Secure boot certificate rollover is real but probably won't hurt you

It increases security in certain circumstances. Mostly for Windows users at big corporations.

For example, you want your users' laptop hard drives to be encrypted - but also you have users who regularly forget their passwords? With bitlocker their hard drive can decrypt itself, so they only need to remember their windows login, which you can reset remotely.

You give laptops to your field workers, who have full physical access and would love to play video games or access netflix when work puts them in a hotel over night with nothing to do? With secure boot you can keep your precious spreadsheets locked down, even if they're willing to boot from USB sticks or swap the hard drive.

And perhaps most importantly, it has "secure" in the name. So the corporation's IT security auditors will like to see it turned on even if they have only a vague understanding of what it does.

Maybe you are too young for this but viruses modifying boot partitions was a big thing back then. It is simply impossible to inject some code without finding an exploit in UEFI with Secure Boot or somehow exploiting the kernel. It is still possible to do this kind of hack but it is 2 orders of magnitude harder.

Linux distributions have been shipping with secure boot support since 2012, so if that was the goal it had already failed over a decade ago.

Yes, it does, for some values of security. Operated correctly it allows you to know you can trust everything on your system from the UEFI firmware down, because if any part of that chain didn't match what you were expecting to be there the next step in the chain would refuse to execute.

Most people experience this via Windows, which automatically sets up that chain of trust so that you can know you've not had a rootkit injected somewhere. In other cases it may be Linux or something more exotic booting, and it requires some management by whoever is operating the device, but that comes with the benefit of knowing that if one of our devices has got to the point of decrypting it's storage we can be reasonably confident that it hasn't been tampered with, and so we can trust it to send good data.

SecureBoot and UEFI were "bundled" with Windows 8.0 PC's to curtail the possibility of users easily installing Windows 7 instead.

Earlier versions of Windows were a much bigger threat to adoption of Windows 8 than Linux was.

Is secure boot even enabled by default?

I have never used it on my gaming PC and Windows doesn't seem to care.

Most security features are, yeah.

The cost in terms of freedom/flexibility and reliability/longevity is very high. But we're told, this is necessary, it's the only way to guarantee the security of the poor user. But if in practice the security wasn't actually guaranteed, for most motherboards over most years, due to pretty big dumb oversights ... was it worth the extreme costs? The cost of losing compatibility with older or newer software/hardware, of losing convenient repairs and recovery? Nope.

You sold your soul for "guaranteed security" of securing the entire boot and runtime from the lowest level hardware up ... and didn't really get it anyway.

You won't be able to switch it off for long. See how many phones still have that option! [1]

In the end what matters is always money. Always.

What brings more money? TiVo or buyer-owned device? You think 5% of technically competent potential buyers would make a difference when the 95% illiterate users will just replace the product no questions asked?

It started as a fight against piracy and half-competent users that break their own systems (and the company's systems too, like you said). But slowly the industry sees that there's more money to be made if the same technology can provide a belivable argument in right to repair and planned obsolescence court cases.

[1] https://github.com/melontini/bootloader-unlock-wall-of-shame

> you're making a TiVo style product you want to harden against the device owners.

This sentence just makes me so sad

You can't play many videogames if you do this, as anticheat won't let the game run unless secure boot is turned on

I'm surprised more huge corporations don't move towards a "Chromebook only" by default. Now you don't have to manage anything. We're all doing our work in browsers anyway.

Even if you can, there might be dark patterns to discourage you, such as showing a "boot screen of shame" if its turned off.

Go in the BIOS and switch it off?

Certainly. Just one problem: Modern consumer BIOS interfaces are graphical and your GPU is off.

> But when the user is the device owner? Doesn't do much.

A decent Secure Boot implementation together with a BIOS/EFI password at least makes the life of US CBP or similar thugs wanting to use my devices against me much more difficult.

And no, that's not an imaginary threat, certainly not under this administration which has come under fire multiple times for first detaining and then deporting random tourists.

Bitlocker

I know about italics, but this is intentional; I'm expressing outrage.

I see. I've never had to deal with any Option ROMs myself. In that case the easier option is to add their hash to db?

That's what I suspect as well. But would this have any actual security benefit or is it just a way to force people to abandon their old hardware like speculated in https://news.ycombinator.com/item?id=44748323 ?

Not like that, you can't. Firstly, that's not a KEK cert - the KEK cert is "Microsoft Corporation KEK CA 2023". And secondly, mokutil manages the MOK database, not the firmware database. MOK keys control what shim will trust, but it's the firmware keys that control whether or not shim will boot in the first place.

Users should absolutely be able to install the db update by hand if they choose to, but it's late and I don't have the commands to hand. I'll write another post on this soon.