4d ago

Microsoft's Secure Boot UEFI bootloader signing key expires in September, posing problems for Linux users

www.tomshardware.com

Linux @programming.dev

Lee Duna @lemmy.nz

6d ago

Microsoft's Secure Boot UEFI bootloader signing key expires in September, posing problems for Linux users

www.tomshardware.com /tech-industry/cyber-security/microsoft-signing-key-required-for-secure-boot-uefi-bootloader-expires-in-september-which-could-be-problematic-for-linux-users

14 comments

manufacturers could add support for the new key by updating the KEK database
Oh right, the KEK database. They are literally trolling us aren't they.
The actual problem is (and has been for a long time) the enormous amount of absolute trash-level uefi implementations.
Updating keys is easy. Alas... a lot of them are completely broken beyond repair and fail everything but running with the pre-installed keys, which includes updating (or adding new) keys (bonus points for the really screwed up devices that even sign some their own hardware with the pre-installed MS keys thus bricking themselves if those keys are changed).
Not if you disable it, "secure boot" is a joke anyway.
- I mean, Secure Boot does actually help defend against evil maid attacks if paired with FDE. Someone can't just fuck with your /boot (CVE-2016-4484 nonwithstanding) to do naughty things with your system if you have Secure Boot enabled. Does that fit with most people's threat model? I dunno, probably not. It does actually do something useful though.
  My work computer has it enabled and I feel better for it. The issue described in the article is easily dealt with if you just keep up with your firmware updates using fwupd.
  
  Ya, Secure Boot is really only useful for corporate devices or very specific people who might actually be targeted by state level attackers. For most of us, it's not worth the hassle.
  
  It would be nice if system76 did firmware updates via fwup
  It doesn't nor does it protect against tampering what so ever
  
  Just so I have this right, fwupd will update the firmware with the new keys. Just fuzz on if you have to create a new secure-boot key yourself?
- It can be a major security benefit when done correctly.
  I'm not sure if there is a single vendor doing it correctly
- Cannot always be disabled
If you use linux and are dependant on M$, youre doing it wrong
- Well I think we are all doing it wrong then
not a problem
- Never was

14 comments