Hacker News new | ask | show | jobs
by Hizonner 695 days ago
Platform keys can be replaced given physical access to the computer. In fact they can generally be replaced by regular UEFI updates.

The problem here is in trusting, nay expecting, your average motherboard maker to either know anything about key management or give a shit about key management.
1 comments
commercialnix 695 days ago
Not any less reasonable than expecting a mechanic to be competent and knowledgeable with brakes.
link
Hizonner 695 days ago
... except that in my experience most mechanics are competent with brakes, and most motherboard makers are not competent with cryptography, or indeed with anything having to do with software.

The auto repair industry has certain standards, and the computer industry... doesn't. In fact, the computer industry does everything it can to insulate itself from any kind of responsibility.

link
commercialnix 695 days ago
> most mechanics are competent with brakes

Because if they aren't and something happens the mechanic is the one who ends up rotting in a cell. Put the same penalties in place for ODMs and OEMs, mandating that machine owners absolutely always can change the locks to their own property, and mysteriously every single problem we have ever seen with secure boot is no longer some obscure inevitable unavoidable technology issue.

link
plasticchris 694 days ago
Exactly why I do my own brakes.

And why I want to control my own keys.

link
jeroenhd 692 days ago
Luckily, you can ignore the factory keys and load your own. This issue affects the default configuration, from what I can tell loading in your own PK will override the built-in ones.
link
commercialnix 691 days ago
I was thinking about this too, thinking about the TPM 2.0 configuration of some machines. However, the keys used by TPM are not the "platform key".

> from what I can tell loading in your own PK will override the built-in ones

How can one go about doing this? If you have any resources that can show how, please share them. The public key of the "platform key" is "fused" into the hardware, is it not?

link
commercialnix 693 days ago
> And why I want to control my own keys.

Such as the keys to one's own house.

link