4 ms·

On the flip side, they are tamper resistant. It would be incredibly difficult for someone to tamper with a Surface tablet siting in a hotel room without leaving

On the flip side, they are tamper resistant. It would be incredibly difficult for someone to tamper with a Surface tablet siting in a hotel room without leaving marks. This is probably good for travel with a corporate device.

craftyguy 8y ago
With physical access, you could execute any number of attacks over usb to get access to data on the device.
- p2t2p 8y ago
  That what BitLocker is for and Surfaces come with that thing enabled by default. (let's suppose you're not being targeted by NSA for simplicity of the discussion) =)
  - craftyguy 8y ago
    BitLocker doesn't matter if the device is on, and that the owner has picked a reasonably strong passphrase (people generally fail to do so).
    - tonyztan 8y ago
      Hence users who may be targeted should not leave the computer unattended AND powered-on. They need to set a TPM PIN and power down the computer when it's not being used. BitLocker only allows you ten attempts to enter the TPM PIN, and if the bootloader is modified by an attacker, the TPM will refuse to release the key.
      - p2t2p 8y ago
        > TPM PIN TIL Also does it require it when comes from hibernation? Because by default Surface Pro powers off after certain time in connected standby, therefore if BitLocker pin is active after wake up the user is safe.
        tonyztan 8y ago
        I believe it's required after hibernation (because the device is powered off), but not after sleep.
HammerJack 8y ago
Do you really think anyone short of a state agency is going to break into your hotel room and attempt to install malicious hardware? Since I assume you'd have drive encryption in such a hostile environment?
- tonyztan 8y ago
  Full disk encryption does not protect against hardware keyloggers, but obviously tampered hardware (broken screen) could lead to the user not entering the passphrase. Also, this is not for my threat model, but it could be appropriate for certain corporate travelers or journalists.

craftyguy 8y ago

With physical access, you could execute any number of attacks over usb to get access to data on the device.

p2t2p 8y ago
That what BitLocker is for and Surfaces come with that thing enabled by default. (let's suppose you're not being targeted by NSA for simplicity of the discussion) =)
- craftyguy 8y ago
  BitLocker doesn't matter if the device is on, and that the owner has picked a reasonably strong passphrase (people generally fail to do so).
  - tonyztan 8y ago
    Hence users who may be targeted should not leave the computer unattended AND powered-on. They need to set a TPM PIN and power down the computer when it's not being used. BitLocker only allows you ten attempts to enter the TPM PIN, and if the bootloader is modified by an attacker, the TPM will refuse to release the key.
    - p2t2p 8y ago
      > TPM PIN TIL Also does it require it when comes from hibernation? Because by default Surface Pro powers off after certain time in connected standby, therefore if BitLocker pin is active after wake up the user is safe.
      - tonyztan 8y ago
        I believe it's required after hibernation (because the device is powered off), but not after sleep.

HammerJack 8y ago

Do you really think anyone short of a state agency is going to break into your hotel room and attempt to install malicious hardware? Since I assume you'd have drive encryption in such a hostile environment?

tonyztan 8y ago
Full disk encryption does not protect against hardware keyloggers, but obviously tampered hardware (broken screen) could lead to the user not entering the passphrase. Also, this is not for my threat model, but it could be appropriate for certain corporate travelers or journalists.