I’ve never understood secure boot. If someone gains physical access to one of my devices, they can do any number of things to compromise it. I don’t really understand what threat model secure boot protects against, but I have spent so much time digging thru bios settings trying to figure out how to disable secure boot so I can install my preferred Linux distro that it seems the primary “threat” is users who don’t want to install Windows.
Secure Boot is designed to help with malware compromising boot code that runs before the OS gets to run and thus has the ability to hide itself from OS and everything running on it while also able to intercept everything an OS is doing.
Given that often physical access allows secure boot to be turned off, it’s clearly not made to protect against a physical attacker.
Now, what’s left is a bit of a mixture of a political issue and developer laziness that makes secure boot a binary toggle of on=boots only microsoft-sanctioned OSes and off.
Ideally there was a safe way for a user to get their own boot loader and OSes signed to allow them to safely boot their own OS while still being sure that it was the user‘s intention to boot that thing.
> I’ve never understood secure boot. [...] I don’t really understand what threat model secure boot protects against
It helps if you remember the context in which Secure Boot was created. Back then, boot sector viruses and similar malware were common. The way they operated was by hooking the operating system while it was being loaded. The operating system (or software running on top of it, like anti-virus and other anti-malware stuff) could protect itself against something which loaded after the kernel and device drivers, but not against something which loaded before the operating system kernel itself.
That is: the main threat model Secure Boot protects against is boot sector viruses and similar. Even if some malware gets write access to the full raw disk, it still cannot inject itself before the kernel in the startup sequence.
> t helps if you remember the context in which Secure Boot was created. Back then, boot sector viruses and similar malware were common.
At the time the Secure Boot was conceived, boot sector viruses were extinct by about a decade. What was new, was the VM* set of instructions, and the scare that there could be a new kind of boot sector viruses slash hypervisors, which could do a bad things to your computer. There was never such a virus in reality, only hypothesized.
It's to secure Microsoft's control of your computer.
(It's not to secure your computer -- that will remain a roach motel of unpatched exploits. But it will be a roach motel that runs Windows rather than something else).
My pet theory, which I admit might border a conspiracy theory, is that secure boot was intended to prevent the "Windows loaders" used to run pirate copies of Windows.
> If someone gains physical access to one of my devices, they can do any number of things to compromise it.
They really cannot. Of course, this means you have to properly secure other knobs as well: Setup password, custom certificates (so a compromised Redmond certificate is irrelevant, configure your OS to use measured boot and abort on all changes, ...
This would mean: Secure Boot cannot be disabled; Software cannot be swapped out; DMA devices cannot be added.
If properly implemented, Secure Boot, a TPM and full-disk encryption will create a PC that cannot be internally compromised by regular thread actors. External additions (keyloggers and the like) are still possible of course.
The idea there are NSA spies who are simultaneously so active they'll sneak into my home and open up my PC to install a bootloader backdoor, and yet so passive they won't plug in a $5 hardware implant seems.... unlikely.
> I don’t really understand what threat model secure boot protects against
Installing linux.
Yes yes you can disable it (for now), put your own keys (very unlikely) but if you do windows will not boot any longer, unless you also disable disk encryption before disabling it.
Do like rms and think long term. The feature is there to lock which software can run on the machine, and prevent the machine to be used to rip movies.
