• Limonene@lemmy.world
    link
    fedilink
    English
    arrow-up
    4
    arrow-down
    1
    ·
    4 days ago

    A person with physical access can tamper with the OS, then tamper with the signing keys. Most secure boot systems allow you to install keys.

    Secure boot can’t detect a USB keylogger. Nothing can.

    • 9tr6gyp3@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      3 days ago

      The signature checks will immediately fail if ANY tampering has occurred.

      Adding a USB keylogger that has not been signed will cause a signature verification failure during boot.

      • Limonene@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        ·
        3 days ago

        A USB keylogger is not detectable by the computer, not in firmware nor operating system. It passively sniffs the traffic between the USB keyboard and the computer, to be dumped out later.

        • 9tr6gyp3@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          3 days ago

          If your keys are stored in the TPM for use during the secure boot phase, there will be nothing for it to log.