Hacker News Reader

Won't work if you're using UKIs. The kernel command line is fixed, signed and measured into TPM2 and your disk won't unlock

View on HN

Hardly anynone uses that currently & it has a lot of unsolved issues.

What are some of the unsolved issues? Just curious

When the motherboard fails, everything is gone. There is no way around this.

You either accept that your data is irretrievably tied to your motherboard, or accept that your data can be viewed/modified by someone who can replace your motherboard.

No? All you need to do is install to a standard LUKS partition with a good password. Then your data is secure but not irretrievably tied to your motherboard. Granted, that's not UKI, but it's a functional solution.

Yes, TPM is just one way to access your disk. The only reason to use it is in my opinion to not have to enter a super long password on every boot. An extra key if your mobo fails is the way to go. Or if you can't boot after an update, and you don't sign your recovery OS with the same key.

Reply on news.ycombinator.com