Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Secure Boot cannot possibly be useful to prevent the installation of other operating systems. Microsoft has a website where they will accept other operating systems to be signed, and there are multiple non-MS operating systems in existence that will boot with no fuss on a machine with Secure Boot enabled. The claim that Secure Boot is bad because MS could decide to stop signing Linux is as ridiculous as the claim that Authenticode is bad because MS could decide to stop signing Firefox, or that HTTPS is bad because MS could replace the set of CAs in Internet Explorer with just itself.

The only way to defeat evil-maid attacks is for the early-boot code in your computer's firmware to cryptographically validate the bootloader or kernel that it's about to start, and make sure it's signed by a trusted authority, and make sure that it's possible for the computer owner to disable the ability for anyone other than him to change the set of trusted authorities. This happens to be exactly what Secure Boot does.



Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: