• Eggymatrix@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    17
    arrow-down
    8
    ·
    4 days ago

    I get your pc, “tamper” it, then i install a fake bios that tells you all is well and that your tpm and secureboot and whatever else bullcrap they invent is still happy.

    See the problem?

    • Corngood@lemmy.ml
      link
      fedilink
      English
      arrow-up
      8
      arrow-down
      3
      ·
      4 days ago

      It won’t boot though, because the keys to decrypt the system are stored in the TPM.

      Sure you could replace the whole OS, but that’s going to be very obvious and won’t allow you access to the data.

        • PHLAK@lemmy.world
          link
          fedilink
          English
          arrow-up
          7
          arrow-down
          2
          ·
          4 days ago

          If you enable Secure Boot you should also set a BIOS password for this very reason.

          • Saleh@feddit.org
            link
            fedilink
            English
            arrow-up
            12
            arrow-down
            1
            ·
            4 days ago

            So, if you set a bios password either way, which benefit does secureboot give?

            • AlphaOmega@lemmy.world
              link
              fedilink
              English
              arrow-up
              4
              ·
              4 days ago

              Not sure if this works these days, but on older systems there was a reset bios config jumper and pulling the cmos battery.

        • Miaou@jlai.lu
          link
          fedilink
          English
          arrow-up
          1
          ·
          3 days ago

          Can’t access the bios with secure boot on (at least I could not on an old laptop I was refurbishing, thank god the owner could login into windows)

          • jjjalljs@ttrpg.network
            link
            fedilink
            English
            arrow-up
            1
            ·
            3 days ago

            That’s unusual, I think. Every computer I’ve had that had it on, I was able to turn it off when I went to install Linux.

      • atticus88th@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        ·
        4 days ago

        Isnt it possible to have a recovery key? Isnt that technically a backdoor? Maybe the terms are not correct but there is a way in physically.