Post #2668325
2026-05-04 00:56 UTC
Evil maid is one advantage but signed modules is another. Secure boot can prevent you from loading unsigned kernel modules once booted.
You basically need to have both or your computer is practically open for anyone who has physical access to the device.
For my desktop I dont use either but for my laptop i’d never leave home without both.
Replies (1)
-
@savvywolf@pawb.social 2026-05-04 01:07
Once you’re booted secure boot is inactive. If there was a security benefit to only loading signed modules, then distros would have that enabled by default regardless of the secure boot status. Iirc, requiring modules be signed is a requirement Microsoft put on the shim bootloader rather than Lunux’s choice. I could be mistaken here, I’m not too sure on the specifics. Regardless, if someone has the ability to load or modify modules on an encrypted Linux install, they can just steal Firefox’s cookie jar and cut out the intermediate step.