Live data from Hacker News

Brave New Trusted Boot World

0pointer.net

101–110 of 178 posts

Re: Brave New Trusted Boot World

#101
post #35

I'm OK with making sure the software I'm running is the software I thought I was running. But because trusted boot runs so deep, and is intentionally hard to get around, it's vital that the implementation is trustworthy. I don't trust Poetteringware. Poettering's team has a record of foisting technology on users, resulting in the need for e.g. the Devuan fork. I wish this work were being done by just about any other…

Going back to the init.d clusterfuck is insane.

Why? It was simple and understandable.

systemd has everything and a kitchen sink, it is a big blob of software.

Finding out why the heck my resolv.conf contains some 127.0.0.x entry and not the real nameserver was the final thing that made me question sanity of distro maintainers and author of two worse pieces of software: pulseaudio and systemd. (I was very surprised that it was the same person).

Re: Brave New Trusted Boot World

#102
post #95
post #2

>System ready for easy remote attestation, to prove validity of booted OS, configuration and local identity >“Democratize” use of PCR policies by defining PCR register meanings, and making binding to them robust against updates, so that external projects can safely and securely bind their own data to them (or use them for remote attestation) without risking breakage whenever the OS is updated. In what world is this a…

This is where computing as a whole is headed because it's the ONLY way to provide defense in depth against cyberattacks. Signed code path from first boot to user space code. Remote attestation because you can NEVER trust the client. Microsoft and especially Apple are already doing this. Linux needs an answer, and "no, it's too user hostile" is NOT a valid answer; it will just make Linux an untenable security risk. It…

>the Wild West 90s internet is long gone and nothing will bring it back. This is where things are headed, because the risks of the status quo are too great. Suck it up and get on with your life.

The "Wind West internet" is very much alive, but as it was in the 90s, its hidden and far away from the "normal" users. And regarding the part with the "suck it up and get on with your life" - I always was a "Don Quijote" type personality, i don't think i will change this attitude...

Re: Brave New Trusted Boot World

#103
post #6
post #2

>System ready for easy remote attestation, to prove validity of booted OS, configuration and local identity >“Democratize” use of PCR policies by defining PCR register meanings, and making binding to them robust against updates, so that external projects can safely and securely bind their own data to them (or use them for remote attestation) without risking breakage whenever the OS is updated. In what world is this a…

Humanity has done a great step forward in the last 50 years or so, usually you can trust the police and governments everywhere on the planet today to always do the right thing. So why this irrational fear and this anti-state ideology? Don´t you love our modern leaders?

My grandfather had a nice saying: "The state is not your friend nor your ally, it is -at best- a adversary with whom you live in an unstable truce"

Re: Brave New Trusted Boot World

#104

Earlier quoted context omitted.

Many folks prioritize preventing practical in-the-wild blue pill attacks over preventing the theoretical DRM use case.

It's not a "theoretical DRM use case" if you stop thinking in terms of movie piracy for a moment, and consider what's happening with banking apps on mobile platforms. Thanks to remote attestation, the custom ROM scene for Android is pretty much dead now, because there's little point of customizing the OS when it automatically makes important services no longer accessible from the phone.

This is not limited to consumer transactions like banking apps, and deployment is never guaranteed to be the result of a rational decision-making process. I have now had more than one employer who deployed remote attestation in a bring-your-own-device ecosystem. They do this because they are told by some vendor tutorial that it is more secure, but they end up disabling user devices by accident. My current IT department told me to buy a new phone if my current one couldn't pass a SafetyNet check.

The problem is that if you are inside a project developing something like this, you can clearly visualize your expected use case, but it's impossible to know what other use cases will be contrived. Of course in this case, we have predicted a few major malfeasances and I think anyone supporting a project like this needs to know the harmful use cases and be responsible for developing with them in mind.

Re: Brave New Trusted Boot World

#105
post #96

Earlier quoted context omitted.

