summaryrefslogtreecommitdiffhomepage
path: root/blog/entry/evilmaid.mdwn
diff options
context:
space:
mode:
authorSean Whitton <spwhitton@spwhitton.name>2018-02-14 13:03:29 -0700
committerSean Whitton <spwhitton@spwhitton.name>2018-02-14 13:03:29 -0700
commit0bf5e55fc6587ff26433b594e1d07d08cd3a5685 (patch)
tree9772c2e3cd08a0a768e259f6f4508e1da473927c /blog/entry/evilmaid.mdwn
parent4b15efccb4c1bba2bcc0a7c7a3cdbb4e72428d57 (diff)
downloadwiki-0bf5e55fc6587ff26433b594e1d07d08cd3a5685.tar.gz
note about MBR/GPT
Diffstat (limited to 'blog/entry/evilmaid.mdwn')
-rw-r--r--blog/entry/evilmaid.mdwn10
1 files changed, 6 insertions, 4 deletions
diff --git a/blog/entry/evilmaid.mdwn b/blog/entry/evilmaid.mdwn
index dda548d..0864173 100644
--- a/blog/entry/evilmaid.mdwn
+++ b/blog/entry/evilmaid.mdwn
@@ -106,10 +106,12 @@ always be mounted. If we are using BIOS, the evil maid reoccurs since
it is not that much harder to modify the code in the post-MBR gap or
the BIOS boot partition.
-My proposed solution, pending UEFI Secure Boot, is to use BIOS boot,
-keep `/boot` in the encrypted root partition and `grub-install` to the
-USB drive. Then set the laptop's boot order to never try to boot from
-the HDD, only from USB.
+My proposed solution, pending UEFI Secure Boot, is to use BIOS boot
+with a MBR partition table, keep `/boot` in the encrypted root
+partition and `grub-install` to the USB drive. Then set the laptop's
+boot order to never try to boot from the HDD, only from USB. (There's
+no real advantage of GPT with my simple partitioning setup but I think
+that would also work fine.)
How does this solve the various issues I've raised? Well, the amount
of code on the USB drive is very small (less than 1MiB) so it is much