Hacker News Reader

A physical keylogger is more complicated then messing with the EFI boot partition and adding some persistent code to the initramfs or kernel.

Some people might say they have a detached bootloader (secondary USB which contains the LUKS headers+bootloader), but that depends on them actually keeping the two separate. Even then there is no way to authenticate what you are booting.

View on HN

> Even then there is no way to authenticate what you are booting.

Let me introduce you to TPM, signed binaries and measured boot!

However, the most secure ways usually involve a flashed kernel (coreboot) on a write protected NAND chip, of course with encrypted root, that start the boot process by dumping and sha'ing the NAND and comparing that to the whitelist.

TPM usage assumes Secure Boot though. It's fairly useless if you are booting malicious files.

With enrolled keys and a password protected bios that refuses to add boot options to the boot menu, and refuse to boot existing options if the signature no longer matches, you can't be booting malicious files.

And that is what Secure Boot does for you. Not the TPM.

And to do that, a TPM is needed to keep the keys/signatures

Reply on news.ycombinator.com