3 ms·
Another point in favor of Win10: full-disk encryption is easier to set up as Bitlocker on Windows. Together with the TPM, physical access no longer means easy d
by jhanschoo 6y ago
Another point in favor of Win10: full-disk encryption is easier to set up as Bitlocker on Windows. Together with the TPM, physical access no longer means easy data access, and you don't have to input a passcode for the encryption either.
There is no good story for tpm-secured booting into a full-drive encrypted Linux OS. What I have now still requires a passcode at boot, and it was still a pain to set up.
- Macha 6y agoMy understanding is bitlocker is using your login credentials as the auth to get the TPM to unlock the disk - otherwise how is it blocking anyone else with physical access getting at data by just turning the power on if there's no auth?
- AaronFriel 6y agoYou can enable TPM and PIN at boot that engages with the TPM, or you can just use TPM in which case your disk is unlocked by the bootloader (IIRC, terminology might be off). The TPM and PIN has protections against brute forcing and offline attacks. The TPM only method for Bitlocker is more similar to FileVault.
- selfhoster11 6y agoI was about to write that you can easily enable full-disk encryption with Ubuntu on install, but then I realised you had a requirement to use TPM for this. Ubuntu doesn't support this mode without finagling, so this wouldn't meet your requirements.