And so can anyone with physical access to the device. I know there's no way to fully prevent evil maid attacks, but Secure Boot helps in that no one can simply plug e.g. a Linux Live USB and wipe my disks in less than 3 minutes
Incidentally, an interesting defense against evil maid attacks involves glitter nail polish. Use it on a sticker over the case and take a photo. To verify your laptop is safe, compare the sticker with the photo. The key is that glitter polish has a lot of minute detail and is thus hard to replicate.
This only gives tamper protection, but evil maid attacks require interaction so it suffices for security.
So, no, the whole secure boot thing is just bullshit security theater and more lock in.
> So, no, the whole secure boot thing is just bullshit security theater and more lock in.
Only if you're only thinking about laptops, desktops, maybe phones and tablets. There are lots of types of machines out there physically exposed to users whom the machine-owners trust to varying degrees, ranging from "not at all" on up.
Think UPS package scanners, HVAC systems, various control systems in everything from warehouses to prisons, sensors and signage controls...
Now, Secure Boot doesn't address anywhere near anything close to "sufficient" in any of those environments, but it is one component of raising the costs of attacking them to a point to make the systems economically viable, or at least apparently so.
If someone disables SecureBoot, then the encryption keys become inaccessible and you will notice that something is wrong.
I don't quite understand your wipe the disk thing, since that will leave a trace, the attacker could just smash your computer or take out your drives.
Combined with a TPU that wipes keys when secure boot is enabled/disabled gives a pretty secure system, that still allows you to "eject" to an unsigned boot when needed.