No Secure Boot / AEM

[wvrbocv]

I wanted to switch to Qubes for the security by isolation, but one of the things that struck me was that there is no support for any form of secure boot. Sure, there is AEM but that is only available for devices with IME enabled, which mine (using dasharo UEFI) does not have. Considering it’s a desktop, if I was to go full paranoia I would like to know for sure that my hardware has not been altered with while I was away, and without this feature the whole security promise falls apart for me. Am I the only one that feels this way?

[fsflover]

Hi @wvrbocv, welcome to the Community. Apart from AEM, one can also use Heads with Qubes. (You would need to have TPM in your hardware to use both, Intel ME is AFAIK not necessary.)

See also:

Verified boot on Qubes -- a lofty dream?

Lately I’ve been re-examining my reasons for using Chrome OS despite the privacy concerns (Google per se isn’t in my threat model, but that doesn’t mean I want to feed them everything) and found my biggest reason is its use of verified boot, which ensures that only signed and approved code is executed. The root of this trust (not sure if correct terminology) is in a ROM. When combined with powerwash and a small attack surface, this means that even if malicious actors do somehow punch through th…

and

Secure boot support

I am successfully using TPM with Heads and Librem Key on my Librem 14 to make sure my BIOS is not tampered with.

[deceiver]

I was to go full paranoia I would like to know for sure that my
hardware has not been altered with while I was away

Without a defined threat model, ‘full paranoia’ can mean anything, so it
means nothing.

and without this feature the whole security promise falls apart for
me.

What ‘promise’ are you pointing to?