Earlier quoted context omitted.
This gets tricky. If I click on a link intending to view a picture of a cat, but instead it installs ransomware, is that abiding by its owner or not? It did what I told it to do, but not at all what I wanted.
The ransomware can encrypt the files in your home directory just as well with secure boot enabled. This is just another example of how secure boot provides zero additional security for the threat modes normal users face.
Microsoft terminates VeraCrypt account, halting Windows updates
221–230 of 259 posts
Re: Microsoft terminates VeraCrypt account, halting Windows updates
#222Windscribe is now the third one to be terminated by Microsoft as well... https://nitter.net/windscribecom/status/2041929519628443943
5eplay.com has also been suspended, as well as my company.
Re: Microsoft terminates VeraCrypt account, halting Windows updates
#223A year ago I used Azure Trusted Signing to codesign FOSS software that I distribute for Windows. It was the cheapest way to give away free software on that platform. A couple of months ago I needed to renew the certificate because it expired, and I ran into the same issue as the author here - verification failed, and they refused to accept any documentation I would give them. Very frustrating experience, especially s…
I like the idea of a central signing authority for open source. While this might go against the spirit of open source, I think it eventually creates a critical mass and outcry if Microsoft or Google would play games with them. Also foundations might be a good way to protect against legal trouble distributing OSS under different regulations. I am imagining e.g. an FDroid that plays Googles game. With reproducible or a…
> I like the idea of a central signing authority for open source.
It would be the most corrupt(ible) org ever involved in open source and it would promote locked-down computing, as that would be their main reason to exist. Be careful what you wish for!
Re: Microsoft terminates VeraCrypt account, halting Windows updates
#224Earlier quoted context omitted.
Valve is doing great work. Now… maybe we could condense the 10,000 pointless distros down to a dozen? Oops, nope. Now 10,001, except this one has the menu bar in the middle of the screen and it moves around.
The distros are not pointless. For every one of them there was a human being that wanted something to work differently and the nature of open source let them do it. That should be celebrated and the day we loose that flexibility would be a very sad day.
This. Not to mention that for the mainstream users there are mainstream distros that are largely the same they have always been: Fedora, Ubuntu, Mint, so I never really understood the issue of having tons of distros out there for enthusiasts.
Re: Microsoft terminates VeraCrypt account, halting Windows updates
#225Earlier quoted context omitted.
Secure Boot provides no useful security for an individual user on the machine they own, and as such should be disabled by default. If you want to enable it for enterprise/business situations, thats fine, but one should be clear about that. Otherwise you get the exact Microsoft situation you mentioned and also no one knows about it.
So everyday users should be vulnerable to bootkits and kernel-mode malware...why, exactly? That is useful security. The fact that people do not pursue this type of malware very frequently is an effect of SB proliferation. If it were not the default then these attacks would be more popular.
This is a tiresome argument that is based on a pile of unstated and rather shaky assumptions, ignores the very concept of opportunity costs and does not consider alternative solutions to the problems you seem to consider so important.
Fir starters, UEFI Secure Boot is actually rater bad at protecting users from bootkits or kernel-mode malware or anything, really. You can search this very website to get a giant list of bypasses and news about leaked vendor keys. Not to mention the fact that CrowdStrike Falcon incident had clearly demonstrated that Microsoft is more than happy to sign utterly insecure garbage.
Also, the issues with boot malware and kernel verification could be solved in many other ways, many of which are much more sensible or elegant. For example, by storing the bootloader and its keys on a physically separate read-only medium.
The issues with UEFI Secure Boot are actually the main point of the system, just like the issues with Windows executable signing are the whole point of that system.
Re: Microsoft terminates VeraCrypt account, halting Windows updates
#226Earlier quoted context omitted.
> and bitlocker doesn't count. Wat? Bitlocker is the answer to your question. > In my limited experience with bitlocker, the disk is decryptable automatically as long as it's in the original motherboard. It's unlocked (not decrypted) when the OS boots, yes. You can optionally enforce (not on Home) other unlock methods, such as PIN before the OS boots. > I want my FDE to be based on a password or a keyfile, not simply…
If someone steals my laptop, and there is no factor of decryption requiring something I possess or know, then the only use of that disk being encrypted is that I can throw it out more safely at end of life. Thieves/LEO has the data because they have the motherboard. If bitlocker has a PIN/passphrase decrypt option, then I missed it.
you should protect your account with a password of course. that will be used to decrypt your drive/data
Re: Microsoft terminates VeraCrypt account, halting Windows updates
#227Earlier quoted context omitted.
I mean, the super-easy option would be to just use BitLocker for FDE. No hassles, just works. But I fugured since everyone here on HN hates MS I wouldn't even bring that up. Don't trust MS? Enroll yourown keys
Yes use Bitlocker, the thing that uploads the encryption key to OneDrive "for convenience" thereby negating the whole point of FDE in the first place
by default, yes. Can be disabled with a single click. That's something that even your Grandma can do, as opposed to installing VeraCrypt (with dozens of options on what to encrypt, and how, and when, ...)
Re: Microsoft terminates VeraCrypt account, halting Windows updates
#228Earlier quoted context omitted.
As an embedded programmer in my former life, the number of customers that had the capability of running their own firmware, let alone the number that actually would , rapidly approaches zero. Like it or not, what customers bought was an appliance, not a general purpose computer. (Even if, in some cases, it as just a custom-built SBC running BusyBox, customers still aren't going to go digging through a custom network…
The customers don't have to install the firmware themselves, they can have a friend do it or pay a repair shop. You know, just like they can with non-computerized tools that they don't fully understand.
I’m not talking about your buddy’s Android phone, the context was embedded systems with firmware you’re not going to find on xda developers. A “friend” isn’t going to know jack shit about installing firmware on an industrial control.
Re: Microsoft terminates VeraCrypt account, halting Windows updates
#229Earlier quoted context omitted.
There is nothing stopping you from using third party certificates to sign Windows binaries. It's just expensive. You don't even need a MS toolchain or CLI tool for it.
> It's just expensive So yes there is.
Having a fee that's trivial for serious software developers but too high for script kiddies shipping trash is a good thing.
Re: Microsoft terminates VeraCrypt account, halting Windows updates
#230heh the same company that controls your secure boot chain just killed the signing account for the tool that encrypts your disk
This is the same pattern playing out everywhere. The platform giveth, the platform taketh away. If your software's distribution depends on one company's good graces, you don't really ship it they do
But nooooooo. All of us screaming bloody murder about UEFI Secure Boot impl's and code signing, and how they were the fundamental primitives to locking users out of general computation were the "paranoid" ones.
The entire Trusted Computing initiative had exactly one benefactor, and it was people looking to constrain what you did on your own machine. Y'all just set up your "End-of-Analysis" goalposts too early, and blinded yourselves to the maliciousness bundled in silver tongued beneficent intentions.
We'd be better off as a society all recognizing the inherent risk of computation than lulling people into a habit of "trust us bro" espoused by platform providers. Anyone trying to sell Trust is someone you can't afford to be trusting of.
I'll live with the threat of rootkits if it means no one can pull this kind of shit.