I set up a firmware password on my MacBook. One thing I don't understand is how I can install a tool such as rEFIt, and effectively bypass the entire firmware password (i.e. installing it never asked for my original Firmware password).
It says on their website:
[...] since “refit.efi” is configured as the legitimate boot loader, it effectively circumvents the firmware password protection.
Isn't that a huge security hole in setting up a firmware password? Doesn't that mean that the securing a computer by setting up a firmware password is only as strong as an admin account's password (i.e. someone that has privileges to install a tool such as rEFIt)?