[fsflover]

The second case requires a professional, dedicated attacker. I use TPM with Heads and a hardware key to protect myself against it. It will notify me if the boot partition or BIOS are tampered with.

As an advantage, all relevant code running on my computer is FLOSS and auditable, unlike the Secure Boot and UEFI.

[npteljes]

That's a cool setup! I didn't know about Heads.

And yes, getting back to the original topic, I believe that against petty criminals, even a full disk encryption is plenty defense. They won't go about installing anything to the EFI partition just to get to the data.

This Coreboot + Heads setup I'd trust to protect against even the more involved.