Comment on Anon tries running live USB Linux on his dad's computer
9point6@lemmy.world 5 days ago
This is partly Microsoft’s fault, for sure, but it’s also more of a function of how secureboot works. A Linux system using TPM backed FDE with secureboot enabled would have the same problem going the other way.
Secureboot prevents a lot of ways the TPM could be compromised, so as part of “securely” turning it off, it wipes the keys (otherwise those protections would be pointless, the first thing an attacker would do would be to turn off secureboot).
PlzGivHugs@sh.itjust.works 5 days ago
The main problem is it turning itself on with no input from or feedback to the user, and not giving the user access to the key without using a Microsoft account. I’ve heard of people getting screwed by this because they set up with a local account and thus never got their secureboot key (or did, but it was hidden somewhere and they were never told to save it).
9point6@lemmy.world 5 days ago
Oh yeah sorry I should have elaborated when I said it’s partly Microsoft’s fault. This mostly happened because neither of them expected the FDE to be enabled which is on Microsoft for silently enabling it