4 ms·

The problem was IIRC that you need something signed with MS key to be able to boot whatever. If you are able to set your own keys - then there is almost no prob

The problem was IIRC that you need something signed with MS key to be able to boot whatever. If you are able to set your own keys - then there is almost no problem (still usb flashes and so on will be harder to boot)

BinaryIdiot 12y ago
> If you are able to set your own keys - then there is almost no problem Doesn't this make the feature useless from a security standpoint? If you're able to create your own keys then malware could create its own keys. Maybe if manufacturers could do it that would be handy.
- tbrownaw 12y ago
  I would assume that these UEFI machines have a built-in settings screen the same as BIOS-based machines do (and that screen would be where the setting we're discussing is found). If the only way to add keys is thru that screen, then you'd need physical access and malware adding keys wouldn't be an issue.
  - BinaryIdiot 12y ago
    That would make sense; thanks!
  - ams6110 12y ago
    If there's a way to add keys there's a way to add keys. I don't think I'd rely on a screen being the only way to pull it off.
    - tbrownaw 12y ago
      The keys are stored in a separate hardware module with a defined interface (which I'm sure is standardized somewhere). From what I understand, part of that interface would be a flag you can set to say "do not accept new keys until next reboot" (I assume there's also one for "do not accept new keys, ever again"). If the firmware sets that not-until-reboot flag before booting the OS, then going thru the firmware really would be the only way.
      - pgeorgi 12y ago
        Secure Boot can (and typically does) operate without a TPM, so no separate hardware module. However, flash writing can be limited in hardware, so it would be possible to store Secure Boot keys in a special region of the flash that's locked down right after the opportunity to get to that setup screen passed.
  - TazeTSchnitzel 12y ago
    But that's not how UEFI works. Unlike your traditional BIOS, the settings can be edited from a normal OS by command-line utilities and such, too. In fact, often the only way to do anything useful, given how broken many UEFI setup pages are, is to edit the settings directly.
    - makomk 12y ago
      You're not meant to be able to edit those settings from anywhere other than the setup page. In practice, that's as broken as everything else in modern UEFI implementations, and some allow userland processes within Windows to add signing keys.
- crdoconnor 12y ago
  No. The first time you log in to a server with ssh, it asks you if you should accept the particular fingerprint it just got. You either say yes or no. Thereafter, if it changes, you get a big fat warning about potentially being hacked. From a security standpoint, this is no different.
anonymfus 12y ago
Currently ability to set your own keys is mandated for Windows 8/8.1 devices. Leaked slides don't describe how it will be for Windows 10. We can guess only on the base of possible Microsoft's intentions.

BinaryIdiot 12y ago

> If you are able to set your own keys - then there is almost no problem Doesn't this make the feature useless from a security standpoint? If you're able to create your own keys then malware could create its own keys. Maybe if manufacturers could do it that would be handy.

tbrownaw 12y ago
I would assume that these UEFI machines have a built-in settings screen the same as BIOS-based machines do (and that screen would be where the setting we're discussing is found). If the only way to add keys is thru that screen, then you'd need physical access and malware adding keys wouldn't be an issue.
- BinaryIdiot 12y ago
  That would make sense; thanks!
- ams6110 12y ago
  If there's a way to add keys there's a way to add keys. I don't think I'd rely on a screen being the only way to pull it off.
  - tbrownaw 12y ago
    The keys are stored in a separate hardware module with a defined interface (which I'm sure is standardized somewhere). From what I understand, part of that interface would be a flag you can set to say "do not accept new keys until next reboot" (I assume there's also one for "do not accept new keys, ever again"). If the firmware sets that not-until-reboot flag before booting the OS, then going thru the firmware really would be the only way.
    - pgeorgi 12y ago
      Secure Boot can (and typically does) operate without a TPM, so no separate hardware module. However, flash writing can be limited in hardware, so it would be possible to store Secure Boot keys in a special region of the flash that's locked down right after the opportunity to get to that setup screen passed.
- TazeTSchnitzel 12y ago
  But that's not how UEFI works. Unlike your traditional BIOS, the settings can be edited from a normal OS by command-line utilities and such, too. In fact, often the only way to do anything useful, given how broken many UEFI setup pages are, is to edit the settings directly.
  - makomk 12y ago
    You're not meant to be able to edit those settings from anywhere other than the setup page. In practice, that's as broken as everything else in modern UEFI implementations, and some allow userland processes within Windows to add signing keys.
crdoconnor 12y ago
No. The first time you log in to a server with ssh, it asks you if you should accept the particular fingerprint it just got. You either say yes or no. Thereafter, if it changes, you get a big fat warning about potentially being hacked. From a security standpoint, this is no different.

anonymfus 12y ago

Currently ability to set your own keys is mandated for Windows 8/8.1 devices. Leaked slides don't describe how it will be for Windows 10. We can guess only on the base of possible Microsoft's intentions.