• WormFood@lemmy.world
    link
    fedilink
    English
    arrow-up
    0
    ·
    1 day ago

    Trusted computing was never about security, it’s a way to take ownership of computers away from users and give it to computer manufacturers and Microsoft. It’s also not a good security model.

    • Laser@feddit.org
      link
      fedilink
      English
      arrow-up
      0
      ·
      1 day ago
      1. The spec allows changing keys by the user as far as I know
      2. I’m unaware of a proposal of a better concept that stops attacks at this layer
        • Laser@feddit.org
          link
          fedilink
          English
          arrow-up
          0
          ·
          13 hours ago

          These protections work at different layers and hence, you use both.

          First off, you can’t really encrypt the first boot loader by design, your UEFI needs something it can read and run. You need to protect this first boot stage somehow, and this is what Secure Boot is for; it verifies the signature of the payload it starts to protect it against tampering.