161–170 of 259 posts
Earlier quoted context omitted.
Computers should abide by their owners. Any computer not doing that is broken.
Its a simple solution in law to enable. Force manufacturers to allow owners of computer to put any signing key in the BIOS. We need this law. Once we have this law, consumers csn get maximum benefit of secure boot withiut losing contorl
Earlier quoted context omitted.
> anyone that cared enough about that specific vector just put their bootloader on a removable media. FDE wasn't somehow enabled by secure boot. Sure, but an attacker could still overwrite your kernel which your untouched bootloader would then happily run. With SB at least in theory you have a way to validate the entire boot chain. > why weren't they more common before? Because security of the rest of the system was…
> Sure, but an attacker could still overwrite your kernel which your untouched bootloader would then happily run. Except that it's on the encrypted partition and the attacker doesn't have the key to unlock it since that's on the removable media with the boot loader. They could write garbage to it, but then it's just going to crash, and if all they want is to destroy the data they could just use a hammer.
Backdooring your kernel is much, much more difficult to recover from than a typical user-mode malware infection.
Earlier quoted context omitted.
I strongly disagree on the Secure Boot front. It's necessary for FDE to have any sort of practical security, it reduces malicious/vulnerable driver abuse (making it nontrivial), bootkits are a security nightmare and would otherwise be much more common in malware typical users encounter, and ultimately the user can control their secure boot setup and enroll their own keys if they wish. Does that mean that Microsoft do…
Secure Boot provides no useful security for an individual user on the machine they own, and as such should be disabled by default. If you want to enable it for enterprise/business situations, thats fine, but one should be clear about that. Otherwise you get the exact Microsoft situation you mentioned and also no one knows about it.
Earlier quoted context omitted.
Do you lock your house or car and permanently handover the keys to some stranger, who you then have to depend on always to lock or unlock it for you?
No? I have locks on my house and car that I have the keys for. That an argument _for_ secure boot.
Earlier quoted context omitted.
What does this even mean ? It's like throwing around the word 'bloat'.
We can explain it to you, but we can't understand it for you. Explanation: Microslop is a power hungry, greedy and frankly evil corporation whose only goal is complete financial domination of the government, business, and personal tech industries. They actively promote making regressive software, increasing complexity, and hiding straightforward processes behind an information veil. Example: Go to learn.microsoft.com…
And of course companies in the US are wanting to make money/capture markets. They’re not a charity. None of that has any relation to holding back the industry. Unless you wish to explain how they hold back all FOSS projects.
You don’t need to be rude in your replies. This is HN, not reddit.
Earlier quoted context omitted.
> Full disk encryption protects from somebody yanking a hard drive from running server (actually happens) or stealing a laptop. Both of these are super easy to solve without secure boot: The device uses FDE and the key is provided over the network during boot, in the laptop case after the user provides a password. Doing it this way is significantly more secure than using a TPM because the network can stop providing t…
> The device uses FDE and they key is provided over the network during boot, in the laptop case after the user provides a password. Sounds nice on paper, has issues in practice: 1. no internet (e.g. something like Iran)? Your device is effectively bricked. 2. heavily monitored internet (e.g. China, USA)? It's probably easy enough for the government to snoop your connection metadata and seize the physical server. 3. n…
If your threat model is Iran and you want the device to boot with no internet then you memorize the long passphrase.
> heavily monitored internet (e.g. China, USA)? It's probably easy enough for the government to snoop your connection metadata and seize the physical server.
The server doesn't have to be in their jurisdiction. It can also use FDE itself and then the key for that is stored offline in an undisclosed location.
> no security at all against hardware implants / base firmware modification. Secure Boot can cryptographically prove to the OS that your BIOS, your ACPI tables and your bootloader didn't get manipulated.
If your BIOS or bootloader is compromised then so is your OS.
Earlier quoted context omitted.
> and bitlocker doesn't count. Wat? Bitlocker is the answer to your question. > In my limited experience with bitlocker, the disk is decryptable automatically as long as it's in the original motherboard. It's unlocked (not decrypted) when the OS boots, yes. You can optionally enforce (not on Home) other unlock methods, such as PIN before the OS boots. > I want my FDE to be based on a password or a keyfile, not simply…
If someone steals my laptop, and there is no factor of decryption requiring something I possess or know, then the only use of that disk being encrypted is that I can throw it out more safely at end of life. Thieves/LEO has the data because they have the motherboard. If bitlocker has a PIN/passphrase decrypt option, then I missed it.
Earlier quoted context omitted.
> Sure, but an attacker could still overwrite your kernel which your untouched bootloader would then happily run. Except that it's on the encrypted partition and the attacker doesn't have the key to unlock it since that's on the removable media with the boot loader. They could write garbage to it, but then it's just going to crash, and if all they want is to destroy the data they could just use a hammer.
The attacker does this when the drive is already unlocked & the OS is running. Backdooring your kernel is much, much more difficult to recover from than a typical user-mode malware infection.
But then you're screwed regardless. They could extract the FDE key from memory, re-encrypt the unlocked drive with a new one, disable secureboot and replace the kernel with one that doesn't care about it, copy all the data to another machine of the same model with compromised firmware, etc.
Earlier quoted context omitted.
There are still phones not obeying the megacorps. Sent from my Librem 5.
Does your Librem 5 run banking apps, though?