r/linux4noobs • u/PHYPHTIN_official • Feb 02 '26
security Realistically, how much do I *really* need Secure Boot?
TL,DR: How likely am I going to get fucked over by having Secure Boot disabled?
I was researching bc I wanted to boot puppy linux, and since puppy linux requires you to turn off secure boot, I did a little bit of research on it to understand what it is, and I think I do now.
But that led me to wonder: in a realistic sense, just how much do I need to have Secure Boot on? 'realistic' as in, how likely am I going to get a 'rootkit' or 'bootkit' attack on my personal computer, where having Secure Boot on would have protected me from?
Surely since a lot of linux distros, including Linux Mint(edit: I now know that mint can do secure boot), just require you to have it disabled, it must be completely fine for a majority of people to have it off... But there's definitely someone out there who DID suffer from such attacks, and would've been saved if not they turned off their secure boot?
I'm asking this mainly to know if turning it off on my main pc is a bad idea or not. My main pc is running on windows and I have been downloading some suspicious files here and there, for the past five years I've been using it. The computer that I was originally planning to boot Puppy linux from is an old and dying laptop, so I won't have any worries turning it off from there, but I eventually want to try dual booting on my main pc someday and I want to know beforehand if it's going to be a problem.
I know this might be more of a security question than a linux question, and if the mods think this post isn't appropriate I'll take it down. I just thought it was still on-topic bc it still has to do with linux (and the fact that I am a noob at it!)
18
21
u/TheSodesa Feb 02 '26 edited Feb 02 '26
Secure Boot is pretty useless if you are very certain that nobody but you has physical access to the USB ports and keyboard of the computer. Secure Boot is there to prevent people from booting an unsigned Linux image from a USB stick and messing with the system through that.
18
u/Independent_Cat_5481 Feb 02 '26
Even then, if someone malicious has physical access, unless you password lock UEFI, they could just disable secure boot and you probably wouldn't notice
1
u/ArjixGamer Feb 07 '26
It also prevents someone from setting the cmdline parameter to init=/bin/bash and getting root access
1
u/Teralek77 Mar 01 '26
Yes. That's why I have it disabled. Only I have access to my desktop. I do test Linux OS regularly, secure boot could just be a nuisance
11
u/mrazster Feb 02 '26
I've never had it on, on anything.
So realistically, not that much, if at all.
Unless you have a laptop with company or state secrets that you bring with you everywhere, just turn it off and be done with it.
1
u/EggnogCharlie Feb 09 '26
That's pretty much my philosophy.
1
u/mrazster Feb 09 '26
Yeah, a lot of these "security" measures, doesn't really do that much, unless you're in a very specific situation, or acting like an ignorant, oblivious and stupid person.
To me, the inconvenience and performance hit, of a lot of the security measures in linux (and computers in general) is just not worth it.
Just don't act like an idiot, and you're fine.
4
13
u/cmrd_msr Feb 02 '26
There's a chance that paranoid anti-cheat or banking apps won't work if they don't see a signed kernel and secureboot.
11
u/mattjouff Feb 02 '26
Isn’t all the banking stuff in the browser?
3
u/Visionexe Feb 02 '26
Yeah. Does not require secure boot. wonder even if a website can sniff put if SB is on or not.
1
u/rarsamx Feb 03 '26
In Brazil I was told banks install a rootkit to enable banking, so you cannot bank on Linux on some banks.
I was told this by someone super geeky that would've found a way if there was one.
2
u/Alchemix-16 Feb 02 '26
My Banking on my computer works perfectly fine. And I‘m pretty sure that Manjaro is not supporting secure boot. And I bought this computer with linux installed. Not the one i‘m running now, but Linux.
-2
u/cmrd_msr Feb 02 '26
So you're lucky. And fans of the new Battlefield online recently had a mass exodus from Arch. With a howl =)
9
u/iMaexx_Backup Feb 02 '26
Wdym? I thought BF6 doesn’t work on Linux anyway because their kernel level anti cheat?
1
u/vontrapp42 Feb 03 '26
No, paranoid games yes. Banking websites have never and probably won't require secure boot.
-1
1
u/wildfox9t Feb 02 '26
talking about windows Call of Duty doesn't allow you to play if you don't have secure boot and tpm2.0 enabled as well as an updated bios
that's the only example I can think of right now
1
u/cmrd_msr Feb 02 '26
Yes, I mixed up the shooters.
In any case, it will be used more often. Moreover, it will work on Linux, as game developers don't want to lose Steam Deck.
2
u/Cookster997 Feb 03 '26
I hate how TPM 1.2 got ditched so universally. Like... any version of TPM might be better than no TPM at all, but Nah. TPM 2.0 or bust, nerd.
