These protections work at different layers and hence, you use both.
First off, you can’t really encrypt the first boot loader by design, your UEFI needs something it can read and run. You need to protect this first boot stage somehow, and this is what Secure Boot is for; it verifies the signature of the payload it starts to protect it against tampering.
My disk and bootloader are both encrypted but I can get to my UEFI menu without decrypting. I’ve been meaning to password protect that but I get nervous about changing anything in UEFI.
I didn’t know much about secure boot or TPM or PAM so I was planning on setting those up, but I’ll skip it if it’s just about corporate capture. Not that my hardware is from some big name corpo or anything, it came with linux by default. But still.
Also I’m worried about locking myself out of booting from live USBs, especially if I ever need to use a recovery drive. But I think if I understand correctly then most official ISOs should still work, but I’m not 100% certain.
For #2, Full Disk Encryption (including bootloader)
These protections work at different layers and hence, you use both.
First off, you can’t really encrypt the first boot loader by design, your UEFI needs something it can read and run. You need to protect this first boot stage somehow, and this is what Secure Boot is for; it verifies the signature of the payload it starts to protect it against tampering.
My disk and bootloader are both encrypted but I can get to my UEFI menu without decrypting. I’ve been meaning to password protect that but I get nervous about changing anything in UEFI.
I didn’t know much about secure boot or TPM or PAM so I was planning on setting those up, but I’ll skip it if it’s just about corporate capture. Not that my hardware is from some big name corpo or anything, it came with linux by default. But still.
Also I’m worried about locking myself out of booting from live USBs, especially if I ever need to use a recovery drive. But I think if I understand correctly then most official ISOs should still work, but I’m not 100% certain.
Clearly, I still have a lot to learn…