Actually done this twice, once in '10 and again in '16. BIOS issues only came up a few times in some chain cybercafes that were locked down. Never had any problem with the mom in pop cafes that were managed by hand. The rest of the time it was an office, friends/family, hotel, or my own laptop. In those cases, I didn't have to modify any BIOS, it was enough to boot with and pressing Esc, F1, or F12 to brings up the boot menu.

> risk of keyloggers means even if you boot your own OS.

While it's likely the OS of some of the machines I used were infected, the odds of them carrying firmware based backdoors was not a concern. The odds of getting dengue fever were far more likely than a hardware level hack. Those attacks are very hardware specific limiting the potential for widespread infection. At the time Snowden was still fresh on my mind. So I was more concerned with the NSA was sucking down all my emails / cloud data. There is only so much you can do.

Had I been using the OS on the cybercafes, I'm sure my risk of getting keylogged would have been 1000x more than using my own OS on their hardware.

I was talking about physical keyloggers, something not unknown in cybercafes. Booting your own OS doesn’t get around them.

When I plug in my USB key, I have to inspect in the back ports of the compute, where I easily can spot a hardware keylogger. I've never seen such a device in the wild. Sure it’s possible a cybercafé somewhere in the world has one... but how big a threat is this really? I'd say my risk of Dengue Fever was 10000x more likely than this. Never mind how easily it would be to detect.

How many of their users bring their own OS on a flash drive? In my travels, I only met only 1 other. One. He was running Tails. And as I said the chains with their management software and BIOS lockdown don't even allow this. So we're talking mom and pop cafes.

Now do you think those small time owners are going to spend their money to add this additional cost to spy on that one traveler who has his own OS? That make zero sense when they already control the OS and network. So much easier to spy on customers on that level. In that case, VPN + my own OS circumvents them.

Your paranoia only makes sense if I was going to DEF CON or some kind of a target of state level spying.