3 ms·
I'm more confused now than ever. Is it true that all Windows 10 SKUs have full-disk encryption turned on by default? And this automatic full-disk encryption i
by panarky 11y ago
I'm more confused now than ever.
Is it true that all Windows 10 SKUs have full-disk encryption turned on by default?
And this automatic full-disk encryption is called "device encryption", which is really the same as BitLocker but without any way for the user to control it? And you can't get BitLocker on the Home edition?
If you immediately set up BitLocker, it allows you to save or print your key instead of sending it to Microsoft. But does it use the same key as the default "device encryption" that was already sent to Microsoft? BitLocker doesn't create a new key and re-encrypt the drive?
And the TPM automatically loads your key into RAM when the device is powered on, so it's still vulnerable when the device is not in your possession?
Are you safe if you (1) create a local account instead of a Microsoft account, (2) use BitLocker instead of device encryption, (3) save your key locally instead of sending it to Microsoft, and (4) require a separate PIN or key to boot the computer in addition to the local Windows account??
It would be helpful to describe exactly how to create a local account, because the Windows 10 setup procedure hides this pretty well. It looks like the only option is to use an existing Microsoft account or create a new one during setup.
And it would be great to explain how to create a secondary PIN or key since that doesn't show up in the BitLocker UI until you edit the local policy[1].
[1] https://weikingteh.wordpress.com/2011/04/18/how-to-enable-bitlocker-to-prompt-for-pin-during-startup/ https://weikingteh.wordpress.com/2011/04/18/how-to-enable-bi...
- ashmud 11y agoFrom only reading the article, it looks like they're shipping BitLocker already on, and that the recovery key Microsoft has is the BitLocker recovery key for the already enabled BitLocker configuration. Turning BitLocker off and back on resets this key. As long as you don't send it to Microsoft after re-enabling, Microsoft won't have it.
- mhurron 11y ago> As long as you don't send it to Microsoft after re-enabling, Microsoft won't have it. Unless you have a Home edition of windows, in which case you have no control over it at all. In order to use device encryption you have to sign on with a Microsoft Account and Microsoft will have the key.
- cmurf 11y agoI'm pretty sure that key can be deleted/removed from the online account; of course it's already out of your control, so you're now in a position of trusting the completion of Microsoft's key deletion.
- orillian 11y agoJust an aside: I'm running Windows 10 Pro and Bitlocker is off for all 4 of the drives in my machine. This machine was setup from a fresh install of windows 10 shortly after it went live in July. Only a single data point, but apparently there are cases when Microsoft does NOT encrypt the drives.
- scholia 11y agoDisk encryption is enabled on some shipping machines, which is to say, it has been enabled on the three brand new Windows 10 machines I've used. The OEM is responsible for the installation, so I'd assume this is an OEM choice, but obviously I don't know. I didn't notice at first, and really, there's no reason why I should have noticed. Also, I assumed Windows 10 Home didn't come with BitLocker anyway. The Windows 10 security overview on Microsoft TechNet includes the following statements: "Modern Windows devices are increasingly protected with device encryption out of the box and support SSO to seamlessly protect the BitLocker encryption keys from cold boot attacks." "BitLocker supports encrypted hard drives with onboard encryption hardware built in, which allows administrators to use the familiar BitLocker administrative tools to manage them." https://technet.microsoft.com/en-us/library/mt601297%28v=vs.85%29.aspx https://technet.microsoft.com/en-us/library/mt601297%28v=vs....
- scholia 11y ago> Also, I assumed Windows 10 Home didn't come with BitLocker anyway. Apparently it's "device encryption" but it's not BitLocker. And while it's optional at the moment, it becomes compulsory in summer 2016.
- cmurf 11y agoUnlikely that the KEK on the TPM is moved into RAM. The TPM would internally decrypt the KEK encrypted DEK, and then use the DEK in RAM (more likely it's just in the CPU using AES-NI, finding it in RAM would be non-trivial assuming the implementation is good). This is compared to e.g. either Linux (LUKS) or OS X where the encrypted DEK is stored on the drive itself (outside of the encrypted volume of course), since neither of them leverage a TPM at the moment.