3 ms·

Does ReFS support native encryption like Apple's new filesystem does? What's keeping Microsoft from enabling encryption for all Windows users by default, other

• nkvoll 9y ago
  Isn't BitLocker (https://en.wikipedia.org/wiki/BitLocker https://en.wikipedia.org/wiki/BitLocker) how Windows supports full disk encryption by default (shipped with Vista and later)? From an end-user perspective it seems to behave very transparent as well. In what way does it come up short?
  • jpalomaki 9y ago
    Yes. And with suitable hardware Bitlocker actually uses the SSD encryption which is anyways enabled, so there's zero performance hit. The drawback is that not all modern hardware supports it [1,2]. For example the Samsung 960 series do not support this. Since Apple controls the whole stack, I would assume they are also doing this, but I'm not sure. [1] https://technet.microsoft.com/en-us/library/hh831627(v=ws.11).aspx https://technet.microsoft.com/en-us/library/hh831627(v=ws.11... [2]https://helgeklein.com/blog/2015/01/how-to-enable-bitlocker-hardware-encryption-with-ssd/ https://helgeklein.com/blog/2015/01/how-to-enable-bitlocker-...
  • kefka 9y ago
    > BitLocker.... In what way does it come up short? By forcing an escrow key linked to Microsoft and whomever owns the TPM on your computer. By definition, backdoor keys and hidden users who can access encrypted content is just absolutely, horribly wrong. And there's no way to turn it off... Well, I'm sure someone will say there's 10 regkeys to change that might fix it on a specific version. Still does nothing regarding the "trust" with the TPM.
    • Karunamon 9y ago
      What do you mean linked to Microsoft? And if your TPM, the hardware device that stores keys, is pwned, the whole exercise is meaningless anyways
      • kuschku 9y ago
        The TPM is pwned, by default. It's closed, secret, and as the AMT issuws showed, has a lot of software running in it with questionable security. That's why the whole excercise is meaningless if you leave the keys on the device, and why you should put them on external hardware TPMs or key vaults. Even a YubiKey is better. Now you just need a system that supports reading keys from such a device during boot.
        • izacus 9y ago
          You can use YubiKey to store BitLocker decryption key.
          • kuschku 9y ago
            And? That still allows MS to decrypt the drive.
            • Karunamon 9y ago
              False. You are given a non-default option to upload a backup of your Bitlocker key to Onedrive. By what evidence are you claiming Microsoft gets to decrypt the drive if this option isn't selected?
        • Karunamon 9y ago
          TPM and AMT are two entirely different technologies with entirely different classes of security concerns. The Intel management engine (which runs the AMT software) is effectively a separate CPU that runs full programs and has direct memory/hardware access, while the TPM is not. The TPM is a PKI device, nothing more. It cannot take over your computer.
  • mtgx 9y ago
    It's not available on Windows Home, for one.