you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 1 year ago (1 child)

With LUKS, your boot/efi partition is still unencrypted. So someone could install a malicious bootloader, and you probably wouldn't know and would enter your password. With secure boot, the malicious bootloader won't boot because it has no valid signature.

  • source
  • parent
  • hideshow 1 child comment
  • Exactly. The malware can do whatever, but as long as the TPM measurements don’t add up the drive will remain encrypted. Given stringent enough TPM measurements and config you can probably boot signed malware without yielding access to the encrypted data.

    In my view, SecureBoot is just icing on the cake that is measured boot via TPM. Nice icing though.

  • source
  • parent