Hacker News Reader

Comment by UnoriginalGuy | Hacker News Reader

The thing about secure boot is that it is a GOOD idea done very badly indeed.

What was needed was for a trusted neutral party(or two) to be the owner of the root key, and for that organisation to hand out child keys (e.g. Microsoft, Open Source Initiative, Apple, etc) who could in turn generate child keys (all of which could be revoked). Essentially we need the "internet model" of key exchanges for this too.

I cannot understand who thought it was a good idea for Microsoft to be the only authorised party to generate keys. Even from Microsoft's perspective it is just asking to get anti-trust-ed again.

View on HN

The internet model of key exchanges sucks, and there is currently much wailing and gnashing of teeth over what to do about it. That's what linus is talking about here:

"They are almost certainly going to be more secure than depending on some crazy root of trust based on a big company, with key signing authorities that trust anybody with a credit card."

Not to mention this kind of thing: https://bugzilla.mozilla.org/show_bug.cgi?id=476766

Also, when it comes to stuff this important, there is no such thing as a trusted neutral party.

The internet model of key exchanges /does/ suck, but yet somehow the Secure Boot model is yet worse still.

The main issue with the internet model is how uncompetitive the whole thing is. You have just a few companies handing out keys and they charge upwards of $50 a year just for the "pleasure" of having secured communications.

Secure boot would likely suffer from the same problem. But yet I'd still take that over this...

The nice thing about SecureBoot is that there is no root key—you can have whatever keys you like installed on your system, you don't have to get permission from a central authority. If you want code signed with your key to run out of the box on random PCs, you just have to convince each PC manufacturer to include your key in the hardware key-store of the systems they ship, a purely independent transaction.

It's just that, well, there's only really one software manufacturer with enough clout to get all the hardware vendors to include its key, and it's a heck of a lot easier to just get a sub-key signed by their master key than pretty much anything else.

Yes, this is the issue I see in all this.

None of the linux vendors banded together to create a NPO which would simply manage keys, ensure it was avialable to all manafacturers. Maybe even provide a logo/stamp/certification/brand so people can instantly see it's supported.

The fact that ONLY Microsoft have done this isn't really the fault of Microsoft. The fact that devs can't agree on the most elegant way of providing the chain of trust, in a manner which plays nicely is again, not Microsofts fault.

Yet Microsoft is being flamed for this.... Why exactly is this their fault?

What about Haiku, or any other OS which doesn't have a big enough community to get their key in? Why should OS installation be a privilege of popularity, with others forced to jump through hoops?

MS is at fault for pushing this whole system. Whether Linux distros could or not join the system is a red herring.

>MS is at fault for pushing this whole system. Whether Linux distros could or not join the system is a red herring.

What?!

Pushing UEFI, which isn't their design, which has been used by Apple and other for years, or pushing secure boot?

Secure Boot is a damned good idea, and whilst IANAL it appears that for a windows sticker you MUST allow it to be switched off.

So its Microsoft are in fact pressuring OEMs to ensure that people can run other OS's on their kit (except ARM).

What this is about is how the other OS's can get the benefit of SecureBoot, well, if they can't get their act together as I mentioend above, why should they fuss that someone else gets SecureBoot. Lets be hoenst too, most people who need such simple "mum proof protection" are on Windows anyway.

The real use for secure boot is within a single company/organization where you want to control exactly what runs on the computers you own. That's an argument for secure boot to be switched off by default, and for the companies that want it to manage their own keys.

Although Microsoft will now point at me and say "but, but we need to prevent boot sector viruses!" it's telling that no other operating system except Windows commonly suffers from this problem.

> it's telling that no other operating system except Windows commonly suffers from this problem.

This is an honest question, as this area isn't my specialty, but could this be for the same reason that people used to perpetuate the myth that Macs don't get viruses? Attackers simply target the platform with the largest market share.

Linux servers are far more common than Windows servers, and servers usually have loads of bandwidth making them especially valuable targets for spammers and fraudsters.

You don't gain much from having root or kernel level access if you're just sending spam from a machine running an OS that isn't typically checking for malware. Windows is a much more attractive target because you can also get user's bank and credit card details, but doing that entirely in userspace will get you picked up by the (now fairly ubiquitous) malware scanners. There's a strong incentive to move yourself into the kernel there.

But Linux servers require root access (or physical access, which frequently amounts to the same thing) to modify the bootloader. If you've already got root, then you don't really need to install a bootkit - you may as well just install a modified kernel or kernel module rootkit.

Unlike desktops, servers are mostly run by people who have at least some idea of what they're doing.

the key word in your sentence being some.

>it's telling that no other operating system except Windows commonly suffers from this problem.

There is nothing whatsoever stopping Linux bootkits technically. Please stop spreading FUD.

No it's a shit idea from end to end.

Any PKI based system is a shit idea unless you are personally in control of the trusted root CA, which in this case you're not. I think that is what Linus is saying.

Google for "certificate authority compromised" and you'll see what utter wads of shit for brains this could be entrusted to.

You can be "personally in control of the trusted root CA" using SecureBoot. Just replace the Platform Key with your own key.[1] Or am I misunderstanding your objection?

1. http://blog.hansenpartnership.com/owning-your-windows-8-uefi...

Yes I know this but its more the fact that there is no CRL that a new device can import so you are not in control of the pre-seeded keys. So if you have kit on the shelf for months and MS's private key is leaked or cracked then you have a large stock of compromised machines waiting to roll. I doubt any average PC retailer will be able to deal with manual key revocation. The same goes for your average government agency or health service.

It should ship with no PKI/certificate scheme at all. We don't need it and it doesn't work and its blatantly obvious.

Secure boot is entirely worthless from end to end.

>Any PKI based system is a shit idea unless you are personally in control of the trusted root CA, which in this case you're not

With UEFI secure boot, you can delete Microsoft's key and add you own.

What advantages would any system controlled by a central authority give you that a system which was entirely local and required specific manual intervention (e.g. typing in a pre-set password or private key) in order to authorize any change to the boot loader would not?

"trusted neutral party"

Such as?

Should Microsoft trust WC3?

Or Foxconn trust the United Nations?

Every organization requires funding. How would this party receive it?

Because the world is unfortunately short of philosopher kings, we are probably better served by the marketplace when it comes to hardware manufacture.

I don't know if there's really a good way to implement it.

No matter how you do it, it seems to have the same problems as SSL CAs and certificates (that is, some CAs are corrupt/negligent/compromised).

And in your proposal, what do you do if the root key ever gets compromised?

Reply on news.ycombinator.com