Another attemped power grab by Microsoft

[Ian.MacAllan]

Truth be told, I have not understood most of this thread. So can someone tell me which programmes are being blocked by Microsoft, please?

Regards

Chas

Hi Chas,

My understanding of the situation is only slightly different from that which KiltedCodeWarrior has described in his post. Here is the difference:

My understanding of the proposal is that it is to be implemented much as Secure Sockets Layer (SSL, identified by https://) presently secures connections on the World Wide Web: a client (e.g., your computer) initiates a connection with a server (e.g., a host on the WWW), which responds with a copy of its certificate testifying to its authenticity. If the client finds that certificate acceptable the connection is established and communication proceeds. In the proposed "secure boot" implementation the BIOS plays the part of the client and any software to be executed plays the part of the server.

The point in contention is who shall have the ability to issue authentic certificates, and what their motives may be. The fear of us who distrust Microsoft is that Microsoft will somehow manage to obtain effective control over the licensing of certificate issuers and therefore over what software can be loaded onto our machines, and will use that control to exclude any software which does not provide to Microsoft an amount of power, income, and control satisfactory to Microsoft.

I agree with those who believe that there is great need to improve the security of the boot process, but I do not trust Microsoft to refrain from using that "improvement" to increase its power, income, and control. And that is my answer to your question, Chas: nothing at present, but potentially anything that does not please Microsoft.

Thank you for your interest and concern.

.

[Joshua]

Ian,
In the case that you have mentioned... It makes perfect sense...

EFI stores a certificate that authenticates the MS cert, and unlocks the partition that holds your windows installation. This would not prevent the booting of a secondary operating system, but could potentially prevent moving data between a 3rd party OS and your Windows installation.

This would prevent the biggest issue with disk security today, the use of 3rd party boot disks that allow you to access the local disk, crack a local password, plant a Trojan, and then return the computer to an unsuspecting victim... Who then boots up the computer, uses their domain password, thus exposing their data and credentials...
But the decision to go with EFI could also be beneficial to booting other OS as well, if Linux and other 3rd parties took advantage of the same features, you wouldn't have the age old issues of fighting between multiple boot managers.

[Ian.MacAllan]

The Linux Foundation (among others) is actively and constructively opposing Microsoft in this matter. See <http://www.linuxtoday.com/it_management/2011102900341NWDT>.

See also <http://blog.canonical.com/2011/10/28/white-paper-secure-boot-impact-on-linux/>. Note the link to the pdf RedHat/Cannonical paper.

.