BIOS/UEFI password

Is adding a BIOS or UEFI password potentially compromising my security? I know it's relatively easy to circumvent via CMOS reset, but does it actually weaken my security position? Is password recovery from BIOS/UEFI possible or common? My view is that if an attacker has a limited amount of time/resources available to them, would they even bother trying to recover a BIOS/UEFI password, or would they just charge through with a CMOS reset/pull drives or something?

>>6583 >My view is that if an attacker has a limited amount of time/resources available to them, would they even bother trying to recover a BIOS/UEFI password, or would they just charge through with a CMOS reset If you put a padlock on your case they probably won't have time to do either right? >pull drives If you're worried about physical attackers (in a shared house for example), then encrypting your harddrives end to end and keeping /boot on portable media would be smart.

>>6584 >padlock on your case My case doesn't appear to have a spot for a Kensington lock (yeah, most can be defeated with a cardboard tube). Any recommendations for other methods of trying to secure a case? >encrypting your harddrives end to end and keeping /boot on portable media would be smart I haven't gone full blown anti-evil maid yet, although that could be a fun project. I do have my drives encrypted, but I suppose my /boot is still vulnerable. Threat model is less long-term APT and more local law enforcement. In the event equipment was seized it would be considered burnt.

>>6586 >Any recommendations for other methods of trying to secure a case? Not really. I tried locking up a laptop in a laptop bag, at least it would be tamper evident if someone cut it open with a knife right? Dumb idea, it overheated. >Threat model is less long-term APT and more local law enforcement. Make sure you know if your country has any key disclosure laws. Encryption won't help if they can just put you in jail until you give them the key. At that point you need to think about how to convince them it is not encrypted or that you don't have the key (anymore). From what I've read in news articles though, the favorite trick of law enforcement everywhere is to create a distraction while your machine is powered and then take it. Like towing your car or smashing a window, anything to make you come outside with the machine still powered on. In the case of DPR they started a fake fight in the library he was in and then snatched his laptop while he wasn't looking. Similar thing to the owner of AlphaBay, plain clothes police smashed his gate down "by accident" and he came running out of his house to see wtf was happening.

UEFI with TPM and BitLocker if you're running windows.

>>6588 no hibernate? :O >>6590 or coreboot a box

i got a bootup password, tried to bypass it with kali, and failed.

I always use a BIOS pass on my personal machine.

>>6583 It's pretty useless if you attacker: 1. Has physical access 2. Has unlimited time/resources at their disposal But really it can keep away petty prying eyes like a nosey roommate or family members. Really, there's no harm in having it.

>>6583 I could see this hurting your security if the password that you use for bios is re-used for anything else. We only have so much memory in our meatware for passwords, and even for the few you need to have memorized (bios, disk encryption, login, password manager, recovery email account, etc) I wouldn't be surprised to learn you re-use some element or there's some theme that ties them together. If someone can get the cleartext for your bios password, that could then be used against you for other memorized passwords.

>>6803 If you really wanted to put up with it, you could elect to have the password manager randomly generate a BIOS password and store it, assuming you're willing to give a smartphone access to your password manager and deal with the hassle of typing a randomly generated password in every time.

>>6584 >encrypting your harddrives end to end and keeping /boot on portable media If you libreboot your machine you can encrypt boot (https://libreboot.org/docs/gnulinux/). That would be a more secure way to do it.