2 ms·
As I understand it, the idea is that even without a BIOS password nor a disk encryption password, your OS can boot and only then request a session password. So
by AshamedCaptain 6y ago
As I understand it, the idea is that even without a BIOS password nor a disk encryption password, your OS can boot and only then request a session password. So effectively you only have to enter one password, rather than 2 or 3. Even if the laptop is stolen, TPM included, you still have to guess the login password. This is how Bitlocker et all operate and to be honest makes a lot of sense for a regular user (and practically everyone unless your enemy is a government-like entity than can decap/sniff TPM chips...).
Secure Boot actually does not help much here... since the idea is that thief wouldn't be able to change the disk contents.
- Tsiklon 6y agoInteresting - LUKS and Apple's Filevault take the opposite approach; wherein you must provide a password from an authorised user in order to access the contents of a filesystem/logical volume. Meaning that without authorisation your data is still encrypted. I'm not completely familiar with Windows service management and how it handles logins - but doesn't the TPM auto decrypt function of Bitlocker mean that if you have a compromised system which has a dodgy service that starts at boot time it can potentially exfiltrate data from the machine without a user logging in? Of course, if this is the scenario you're experiencing you have much bigger problems already haha.