Intel OEM Private Key Leak: A Blow to UEFI Secure Boot Security

Re:Intel OEM Private Key Leak: A Blow to UEFI Secure Boot Se... by cptskippy on Saturday May 06, 2023 @03:52PM (#35844812)

Doesn't this enable them to be installed on systems with Secureboot enabled without having the user muck around in the BIOS? Smart for VMs?

[ Parent | on HN ]

Re:Intel OEM Private Key Leak: A Blow to UEFI Secure Boot Se... by TacticalCoder on Saturday May 06, 2023 @03:56PM (#35844835)

I can see your point but, geez, that's pretty depressing if it's the only reason it's supported!

As a sidenote for having installed Debian with SecureBoot on on several systems, I'd say I still had to muck around quite some in the BIOS/UEFI. Latest one I scratched my hair for a bit was an AMD 3700X on an Asrock mobo where I somehow had to turn "CSM" (Compatibility Support Module) off otherwise Debian would stubbornly start the non-UEFI (and hence no SecureBoot) installer. On my Asus / AMD 7700X things were a bit easier but I still had to toggle some SecureBoot setting (from "custom" to "default" or the contrary, don't remember). All this to say: it's still not totally streamlined and users still need to muck around anyway.

[ Parent | on HN ]

Re:Intel OEM Private Key Leak: A Blow to UEFI Secure Boot Se... by Vogtinator on Saturday May 06, 2023 @04:12PM (#35844968)

There's another reason but it's even worse: Some certifications require that secure boot is enabled.

[ Parent | on HN ]