Hacker News Reader

Comment by omnibrain | Hacker News Reader

I'm sure this is a naive take, but why is it not possible to enter a new key into the BIOS (dating myself, I know it's EFI) by hand?

View on HN

It's possible and it's what you should be doing. "sbctl" (https://github.com/Foxboron/sbctl) AFAIK has a reasonable frontend for doing that on Linux (don't know, I did it manually). You have to put the system in "secure boot setup mode" in BIOS/UEFI options before booting, which enables changing the PK (Platform Key) which is used to chain off all the other keys. (Setup mode should be automatically exited when you install a new PK.)

You can keep the Microsoft keys in there if you want to dual boot Windows, you just need to re-sign the keys themselves with your own PK.

It should be, at least on higher-end boards, no?

You'd have control over what boots on your computer then...

you literally have though. you can self sign everything and set up uefi to only boot your signature

Only on x86 secure boot implementations. On most devices with trusted boot, you don't have this option.

uefi on non x86 is a non starter for most people anyways. not that uboot is better

That would be a disaster. Or imagine what would happen if you just disabled secure boot, your computer will be infected with viruses and your bank account emptied instantly I reckon

Secure boot doesn't stop user-space malicious activity.

I'd argue that it only helps check a tick box on corporate security manifest, as it indicates the kernel being booted, is not tampered with.

OP was being sarcastic

it is

Reply on news.ycombinator.com