News for hackers. Stuff that matters.

A comment on I am seriously considering going back to desktop computers. Parent comment

Re:I am seriously considering going back to desktop computers by easton on Sunday October 25, 2020 @08:33PM (#24891553)
You can revoke the keys as a user, it’s just that the system has to trust the Microsoft CA out of the box. If you have purchased a device with Secure Boot capability (including a motherboard), it trusts Microsoft’s CA (since it would be extremely confusing for 99% of users if Windows wouldn’t boot without trusting a key).

My Ryzen board trusted Microsoft out of the box, it has to if they want to pass Windows logo certification. You can check yours here: https://partner.microsoft.com/en-us/dashboard/hardware/searc...

[ Parent | on HN ]
Re:I am seriously considering going back to desktop computers by morganvachon on Monday October 26, 2020 @07:14AM (#24894879)
"...it’s just that the system has to trust the Microsoft CA out of the box"

That's the entirety of my complaint.

Thanks for the link! My board is not on it as I assumed.

[ Parent | on HN ]
Re:I am seriously considering going back to desktop computers by reanimus on Tuesday October 27, 2020 @04:25PM (#24911449)
You can remove Microsoft's certs from the trust store used by the board, though. You can choose to keep them to facilitate dual boot with Secure Boot on, but you can also choose to eject them from the trust store.

Sure, they're loaded by default, and you can argue that we can't prove the board isn't gonna trust them behind your back -- but that applies to older non-open hardware too.

My bigger annoyance is Intel Boot Guard. I want Intel to let us control the firmware more directly -- even if it requires some physical authorization/kills some DRM component in ME or something. But that's not happening anytime soon...

[ Parent | on HN ]