3 ms·
No it's a shit idea from end to end. Any PKI based system is a shit idea unless you are personally in control of the trusted root CA, which in this case you're
by meaty 14y ago
No it's a shit idea from end to end.
Any PKI based system is a shit idea unless you are personally in control of the trusted root CA, which in this case you're not. I think that is what Linus is saying.
Google for "certificate authority compromised" and you'll see what utter wads of shit for brains this could be entrusted to.
- cooldeal 14y ago>Any PKI based system is a shit idea unless you are personally in control of the trusted root CA, which in this case you're not With UEFI secure boot, you can delete Microsoft's key and add you own.
- deleted 14y ago[deleted]
- kevinoid 14y agoYou can be "personally in control of the trusted root CA" using SecureBoot. Just replace the Platform Key with your own key.[1] Or am I misunderstanding your objection? 1. http://blog.hansenpartnership.com/owning-your-windows-8-uefi-platform/ http://blog.hansenpartnership.com/owning-your-windows-8-uefi...
- meaty 14y agoYes I know this but its more the fact that there is no CRL that a new device can import so you are not in control of the pre-seeded keys. So if you have kit on the shelf for months and MS's private key is leaked or cracked then you have a large stock of compromised machines waiting to roll. I doubt any average PC retailer will be able to deal with manual key revocation. The same goes for your average government agency or health service. It should ship with no PKI/certificate scheme at all. We don't need it and it doesn't work and its blatantly obvious. Secure boot is entirely worthless from end to end.