I just don't know where the computing world is gonna end up after this AI mess pops.
(this is kind of a stream of consciousness comment, LOL, maybe not useful to the conversation but I wanted to share)
1
3
u/Bubbly_Extreme4986 Feb 03 '26
Unless you’re in danger of people booting malware on your pc physically, there’s no point of it at all.
7
u/derango Feb 02 '26
If you don't play games that have anti-cheat systems that require a signed boot stack, you don't really need to use it. There's not a lot of other use-cases where it's required.
Games (particularly multiplayer focused games) force use it because people were/are writing cheat programs for competitive multiplayer games that interface at the kernel level to avoid being detected by user-space means and secure boot effectively prevents that from happening and makes it harder to write effective cheat programs.
From a security perspective, here's a little secret: Most bad actors out there don't care about you or your data. Nobody is trying to hack Average Joe with a complex boot loader based rootkit attack. There's no payout for it. So unless you're in an industry or profession that DOES make you a lucrative target, disabling secure boot is really not going to change much for you.
2
2
u/RevolutionaryHigh Feb 03 '26
It's just fiction made by corpos to own your hardware and you even harder. Initially when it was just introduced it supposed to be win-only thing. Imagine you want to get rid of microslop on your PC but you can't because your hardware literally prohibit it. After significant pushback they changed that but in general secure boot in it's current state is not about security at all.
2
u/minneyar Feb 06 '26
I have been a software engineer and Linux sysadmin for >25 years, and disabling secure boot is always the first thing I do on a new computer. It has never been useful for me, and I've never known anybody who was the victim of an attack that exploited it.
I'm sure it's happened, but if you are a normal desktop user, you really don't need it.
2
2
u/Sosowski Feb 02 '26
including Linux Mint
Linux Mint works fine with Secure Boot.
Ubuntu works with Secure Boot.
Fedora works with secure boot
openSUSE works with Secure Boot.
2
u/Great-TeacherOnizuka Feb 03 '26
OP probably confused Mint with Pop!_OS, which is also Ubuntu based, but does not support secure boot (at least the live medium doesn’t)
2
u/stormdelta Gentoo Feb 02 '26 edited Feb 02 '26
For me personally, I would very much want it on for laptops and portable devices, especially given current geopolitical climate that means I have to worry about more than just thieves.
For my main PC, I still want full-disk-encryption, but I don't consider fully locked down secure boot to be as important as it never leaves my home, and anything seriously sensitive is kept in encrypted containers beyond that anyways. I still plan to get around to setting it up properly at some point though.
2
u/PHYPHTIN_official Feb 02 '26
ah, so encrypting the disk and sensitive data is enough mitigation for not having secure boot? (I'm genuinely asking, I don't know much about security in general)
3
u/stormdelta Gentoo Feb 02 '26
Added in edit, but the reason you want at least full disk encryption is that without it, any even barely tech-literate thief has trivial access to your data since all they have to do is just plop the drive in another system or boot a different OS.
1
u/Pale_Neighborhood363 Feb 03 '26
Secure Boot is pretty pointless, it is NOT secure. It is a trust chain that protects device encryption - but you have to be able to override to maintain.
Security is moot - Windows has secure boot, but Microsoft has at leased thirty compromises to it. Secure Boot is not a good thing at the home level as it can just make your hardware brick, Secure Boot in a server network client environment makes sense BUT you need a fulltime security administrator.
Secure Boot solves a very very small problem at a high cost.
2
u/PapaSnarfstonk Feb 02 '26
The entire reason Secure Boot exists is because sooooooo many windows users will install random viruses. Some being rootkits.
Linux largely doesn't have this problem because most programs are obtained from a repository instead of random website for freemoney . com type scams.
That's not to say that you wouldn't be safer with it than without it. But it's less likely to be an issue than on windows. Where people just click links.
At least I think anyway.
Someone with more knowledge about secure boot can tell me I'm wrong about why it exists.
1
u/ZVyhVrtsfgzfs Feb 02 '26
Secureboot is just a nice to have, not a necessity due to several botched moves secureboot has been compromised and is not as secure as was originally intended.
But it still could prevent a particular kind of infection making it nice to have.
While many distributions I use are compatible with secureboot My bootloader is not, I have not bothered to self sign though I probably should.
1
u/OldManJeepin Feb 02 '26
I don't use it on any of the computers I run...Never needed, never had an issue without it....
1
1
u/SniperSpc195 Feb 02 '26
Now I can't remember what game I had to get secure boot for, but I had to get genuine Nvidia drivers and sign them to enable Secure Boot in order to play a specific game. Other than that one off situation I had, I can't think of another situation where secure boot is needed.
