Safeboot: Booting Linux Safely
safeboot.dev
Safeboot: Booting Linux Safely
1–10 of 61 posts
Re: Safeboot: Booting Linux Safely
#2If every Linux user would boycott AMD to release their source, then we could have libreboot:
https://libreboot.org/amd-libre.html
ME vs PSP isn't much of a choice. Of course POWER might be an option eventually, but isn't for most of us currently.
Re: Safeboot: Booting Linux Safely
#3Does anyone know if anything similar is possible with Windows? I am interested in the idea of signing the bootloader with your own keys to prevent other system images from being used on the system. It seems like such a system would provide much better anti-theft guarantees than existing solutions like CompuTrace/Lojack.
Re: Safeboot: Booting Linux Safely
#4> fTPM tampering is out of scope since the ME is the root of all trust in the system
I'm wondering about this assumption. Hasn't the ME previously been shown to be fairly straightforward to exploit?
Re: Safeboot: Booting Linux Safely
#5Does anyone know if anything similar is possible with Windows? I am interested in the idea of signing the bootloader with your own keys to prevent other system images from being used on the system. It seems like such a system would provide much better anti-theft guarantees than existing solutions like CompuTrace/Lojack.
Isn't that what Bitlocker and Secure Boot do essentially?
https://docs.microsoft.com/en-us/windows-hardware/design/dev...
Re: Safeboot: Booting Linux Safely
#6Does anyone know if anything similar is possible with Windows? I am interested in the idea of signing the bootloader with your own keys to prevent other system images from being used on the system. It seems like such a system would provide much better anti-theft guarantees than existing solutions like CompuTrace/Lojack.
Isn't that what Bitlocker and Secure Boot do essentially? https://docs.microsoft.com/en-us/windows-hardware/design/dev...
In its typical configuration, Secure Boot can't provide any anti-theft guarantees because an attacker could just replace the contents of the disk with a new Windows installation and the workstation would be usable for them.
Secure Boot as it is configured by Windows only prevents malware from inserting itself into the boot process, since all Windows installations use the same signature. Bitlocker only prevents attackers from accessing the data on the disk, not from using the workstation in general.
Re: Safeboot: Booting Linux Safely
#7> fTPM tampering is out of scope since the ME is the root of all trust in the system I'm wondering about this assumption. Hasn't the ME previously been shown to be fairly straightforward to exploit?
ME has had exploits, but it has also had patches.
Re: Safeboot: Booting Linux Safely
#8If every Linux user would boycott AMD to release their source, then we could have libreboot: https://libreboot.org/amd-libre.html ME vs PSP isn't much of a choice. Of course POWER might be an option eventually, but isn't for most of us currently.
Boycott AMD, and obviously Intel [0]. Doesn’t really leave a lot of options.
Re: Safeboot: Booting Linux Safely
#9If every Linux user would boycott AMD to release their source, then we could have libreboot: https://libreboot.org/amd-libre.html ME vs PSP isn't much of a choice. Of course POWER might be an option eventually, but isn't for most of us currently.
It looks like that stuff was hot 3 years ago. Is there a newer (more likely to pay off) push? I'd happily tell AMD that I'm in the market for an expensive new system and I'd instantly go with Ryzen if it were open. As it stands now I'm leaning Intel because it's the devil I know.
Re: Safeboot: Booting Linux Safely
#10If every Linux user would boycott AMD to release their source, then we could have libreboot: https://libreboot.org/amd-libre.html ME vs PSP isn't much of a choice. Of course POWER might be an option eventually, but isn't for most of us currently.
Or, instead of boycotting, work towards sensible laws for obliging software/hardware providers to provide sources.