Ordinary disk encryption would protect me too here, wouldn't it?
https://security.stackexchange.com/questions/267222/full-dis...
So, there are two scenarios here.
First, PC with FDE + normal boot gets stolen. The attacker cannot get the data without the password, so it's safe.
Second, unattended FDE + normal boot PC gets tampered with. Attacker manipulates the bootloader. Unsuspecting user later boots the tampered PC, unlocks the FDE, gets owned.
As an advantage, all relevant code running on my computer is FLOSS and auditable, unlike the Secure Boot and UEFI.
And yes, getting back to the original topic, I believe that against petty criminals, even a full disk encryption is plenty defense. They won't go about installing anything to the EFI partition just to get to the data.
This Coreboot + Heads setup I'd trust to protect against even the more involved.
That unencrypted bootstrap process can be modified by anyone with access to the disk, physical or remote. Theoretically, someone can inject a keylogger into the process and exfiltrate your encryption key's password, or a process that waits until you're decrypted and exfiltrates your data. It's also a potential vector for ransomware, root/boot kits, etc.