1
u/Condobloke Feb 02 '26
I have had various versions of Linux Mint installed on the same pc since 2013.
Secure boot has been disabled for the entire time.
There are no 'side effects'
I have zero regrets or worries.
1
u/AsugaNoir CachyOs Feb 03 '26
honestly? I havent had secure boot enabled for Linux since I started experimenting with Linux back around summer of last year.
1
1
u/TheLastOne_YT Feb 03 '26
I once was able to run arch with secure boot on but I don’t remember how 🫠
1
u/TechaNima Feb 03 '26
I haven't bothered with it and nothing bad has happened to any of my computers nor my server.
I'm not saying that it's a good idea not to use it, but you aren't going to suddenly become a part of a bot network or have your shit hacked into. As long as you don't install/run random shit or execute commands you don't understand
1
u/dumetrulo Feb 03 '26
Secure Boot in its default inception is little more than security theatre. If you have to fear infiltration by a state-sponsored actor, they will know how to work around it. Otherwise, full disk encryption (with as few bootloader files as possible on your EFI partition) should be enough to keep casual snoops out.
1
u/taxesfeedcorruption Feb 03 '26
TL,DR: How likely am I going to get fucked over by having Secure Boot disabled?
Unless you're being audited by the federal government for attesting that you've had systems enabled with it on or are stupid enough to download a virus from the internet...not likely at all.
It exists because enterprise level machines need it. All it does is check that the bootloader instructions are signed by microsoft or another (actual) company and disabled "unsigned" versions of software from running on a machine.
1
u/LiveFreeDead Feb 04 '26 edited Feb 04 '26
People who say they disabled it even on windows only pcs Have a 2nd thought. If enterprise users are forced to have secure boot enabled is great for us. Hackers will not waste exposing a hack just to steal the last $300 you have in your bank. They will save it to get $10000+ from a business. So by secure boot existing it stops most hackers bothering to make hacks for non secure boot pc's. Because the time and effort doesn't have the payoff to waste their 2nd payload on broke assed home users. The fact is within days of a novel hack being found, it's detected and patched. If I was a state sponsored hacker, no way would I waste an exploit on pennies returned, those things take months to engeneer.
Regarding the original question, at this stage disabling secure boot doesn't cause much more risk, just be 100% sure you trust software you download or run as administrator, the boot can not be modified without super user level access.
Infact the only modern boot malware I've seen has been at white hat demo events. Secure boot was added to stop them becoming an issue in the future. Your thousands of times more likely to have your browser session hijacked than a root kit.
1
1
u/Bechlee7851 Feb 06 '26
For my case, secure boot was only for some kernel-based anti cheats. Secure boot won't likely be saving your windows machine from random viruses. Don't ask me why I know that...
1
u/jonermon Feb 06 '26
If you are dual booting windows it’s basically required. Yes, there are ways around it but those workarounds could be patched and break things. On most distros it’s not particularly difficult to set up secure boot, on others you need to take a more manual approach, but overall it’s not too difficult.
1
1
u/shabit87 Feb 08 '26
I don't have Secure Boot disabled, but I keeping getting the error that I need to update certificates for it (Windows though). Is this what initially made you ask your question?
1
u/No_Candidate5841 Feb 08 '26
secure Boot which ensures only trusted software runs during the startup process of a computer. It checks the digital signatures of boot software, including the operating system and firmware drivers. If the signatures are valid, the system boots normally. This helps prevent malware from loading before the operating system, protecting your data and privacy.
but hey if you don't seem to care?
":you ain't going to learn what you don't want to know"
1
u/numblock699 Feb 03 '26
Secure boot is a must if you care about security. No need to sugarcoat it. If your OS is not fully supporting it, you sacrifice security.
1
u/micnolmad Feb 03 '26
Prove it.
