Hacker News Reader

Comment by userbinator | Hacker News Reader

disabling secure boot

...making it even more clear what "secure" boot actually secures: the control others have over your own computer.

It has their uses. If, for example, a company wants to issue fleet computers to workers or school to students, you want to have secure boot on those devices to prevent tampering. Secure boot makes it so that physical access is not the end all of security.

If you own the computer yourself, you "ought" to be able to turn off these measures in a way that is undetectable. Being unable to do so would be the red line imho - and looking at those hypervisor cracks available, it's not quite being crossed. The pessimistic, but realistic future prediction is that various media companies would want and lobby for machines to have unbreakable enclaves for which they can "trust" to DRM your machine, and it's just boiling the frog right now. Windows 11's new TPM requirement is testament to that.

Switch to linux asap - that's about the only thing a consumer is capable of doing.

This is coming. In particular, without a Secure-Boot-enforced allowlist of operating systems, it will be near impossible to verify that an OS connecting to the internet complies with your locality's age verification laws, so it will soon be illegal to run a computer that does not make Secure Boot mandatory and connect it to the network.

If you're starting to think "huh, maybe that's why these age verification laws suddenly became all the rage", you're onto something. Whatever the case, "general purpose computing" is definitely cooked.

General purpose computing as it was done in the 1900s is cooked for the average user because there is no market incentive for it to exist. The actual market incentive revolves around apps as they provide user value along with the ability to deploy custom apps.

The laws in my locality place requirements on the service provider (e.g. the adult website operator), not on random computer owners or manufacturers or software vendors.

Newsom signed a law that places those requirements on every operating system in California, and in practice, organizations tend to comply with California's terrible laws no matter where you are, rather than stopping doing business there or making two variants of their products.

With software it's trivial to have a switch for "California compliant" mode, but in any case, that makes it clear that such criticisms should be directed at California. Other (generally "red") states already had a more reasonable solution: make the sites offering the restricted service liable for their actions just like other businesses.

The problem is that you could face liability if you do business in the United States and permit a minor in California to use an OS in non-California-compliant mode. If you're an "OS provider" in Wichita, KS, California will find that its jurisdiction still applies because the minor was in California and sue you in its courts. If you fail to turn up that's a judgement for the state by default. (And if you do turn up, it's a judgement for the state as soon as they prove a kid ran your non-age-checking OS.) And, thanks to the "full faith and credit" clause of the Constitution, California will be able to collect on its judgement against you in Wichita.

Hardware vendors are not going to want that kind of liability, in California, Colorado, New York, or anywhere else. So they will switch to selling hardware with locked bootloaders and only allowing approved operating systems within that locality (which for end-user PCs will mean pretty much just Windows). There is still foreign hardware, but those chinesium PCs are going to be confiscated by ICE unless the Chinese manufacturers also play ball.

Besides all this... federal legislation is coming.

If you'd humor me, or just read the last paragraph for a tldr...

So let's say a PC builder(an individual; not a company) were to donate a PC to charity. Let's say it's built with a fairly recent MSI motherboard(https://www.amazon.com/dp/B0BRQSWSFQ/) 'MSI PRO B760-P' if you'd prefer to avoid amazon.

I remove all my internal SSDs and NVME drives but buy a new 1tb SSD for whoever receives the PC. I also install a Linux OS, as well as sign the secure boot keys via sbctl myself, setup ukify, efibootmgr, etc. Everything the recipient would need to switch over to another OS if they so choose.

But oh no, the donated PC landed in the hands of Johnny, a 17-year old in California.

So who's at fault here, MSI for creating a BIOS that allows for non-windows EFI images to be installed? The PC Builder(donator) for knowingly installing Linux(though not knowing where it would end up)?

This is kind of what confuses me and I'm curious what this means for future hardware sold in the US and those who build PCs for their own use or others. Most modern motherboards are "locked down" by default, but can easily be unlocked by the end-user, it may take a few extra steps or be a bit harder to find but still pretty simple for someone moderately tech-savvy.

The full faith and credit clause does not apply if the court lacks jurisdiction, which California clearly would. There's a reason "California compliant" already exists as a phrase; you can buy and sell things that break California law outside of California. If you bring it in that's on you.

> If, for example, a company wants to issue fleet computers to workers or school to students, you want to have secure boot on those devices to prevent tampering. Secure boot makes it so that physical access is not the end all of security.

Measured boot is actually better for that: You can still boot whatever you want however you want, but hashes are different which can be used for e.g. remote attestation. Secure boot has to prevent that "unauthorized" code (whatever that means for each setup) can ever run. If it does, game over. That means less freedom and flexibility.

Measured boot isn't any better. Look at Android phones, where it's technically possible to unlock your bootloader, but a ton of apps (e.g., McDonald's and most banking apps) use remote attestation to see whether you did so and will refuse to work if you did.

Yep.

Exactly why i said

> turn off these measures in a way that is undetectable.

If you own the device, you ought to have the means to make such configuration/changes in undetectable ways. Otherwise, you don't truly own the device.

Some apps want to run on devices that you don't "own", because they are doing something the owner would not want done (in secret or what not).

McDonald's does that? Their App works fine on Lineage 22.

Having an operating system purposefully allow support to installing rootkits should clearly be a bad idea. It shouldn't be surprising you have to turn off security features to install a rootkit.

Anti-cheat drivers are just as much of rootkits, and in practice, they have vulnerabilities that get a lot more hosts pwned than cheats do. Let's get Microsoft to stop loading their drivers.

I agree. Microsoft should provide proper integrity APIs to apps so they don't need such drivers. The fact that the PC ecosystem is so far behind XBox's for platform integrity is a big failure on Microsoft's part towards the PC gaming market.

The "integrity" you speak of is a bad thing. Microsoft should be making that harder to obtain, not easier.

Integrity is needed for a fair playing field. Their is consumer demand for such a fair playing field so it is a good thing for an operating system to respond to customer demand.

it is stupid to turn it off. It is incredibly easy to infect your system components without your knowning.

that being said, it does assume a certain trust in firmware vendors / oems. If you dont trust those, then dont buy from them.

i think for most ppl trusting OEM or trusting rando from interwebz with a custom hypervisor and requirement to cripple my system security are totally different things ..

u know they could actually make theyr HV support secure boot etc. to do it properly and have ur system run the cracks but not have gaping holes left by them -_-. lazy.

If you’re downloading torrents and running code with elevated privileges that infects your PC, 99% of people are absolutely hosed at that point anyway. I don’t see th real distinction between being owned at an elevated system level and owned by disabling system secure boot for a home user

pwned at the bios level means the pwnage can survive a complete OS reinstall

As always in security, It Depends™; there are vulnerabilities that only impact systems with secure boot (and result in a situation worse than not having secure boot to begin with).

> there are vulnerabilities that only impact systems with secure boot

Boring claim, obviously true.

> and result in a situation worse than not having secure boot to begin with

A very big claim that requires evidence.

If your system gets locked (I.e. ransomware) and you have secure boot active, then you are out of luck.

See Apple M chips which if they get locked you will never unlock them again.

This is not a real vulnerability though.

Secure boot is an attempt to make covert persistence of an infection harder, that's all. It doesn't make it more or less likely for you to be compromised in the first place (and in general compromise of your user account is enough to be a big problem: most malware doesn't even need admin access let alone the ability to modify the parts of the system protected by secure boot)

It would work just as well if the instructions instead told you to enrol your own key and sign the cracks. Those instructions just aren't as popular.

Cheap take

Reply on news.ycombinator.com