From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with archive (Exim 4.43) id 1KPcdI-0004k5-8W for mharc-grub-devel@gnu.org; Sun, 03 Aug 2008 08:24:20 -0400 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1KPcdG-0004gO-5t for grub-devel@gnu.org; Sun, 03 Aug 2008 08:24:18 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1KPcdE-0004dx-Uy for grub-devel@gnu.org; Sun, 03 Aug 2008 08:24:17 -0400 Received: from [199.232.76.173] (port=43422 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1KPcdE-0004dm-Rz for grub-devel@gnu.org; Sun, 03 Aug 2008 08:24:16 -0400 Received: from aybabtu.com ([69.60.117.155]:58298) by monty-python.gnu.org with esmtps (TLS-1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1KPcdE-00046u-GS for grub-devel@gnu.org; Sun, 03 Aug 2008 08:24:16 -0400 Received: from [192.168.10.10] (helo=thorin) by aybabtu.com with esmtps (TLS-1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.69) (envelope-from ) id 1KPcW9-0001WV-BC for grub-devel@gnu.org; Sun, 03 Aug 2008 14:16:57 +0200 Received: from rmh by thorin with local (Exim 4.63) (envelope-from ) id 1KPccB-0001Rd-Ke for grub-devel@gnu.org; Sun, 03 Aug 2008 14:23:11 +0200 Date: Sun, 3 Aug 2008 14:23:11 +0200 From: Robert Millan To: The development of GRUB 2 Message-ID: <20080803122311.GA5383@thorin> References: <1216918145.22586.14.camel@dv> <20080725210840.GA19505@thorin> <1217022420.3957.3.camel@dv> <20080725221050.GA31179@thorin> <1217034532.6376.13.camel@dv> <20080727121914.GA11242@thorin> <1217176183.4029.20.camel@ct> <20080727183737.GB16393@thorin> <489591FF.3070601@isaac.cedarswampstudios.org> <20080803120833.GA4302@thorin> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20080803120833.GA4302@thorin> Organization: free as in freedom X-Message-Flag: Worried about Outlook viruses? Switch to Thunderbird! www.mozilla.com/thunderbird X-Debbugs-No-Ack: true User-Agent: Mutt/1.5.13 (2006-08-11) X-detected-kernel: by monty-python.gnu.org: Genre and OS details not recognized. Subject: Re: [PATCH] use UUIDs for cross-disk installs (Re: Issue with boot != root and chainloading) X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: The development of GRUB 2 List-Id: The development of GRUB 2 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 03 Aug 2008 12:24:18 -0000 On Sun, Aug 03, 2008 at 02:08:33PM +0200, Robert Millan wrote: > > This line of thinking is what is commonly used to justify draconian measures > (i.e. Treacherous Computing) but it doesn't make any sense. If your security > policy is such that you don't trust users with physical access, try any of > the following: > > - Crypt your whole disk. Have your /boot in a usb drive you carry with you. > > - Remove your CD drive and unexpose USB slots (use locks or if really paranoid > sink your board in concrete). Or use a crypto module where you load a key from a secure environment and use that to implement measurement during boot. The TPM could have become such module, but they decided to cripple it by: a) Loading the key themselves. b) Not giving you a copy of the key. I still hope sooner or later a sane company (that is, one that understands basic rights like ownership) will manufacture modules for this purpose. -- Robert Millan The DRM opt-in fallacy: "Your data belongs to us. We will decide when (and how) you may access your data; but nobody's threatening your freedom: we still allow you to remove your data and not access it at all."