Re:Authenticated Boot and Disk Encryption on Linux
by Foxboron on Thursday September 23, 2021 @09:51AM
(#28629121)
>Is that somehow configurable from Linux distribution's setup, or it will require user to manually set a BIOS password? (and it requires the user to set a different bios password. if the user sets the same password for fde and for bios, then back to square 1)
Not yet? And when I said "modern computers" i should probably clarify I'm thinking about more enterprise grade computers. Such as Thinkpads.
Thinkpads also recently got the feature to set the password from Linux userspace. But I forget where I read that, and where the patch is located :)
>That sounds interesting. Though it still sounds totally impossible for the vast majority of users.
It is. But this is why threat modelling is important. If a realistic threat scenario is someone replacing your motherboard, then tpm2_totp should be something you setup.
Listing all possible attack scenarios and assuming any generic distribution protect fully against them is a pipe dream. There needs to be some compromise between usability and security.
Not yet? And when I said "modern computers" i should probably clarify I'm thinking about more enterprise grade computers. Such as Thinkpads.
Thinkpads also recently got the feature to set the password from Linux userspace. But I forget where I read that, and where the patch is located :)
>That sounds interesting. Though it still sounds totally impossible for the vast majority of users.
It is. But this is why threat modelling is important. If a realistic threat scenario is someone replacing your motherboard, then tpm2_totp should be something you setup.
Listing all possible attack scenarios and assuming any generic distribution protect fully against them is a pipe dream. There needs to be some compromise between usability and security.