Hacker News Reader

Comment by saidnooneever | Hacker News Reader

it is stupid to turn it off. It is incredibly easy to infect your system components without your knowning.

that being said, it does assume a certain trust in firmware vendors / oems. If you dont trust those, then dont buy from them.

i think for most ppl trusting OEM or trusting rando from interwebz with a custom hypervisor and requirement to cripple my system security are totally different things ..

u know they could actually make theyr HV support secure boot etc. to do it properly and have ur system run the cracks but not have gaping holes left by them -_-. lazy.

View on HN

If you’re downloading torrents and running code with elevated privileges that infects your PC, 99% of people are absolutely hosed at that point anyway. I don’t see th real distinction between being owned at an elevated system level and owned by disabling system secure boot for a home user

pwned at the bios level means the pwnage can survive a complete OS reinstall

Secure boot is an attempt to make covert persistence of an infection harder, that's all. It doesn't make it more or less likely for you to be compromised in the first place (and in general compromise of your user account is enough to be a big problem: most malware doesn't even need admin access let alone the ability to modify the parts of the system protected by secure boot)

As always in security, It Depends™; there are vulnerabilities that only impact systems with secure boot (and result in a situation worse than not having secure boot to begin with).

> there are vulnerabilities that only impact systems with secure boot

Boring claim, obviously true.

> and result in a situation worse than not having secure boot to begin with

A very big claim that requires evidence.

If your system gets locked (I.e. ransomware) and you have secure boot active, then you are out of luck.

See Apple M chips which if they get locked you will never unlock them again.

This is not a real vulnerability though.

Reply on news.ycombinator.com