I understand LUKs can be used to encrypt your data. But what would prevent somebody plug in a USB with and just wipe my drive?
On traditional BIOS like Lenovo, HP, Dell and even Framework you can set a supervisor password that locks the boot menu. So nobody can boot from the USB.
Coreboot is different though. I spoke with Starlabs whose computers run Coreboot, and apparently you can have the boot menu password. OTOH, Sys76’s Coreboot doesnt allow such things.
I ask because i want to libreboot my T480, but the number 1 thing i worry is unauthorized USB boot.
This one: https://libreboot.org/docs/linux/grub_hardening.html#grub-password
seems to only lock the ability to edit the grub entry freely, aka press “e” to change stuff when grub fails to boot.
Setting a BIOS password doesn’t really do much good. Someone can just unplug the CMOS battery and the password will be cleared. Even if it was stored in flash, it could be removed by erasing it with a flash programmer and flashing a new BIOS.
There are methods to detect if a device has been tampered with and disassembled. Like glitter nail polish on the screws.