Is there actually any use for secure boot?

[18358414]

Recently I was having some issues installing NVidia drivers and the resulting fix was to disable UEFI secure boot.  Surprisingly, disabling secure boot was very easy to do in the bios leading me to wonder why it's even used to begin with.

 

Secure boot is supposed to prevent 'untrusted' software from running on the machine, but if you can just disable it in the bios with a few clicks then is there really any point to it at all?

[gbergeron]

1 minute ago, 7he404guy said:

Recently I was having some issues installing NVidia drivers and the resulting fix was to disable UEFI secure boot.  Surprisingly, disabling secure boot was very easy to do in the bios leading me to wonder why it's even used to begin with.

 

Secure boot is supposed to prevent 'untrusted' software from running on the machine, but if you can just disable it in the bios with a few clicks then is there really any point to it at all?

Secure boot is made to stop any non-microsoft software to boot from USB key.

 

It's a safety.

 

You can put a password on the BIOS to avoid people going in and turn it off. 

[Granular]

You can't disable it on a system where UEFI settings are behind an administrator password and you can't disable it remotely, someone who's hacked your system can't make it boot their compromised OS.

[wasab]

I used secure boot for all my Linux distos. I am security paranoid, which is why I used Linux in the first place. I had some first hand experiences witnessing how easily it is to break into others system.

 

i used lvm encryptions to encrypt all my Linux partitions, use a password to lock down my bios, and secure boot to prevent booting from another OS.

[wasab]

25 minutes ago, gbergeron said:

Secure boot is made to stop any non-microsoft software to boot from USB key.

 

It's a safety.

 

You can put a password on the BIOS to avoid people going in and turn it off. 

Hilariously, you can actually set it to stop windows boot and trust boot from Linux systems as well. Although that is quite pointless because anyone can download the Linux source code and insert malicious codes into it. Best practice is just lock down third party boot in the bios and set a password to restrict bios access.

[paddy-stone]

30 minutes ago, wasab said:

I used secure boot for all my Linux distos. I am security paranoid, which is why I used Linux in the first place. I had some first hand experiences witnessing how easily it is to break into others system.

 

i used lvm encryptions to encrypt all my Linux partitions, use a password to lock down my bios, and secure boot to prevent booting from another OS.

I thought LVM was so you can shrink/enlarge volumes more easily?

 

[edit] - nevermind I know what you mean now  https://security.stackexchange.com/questions/39080/ubuntu-lvm-encryption

[Wild Penquin]

I think secure boot has it's uses in situation where a potentially malicious user (schools students?) has access to a computer, or if the computer is on the go and it can not be guaranteed it is under the eyes of the owner all the time (and a malicious user might have time to boot some other OS).

 

Granted, if a user has physical access, he can do whatever with the computer provided he/she has enough time. But secure boot makes it more difficult, and often non-feasible to boot another OS. But if it is the data that needs (malicious read) protection, encryption is a way better protection (and a separate thing from secure boot).

 

But then again, on computers without secure boot, you could lock down BIOS with a password, and set it to boot only from a single source / hard disk (which is good enough for schools etc.).

 

I guess secure boot could allow booting from some other media which has boot entries signed with trusted keys?

 

TL;DR: it certainly has some uses, but a home user usually has little. Some conspiracy theorists say it was invented by Microsoft to prevent booting Linux, but I think that is mostly baloney

[wasab]

1 hour ago, Wild Penquin said:

I think secure boot has it's uses in situation where a potentially malicious user (schools students?) has access to a computer, or if the computer is on the go and it can not be guaranteed it is under the eyes of the owner all the time (and a malicious user might have time to boot some other OS).

 

Granted, if a user has physical access, he can do whatever with the computer provided he/she has enough time. But secure boot makes it more difficult, and often non-feasible to boot another OS. But if it is the data that needs (malicious read) protection, encryption is a way better protection (and a separate thing from secure boot).

 

But then again, on computers without secure boot, you could lock down BIOS with a password, and set it to boot only from a single source / hard disk (which is good enough for schools etc.).

 

I guess secure boot could allow booting from some other media which has boot entries signed with trusted keys?

 

TL;DR: it certainly has some uses, but a home user usually has little. Some conspiracy theorists say it was invented by Microsoft to prevent booting Linux, but I think that is mostly baloney

I think the bigger problem is not about preventing boot but rather what happens if someone simply takes your hard drive out of your computer, plug it into his own computer, mount it on whatever operating system he uses? Lo and behold, all your bios protection, secure boot, and user login password are completely bypass.

 

Bottom line, you gotta encrypt your drive. Else if your computer is stolen, all your privacy and data go out the window 

 

 

[Shoe_Eater]

it is a 'safety feature' by microshit basically to stop the computer from booting to anything that isnt a UEFI version of windows, which basically means you cant run old windows or linux. it is required to be part of all computers that ship with windows preinstalled as part of the contracts with microshit, and for the contracts for windows 10, there doesent actually have to be a way for the end user to disable the 'feature' but the only reason why you still can disable it is because no manufacturer wants to be the first to deny people the right to install windows on their machines. 

[Wild Penquin]

@wasab Agreed, that's why I mentioned encryption

 

@Shoe_Eater Now that you put it that way .... I don't think it is that far fetched that implementing secure boot could not have some motivations aiming at some kind of monopoly on the OS market. Granted, it can be easily disabled currently on most computers. But, that does not necessarily need to be so in the future! "Embrace, Extend, Extinquish" as someone said at M$; and in this case they are at Embrace or Extend -stage, slowly moving to Extinquish (I certainly hope that is not the future)....

Edited November 13, 2018 by Wild Penquin
spurious negative