There are quite a few instances[1] where adding your own signing keys bricks the device. [1] https://wiki.archlinux.org/title/Unified_Extensible_Firmware...

Huh, wasn't aware of that. Reading through, it looks like this is just talking about Microsoft "Secured-core" hardware, which seems to be hardware specifically marketed to provide a Microsoft-certified boot chain. I'm not sure that's the same thing as Microsoft making it harder in general for people to bring and use their own keys (or just turn it off altogether).

It's a bit more complicated. The UEFI drivers and Linux distributions are signed by the same certificate, the "Microsoft 3rd party UEFI Certificate".

UEFI Drivers can be Option ROM on the PCIe cards, commonly found of graphics cards. If you where to leave this certificate out of your boot chain, how would you validate this drivers? Well, you can't.

This results in your not having any GPUs and your device is "bricked" until you can hopefully piggyback on something else. It's not really a proper brick.

This is just a design flaw in my opinion. Microsoft taking the easy route for being the org responsible for signing UEFI code when there was no other options (LetsEncrypt wasnt a thing in 2010/2012). And I don't think Microsoft envisioned themselves in the position they are currently inn.

There are workarounds though, you can read the drivers loaded during boot from the TPM Eventlog and enroll each driver into the approve list for Secure Boot (The `db` variable). But this isn't necessarily future proof if anything changes.

Re: Brave New Trusted Boot World

#106
post #75

Earlier quoted context omitted.

This is unfair. MS keeps making it harder and harder to run anything that is not MS-signed (TM) on Secure Boot hardware; any distro that does not bow to the whims of MS is thus likely to be relegated to obscurity or die due to lack of users capable of installing it.

I keep hearing that Microsoft is making things "harder", but I've yet to see any evidence that this is true. All I can see is that Microsoft mandate that laptop hardware sold with Windows installed have secure boot capability and that the MS-signing keys are shipped in the TPM. This has been true for, what, over 10 years? How are they making things harder?

> I keep hearing that Microsoft is making things "harder", but I've yet to see any evidence that this is true.

You shall try to run Windows 10. See calc.exe or Teams (though the web versions of 365 are also representative)

Re: Brave New Trusted Boot World

#107
post #65

Earlier quoted context omitted.

> If I was responsible for ... the only software that gets to run is the one I want running. Not wishing to pick on you personally, but the above paragraph is wonderful example of the sort of logic going around that bothers me. You trace a faultless journey from responsibility to desiring total control. That's not what responsibility is. You're describing the feeling of culpability within a brutal regime - where Vade…

The problem isn’t that you can’t trust people. The problem is that people are defenseless in the face of malicious hackers with vastly more expertise and zero day vulnerabilities. It’s not that you can’t trust your employees. It’s that you can’t trust them to defend themselves from being mugged. The forcing function for all this removal of freedom is defense against malicious hackers. The removal of freedom is not th…

Some good points. Lets see what we can do here:

> The problem isn’t that you can’t trust people.

Good. It's always best to have an optimistic view of our fellows, that's how we build good social structures.

> The problem is that people are defenceless in the face of malicious hackers

So. Make then not defenceless. We arm them. With education and other tools they need to defend themselves. Digital Self Defence (Or Digital Literacy 2.0 if you want a fluffier title) is the project I am committed to. Defensive tools belong in the hands of users.

> with vastly more expertise

We can balance the theatre twofold, by giving people more defensive capability, knowledge and rights, and by attacking the knowledge base and knowledge value of malicious actors. We must recognise that many of our own institutions play part of the problem, from vendor malware, and backdoors to security disinformation. Cyber-law needs radical reform to give end-user better security rights, and "surveillance capitalism" needs dragging to the dock.

> zero day vulnerabilities.

Starting maybe with an all out assault on "zero days", including the companies, agencies and re-sellers of them, using the law.

> It’s that you can’t trust them to defend themselves from being mugged.

