Re:All Chromebooks will also be Linux laptops going forward
by DoctorOetker on Thursday May 09, 2019 @12:39PM
(#19869775)
why not just a UEFI menu where you can implicitly authorize the private key by simply entering a public key of choice? 1024 bit = 128 bytes = 256 hexadecimal digits. Totally feasible to enter manually...
[ Parent
| on HN ]
Re:All Chromebooks will also be Linux laptops going forward
by derefr on Thursday May 09, 2019 @12:51PM
(#19869888)
Because that’s still something an MITM in your hardware logistics chain could do to
keylog you, which is what the trusted-boot sequence is designed to prevent.
It might make sense to have a the ability to enter a UEFI key that would disable the dangerous “press to erase” prompt, but I don’t think it would ever make sense to make such a modified machine boot completely silently and “out-of-the-box like” (unless you don’t believe they should have secure boot as a design goal in the first place.)
Probably the most burning in a UEFI key would do is change the “this is a dev-mode laptop” warning to a “this is a customized deployment; if you were expecting a device direct from Google, you are being attacked!” warning.