent the installation of other operating systems. The FSF just fight Secure Boot for the real reason it has been created; if you create and alternate security feature for the "evil maid" scenario that preserve user freedom, that would be a completely different subject and you want angry the FSF with it. The FSF's attitude towards new technologies is not reactionary. They fight for user's freedom, as always.

geofft 14y ago
Secure Boot cannot possibly be useful to prevent the installation of other operating systems. Microsoft has a website where they will accept other operating systems to be signed, and there are multiple non-MS operating systems in existence that will boot with no fuss on a machine with Secure Boot enabled. The claim that Secure Boot is bad because MS could decide to stop signing Linux is as ridiculous as the claim that Authenticode is bad because MS could decide to stop signing Firefox, or that HTTPS is bad because MS could replace the set of CAs in Internet Explorer with just itself. The only way to defeat evil-maid attacks is for the early-boot code in your computer's firmware to cryptographically validate the bootloader or kernel that it's about to start, and make sure it's signed by a trusted authority, and make sure that it's possible for the computer owner to disable the ability for anyone other than him to change the set of trusted authorities. This happens to be exactly what Secure Boot does.

by temac 14y ago

geofft 14y ago

Secure Boot cannot possibly be useful to prevent the installation of other operating systems. Microsoft has a website where they will accept other operating systems to be signed, and there are multiple non-MS operating systems in existence that will boot with no fuss on a machine with Secure Boot enabled. The claim that Secure Boot is bad because MS could decide to stop signing Linux is as ridiculous as the claim that Authenticode is bad because MS could decide to stop signing Firefox, or that HTTPS is bad because MS could replace the set of CAs in Internet Explorer with just itself. The only way to defeat evil-maid attacks is for the early-boot code in your computer's firmware to cryptographically validate the bootloader or kernel that it's about to start, and make sure it's signed by a trusted authority, and make sure that it's possible for the computer owner to disable the ability for anyone other than him to change the set of trusted authorities. This happens to be exactly what Secure Boot does.