3 ms·

An encrypted hdd/ssd will help of someone steals your computer, removes your drive, and tries to read it from another computer in order to bypass your passwords

An encrypted hdd/ssd will help of someone steals your computer, removes your drive, and tries to read it from another computer in order to bypass your passwords. It won’t do shit for ransom ware. Ransom ware runs as a user land program and does encryption from within your OS where you data is live and unencrypted. The end result will be a hard drive full of encrypted files that is then reencrypted by bitlocker.

Aardwolf 5y ago
If someone steals your computer, they also have the TPM, which has the key, right? What am I missing about what TPM does that is so secure?
- mnd999 5y ago
  The TPM combined with secure boot will only unlock the disk if nothings been tampered with, meaning your OS security is intact. If you switch off secure boot or mess with the kernel or boot loader it’ll just refuse to unlock. I would guess extracting the keys from the tpm in other ways is not impossible, but probably sufficiently hard to be not worth it in most situations.
  - arthurcolle 5y ago
    So if you modify any components in a laptop, say RAM or a video card, or you you mess with any BIOS settings, it won't boot? is this for real...?
    - orra 5y ago
      No, you misunderstand. The TPM verifies the bootloader and the operating system kernel, etc: that those components haven't been altered.
      - Grimm665 5y ago
        No, I think you might be mistaken. I have been bitten by this when doing a simple BIOS reset for a computer that was having charging/battery issues. Resetting the BIOS tripped Bitlocker, which I did not configure or enable, it was enabled after doing the initial Windows 10 setup. Since the account was a local account, not one signed into a Microsoft account, the Bitlocker keys were not backed up an all data was lost. I was stunned, I've been doing laptop repair for almost 10 years and I've never seen something this stupid.
- my123 5y ago
  The TPM gets the measurements of the state of the system during different phases of the boot process, and only releases the key if those measurements match. It's also designed to not be able to be able to extract the key material out of it.
  - TinkersW 5y ago
    Measurements of what? What if swap out my GPU? Or RAM?
    - arthurcolle 5y ago
      One of the response comments to my original comments seems totally on point. This seems like a totally insane DRM scheme. [0] [1] [0] https://news.ycombinator.com/item?id=27655320 https://news.ycombinator.com/item?id=27655320 [1] https://news.ycombinator.com/item?id=27656144 https://news.ycombinator.com/item?id=27656144 Can someone on the inside confirm that my using a new chip won't make me unable to boot into my Windows 11 install "Sorry you need your double secret trusted components to use them with our TPM modules, and thus your* software install." * "Your" meaning ours, licensed to you until we decide to change the license.
    - my123 5y ago
      The measurements are of system firmware and bootloader stages + configuration. If you change any of those... Then, in the case of full drive encryption, you'll be asked for the BitLocker recovery key at bootup. If you used Windows Hello for authentication, that option wouldn't be available - making you have to use your password instead to login.
- yabones 5y ago
  The only thing TPM based disk encryption protects is the kernel and the login screen. Without disk encryption somebody could modify your kernel or boot sequence and inject something nasty. Likewise they could do the old utilman.exe hack[1] and get admin by replacing one of the programs on the login screen with a shell. If the device can boot without a password or PIN, there are some surprising ways to get into it just by switching networks (if network drives are mounted it will sometimes send NTLM hashes), or by good old brute-forcing. [1] https://blog.kaniski.eu/2020/12/utilman-exe-to-cmd-exe-and-back/ https://blog.kaniski.eu/2020/12/utilman-exe-to-cmd-exe-and-b...

Aardwolf 5y ago

If someone steals your computer, they also have the TPM, which has the key, right? What am I missing about what TPM does that is so secure?

mnd999 5y ago
The TPM combined with secure boot will only unlock the disk if nothings been tampered with, meaning your OS security is intact. If you switch off secure boot or mess with the kernel or boot loader it’ll just refuse to unlock. I would guess extracting the keys from the tpm in other ways is not impossible, but probably sufficiently hard to be not worth it in most situations.
- arthurcolle 5y ago
  So if you modify any components in a laptop, say RAM or a video card, or you you mess with any BIOS settings, it won't boot? is this for real...?
  - orra 5y ago
    No, you misunderstand. The TPM verifies the bootloader and the operating system kernel, etc: that those components haven't been altered.
    - Grimm665 5y ago
      No, I think you might be mistaken. I have been bitten by this when doing a simple BIOS reset for a computer that was having charging/battery issues. Resetting the BIOS tripped Bitlocker, which I did not configure or enable, it was enabled after doing the initial Windows 10 setup. Since the account was a local account, not one signed into a Microsoft account, the Bitlocker keys were not backed up an all data was lost. I was stunned, I've been doing laptop repair for almost 10 years and I've never seen something this stupid.
my123 5y ago
The TPM gets the measurements of the state of the system during different phases of the boot process, and only releases the key if those measurements match. It's also designed to not be able to be able to extract the key material out of it.
- TinkersW 5y ago
  Measurements of what? What if swap out my GPU? Or RAM?
  - arthurcolle 5y ago
    One of the response comments to my original comments seems totally on point. This seems like a totally insane DRM scheme. [0] [1] [0] https://news.ycombinator.com/item?id=27655320 https://news.ycombinator.com/item?id=27655320 [1] https://news.ycombinator.com/item?id=27656144 https://news.ycombinator.com/item?id=27656144 Can someone on the inside confirm that my using a new chip won't make me unable to boot into my Windows 11 install "Sorry you need your double secret trusted components to use them with our TPM modules, and thus your* software install." * "Your" meaning ours, licensed to you until we decide to change the license.
  - my123 5y ago
    The measurements are of system firmware and bootloader stages + configuration. If you change any of those... Then, in the case of full drive encryption, you'll be asked for the BitLocker recovery key at bootup. If you used Windows Hello for authentication, that option wouldn't be available - making you have to use your password instead to login.
yabones 5y ago
The only thing TPM based disk encryption protects is the kernel and the login screen. Without disk encryption somebody could modify your kernel or boot sequence and inject something nasty. Likewise they could do the old utilman.exe hack[1] and get admin by replacing one of the programs on the login screen with a shell. If the device can boot without a password or PIN, there are some surprising ways to get into it just by switching networks (if network drives are mounted it will sometimes send NTLM hashes), or by good old brute-forcing. [1] https://blog.kaniski.eu/2020/12/utilman-exe-to-cmd-exe-and-back/ https://blog.kaniski.eu/2020/12/utilman-exe-to-cmd-exe-and-b...