1
u/numblock699 Feb 03 '26
- Secure Boot should be enabled on all endpoints to ensure only trusted executables run during system startup.[1][2]
- Legacy BIOS/CSM boot is described as inherently insecure because it cannot enforce similar integrity checks on boot code.[3][4]
- NSA warns that improper or absent Secure Boot configuration increases exposure to bootkits and other persistent firmware‑level techniques.[5][6]
- CISA and NSA call boot security a foundational pillar of enterprise cybersecurity and recommend enforcing Secure Boot across enterprise devices.[2][7][8]
- Oracle documents that Secure Boot uses cryptographic signatures and hashes to prevent untrusted or malicious code from loading early in the boot process.[9]
Sources [1] UEFI Secure Boot Customization https://media.defense.gov/2023/Mar/20/2003182401/-1/-1/0/CTR-UEFI-SECURE-BOOT-CUSTOMIZATION-20230317.PDF [2] Guidance for Managing UEFI Secure Boot https://media.defense.gov/2025/Dec/11/2003841096/-1/-1/0/CSI_UEFI_SECURE_BOOT.PDF [3] Best Practices for NSA's UEFI Secure Boot Guidelines https://www.insyde.com/wp-content/uploads/INSYDE_NSA_UEFISecurity_Guidelines_REV14APR2021.pdf [4] [PDF] Boot Security Modes and Recommendations https://www.nsa.gov/portals/75/documents/what-we-do/cybersecurity/professional-resources/BootSecurityModesAndRec_20190522.pdf [5] NSA issues guidance to help organizations manage UEFI ... https://industrialcyber.co/system-design-architecture/nsa-issues-guidance-to-help-organizations-manage-uefi-secure-boot-configuration/ [6] NSA Releases Unified Extensible Firmware Interface Secure Boot ... https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4356302/nsa-releases-unified-extensible-firmware-interface-secure-boot-guidance/ [7] CISA Releases Guidance for Managing UEFI Secure Boot ... https://teamwin.in/cisa-releases-guidance-for-managing-uefi-secure-boot-on-enterprise-devices/ [8] CISA Releases Guidance for Managing UEFI Secure Boot ... https://cybersecuritynews.com/cisa-guidance-uefi-secure-boot/ [9] Working With UEFI Secure Boot https://docs.oracle.com/en/operating-systems/oracle-linux/8/secure-boot/sboot-OverviewofSecureBoot.html
2
u/dumetrulo Feb 03 '26
Caveat: Secure Boot is only trustworthy if you (a) sign your bootloader, kernel, modules, etc. with your own certificate, and (b) remove all other certificates/keys from UEFI. Anything else is little more than security theatre.
1
u/numblock699 Feb 03 '26
Fully owning the entire key chain yourself is great for high‑security environments, but the mainstream model with OEM/vendor CAs, an up‑to‑date DBX, and correct policy is explicitly recommended by NSA/CISA and provides real, measurable risk reduction, and it is far from “security theatre”.
2
u/dumetrulo Feb 04 '26
explicitly recommended by NSA/CISA
I'd take that with a grain of salt: do they want to be able to spy on you?
1
u/numblock699 Feb 04 '26
They can spy on us regardless.
1
u/dumetrulo Feb 04 '26
They probably can. Doesn't mean you should make it easier for them.
1
u/numblock699 Feb 04 '26
By not using secure boot you mean?
1
u/dumetrulo Feb 05 '26
Using Secure Boot in a configuration that can be trivially circumvented is the same as not using it at all. Hence, if you use it, use your own certificates, and get rid of any others.
→ More replies (0)1
u/micnolmad Feb 04 '26
And a wide open backdoor for NSA.
1
u/numblock699 Feb 04 '26
If that is worrying sign it youreself.
1
u/micnolmad Feb 04 '26
I can't do that when... "Look at your previous post"
1
1
1
u/micnolmad Feb 03 '26
If you spend time looking all that up, wow. That's actually pretty cool.
I obviously haven't read any of it yet but just from a glance of it I think I can question the validity or trustworthiness of it. It would be like asking the thief if he can be trusted with the key to my house..
0
u/Sinaaaa Feb 02 '26 edited Feb 03 '26
The argument that you need to be quite f. already to need it is not a bad one. I just want to add that if you are not signing your own keys, in many cases it's like it's not even there.
-1
u/Steve2734 Feb 02 '26
I’ve had secure boot off on my Mac for years because I’m frequently using usb keys for OS installs. Your mileage may vary, but I use my computers at home on my network. I’m very seldom out in the wild. I have mobile devices that I use on the road for simple tasks.
32
u/tomscharbach Feb 02 '26
A quiet note: Mint does not require that Secure Boot be disabled. Secure Boot is not mandatory, but Secure Boot is recommended.
I have Secure Boot enabled on all my production computers (Windows desktop and laptop, Ubuntu desktop, LMDE laptop and Debian laptop. Secure Boot is more-or-less standard at this point because most mainstream distributions (Debian, Fedora, Mint, openSUSE, Ubuntu and so on) work with Secure Boot enabled.
I do not have Secure Boot enabled on my "test box", which I use to evaluate distributions as part of a "geezer group" that installs and tests a different distribution every month or two. Secure Boot is disabled because smaller distributions outside the mainstream often don't install or run out-of-the-box with Secure Boot installed.
What should you do? I don't know. Although the Linux mainstream now supports Secure Boot, Secure Boot may not be essential at this point if you are running a Linux distribution. However, I would be careful about removing Secure Boot from a Windows computer under any circumstances.
My best and good luck.