Re:All Chromebooks will also be Linux laptops going forward
by derefr on Thursday May 09, 2019 @12:51PM
(#19869888)
Because that’s still something an MITM in your hardware logistics chain could do to
keylog you, which is what the trusted-boot sequence is designed to prevent.
It might make sense to have a the ability to enter a UEFI key that would disable the dangerous “press to erase” prompt, but I don’t think it would ever make sense to make such a modified machine boot completely silently and “out-of-the-box like” (unless you don’t believe they should have secure boot as a design goal in the first place.)
Probably the most burning in a UEFI key would do is change the “this is a dev-mode laptop” warning to a “this is a customized deployment; if you were expecting a device direct from Google, you are being attacked!” warning.
It might make sense to have a the ability to enter a UEFI key that would disable the dangerous “press to erase” prompt, but I don’t think it would ever make sense to make such a modified machine boot completely silently and “out-of-the-box like” (unless you don’t believe they should have secure boot as a design goal in the first place.)
Probably the most burning in a UEFI key would do is change the “this is a dev-mode laptop” warning to a “this is a customized deployment; if you were expecting a device direct from Google, you are being attacked!” warning.