Practical security for 2014 [LWN.net]

Practical security for 2014

Posted Jan 10, 2014 12:49 UTC (Fri) by nix (subscriber, #2304)
In reply to: Practical security for 2014 by nix
Parent article: Practical security for 2014

(Note: I know Matthew said some of this in his keynote, but after wasting two days on fruitless installation horrors I had to vent. :) )

to post comments

Practical security for 2014

Posted Jan 11, 2014 0:51 UTC (Sat) by dashesy (guest, #74652) [Link] (4 responses)

It was a turning point for me at least. No more dual-boot installation, just disabled the secure boot in BIOS and deleted Windows partition. Did not even try to extract the license key first, Windows8 is not worth it.

Practical security for 2014

Posted Jan 17, 2014 12:35 UTC (Fri) by etienne (guest, #25256) [Link] (3 responses)

You should first have tried to run Windows, suspend to disk, and see if the resume from disk did work: if yes, then the "secure boot" can be bypassed completely, seems just like security by obscurity to me (you just need to know what shall be the disk content).
I frequently suspend to disk on my "older" PC to swap hard disk and boot something else, later there is no problem to swap hard disk again and resume...

Practical security for 2014

Posted Jan 17, 2014 13:29 UTC (Fri) by mjg59 (subscriber, #23239) [Link] (2 responses)

Resume from disk is mediated by the bootloader, which (if Secure Boot is enabled) has to be appropriately signed.

Practical security for 2014

Posted Jan 17, 2014 15:37 UTC (Fri) by etienne (guest, #25256) [Link] (1 responses)

But the bootloader, which is signed (we are talking here of the FLASH bootloader), will accept to load an unsigned image of the memory from the disk to run.
The image of the memory in the disk cannot be signed, else it would mean the operating system contains the key to sign that image.

Practical security for 2014

Posted Jan 17, 2014 15:38 UTC (Fri) by mjg59 (subscriber, #23239) [Link]

No, it won't. That's not how hibernation works.