Part of ones job then, is to enable them to defend themselves. You cannot follow your children around for the rest of their lives in case bullies pick on them. You need to teach them fighting skills so they won't be doormats. That's the reality of the digital workplace today. Also, don't give your kids gold Rolex Oyster watches and diamond rings to mooch around scuzzy neighbourhoods with. Limit assets, practice compartmentalisation. Half an ounce of sensible opsec is worth a ton of authoritarian technical non-solutions.

> The removal of freedom is not the goal so much as a side effect.

The removal of freedom is NEVER an acceptable "side effect" of any security action. Security and freedom are not diamtrics. Otherwise "the terrorists win" and one may as well join the ranks of malicious principles and directly attack our own people (which is the stance many US agencies have taken since 2001 toward baby and bath-water alike)

> real world ... borders armies police

But this isn't the real world. Its a digital one which is different. The old military model of perimeters and weapons isn't working and smart people in cybersecurity know that. The collateral damage of that broken model is our digital economy and liberal democracy itself (which are intimately linked in the American/Western mind if you believe one jot in things like startups and entrepreneurialism).

We'll simply have to do better than handing over the responsibilities of our elected guardians to unelected companies considered by some [1] to be criminally motivated. We still have laws, schools and hopefully enough common sense to avoid that.

EDIT: subtracted fulmination.

[1] https://en.wikipedia.org/wiki/United_States_v._Microsoft_Cor.... https://en.wikipedia.org/wiki/Microsoft_litigation

Re: Brave New Trusted Boot World

#108
It's possible to encrypt all of /boot while using SecureBoot. That was my solution. It's a little annoying to type the passphrase at boot, but it's entirely doable.

I did the whole TPM thing previously on a Debian-only machine and it worked great until it stopped for some reason and I haven't had time to revisit. But on my latest machine I wanted to make sure Windows with SecureBoot worked and I was in a rush. So it's encrypted /boot for now.

I figure the threat is now that someone could clone the drive and brute force the passphrase and then tamper with /boot.

Re: Brave New Trusted Boot World

#109
post #65

Earlier quoted context omitted.

The problem isn’t that you can’t trust people. The problem is that people are defenseless in the face of malicious hackers with vastly more expertise and zero day vulnerabilities. It’s not that you can’t trust your employees. It’s that you can’t trust them to defend themselves from being mugged. The forcing function for all this removal of freedom is defense against malicious hackers. The removal of freedom is not th…

Some good points. Lets see what we can do here: > The problem isn’t that you can’t trust people. Good. It's always best to have an optimistic view of our fellows, that's how we build good social structures. > The problem is that people are defenceless in the face of malicious hackers So. Make then not defenceless. We arm them. With education and other tools they need to defend themselves. Digital Self Defence (Or Dig…

> Make then not defenceless.

This, simply put, doesn't work in an enterprise context. I'd argue that relying on people for security doesn't work in any context, and that it's about as effective as relying on programmers to not code memory leaks, but in companies where there's people whose _only_ use of a desktop computer is at work, as is increasingly common nowadays, it's simply not possible to get half the people out there to learn more than absolutely required to do their job. Go look at /r/sysadmin or /r/talesfromtechsupport: for some people it's a critical emergency if their desktop icons are rearranged because then their muscle memory to click on Chrome is broken. And that's not to mention executives who believe they're above things like "phishing awareness campaigns". Technical measures are much cheaper and vastly more effective than social measures directed at people who don't want to learn

Re: Brave New Trusted Boot World

#110
post #84

Now that 's the most ominous title I've read all year, and it's a piece in favor of it? Maybe I've just read too many dystopian novels, but come on. I'm all in favor of secure boot as long as I can enroll my own keys, but remote attestation gets scary quickly.

Total sidenote: Funnily enough, the sentence as it was coined was positive before Huxley turned it around.

(Shakespeare: The Tempest)

Post reply on HN