3 ms·

> Secondly, to avoid the problem in this article, you should have an external password necessary to unlock the drive; not a TPM. This is, of course, not what mo

> Secondly, to avoid the problem in this article, you should have an external password necessary to unlock the drive; not a TPM. This is, of course, not what most people do, since typing in passwords is tedious. Back when I worked at MS, a PW was required on boot to deencrypt the drive. I am honestly shocked that isn't the default for bitlocker. But then again it does require people to have a unique bitlocker PW, and if they ever forget it, everything on the machine is gone for good. (Which I've actually been bitten by, oops!)

redtexture 5y ago
Care to desribe the experience, and what was lost to you?
- com2kid 5y ago
  Now that I remember, there is a separate key stored by the corporation that can also unlock the drive.
0942v8653 5y ago
It seems like it'd be possible to have a separate recovery key stored by the company in addition to the regular password.
- Osiris 5y ago
  That's how my employer does it but it's for less than a hundred devices so we just provide security the key after turning on FileVault.
- JonathonW 5y ago
  I don't recall whether or not it's the default, but Bitlocker can do this on domain-joined machines-- they get automatically backed up into Active Directory where they can be retrieved from the computer account's properties (or there's a tool in RSAT that can find them).
koyote 5y ago
> But then again it does require people to have a unique bitlocker PW, and if they ever forget it, everything on the machine is gone for good. (Which I've actually been bitten by, oops!) I am not sure if it was the same system, but at a company I worked for we also had a boot password for bitlocker. People would sometimes forget it or bitlocker would somehow corrupt itself. IT was usually able to fix it though. I believe they were able to print out some kind of longer master password that could be used to unlock the machine.
- aksss 5y ago
  That would probably be the recovery password, which is a long string of gobblydigook. In corporate environment, the recovery password is backed up to the user's Azure AD account and logged by the configuration manager (like InTune, probably 3rd party ones too).
- EvanAnderson 5y ago
  Commonly machines will be configured (via Group Policy) to store their Bitlocker recovery keys in Active Directory (where they are readable by only privileged users). (It would be nice if MSFT would do with Bitlocker recovery keys what they do with EFS recovery keys, and encrypt them with a public key. At that point popping Active Directory wouldn't be enough to get Bitlocker recovery keys-- you'd need a private key that, hopefully, was stored offline or in an HSM.)
naikrovek 5y ago
> I am honestly shocked that isn't the default for bitlocker. manual PIN entry IS the default for BitLocker, and the article states this.
- detaro 5y ago
  It isn't, and you are misparsing the sentence in the article (it is saying the configuration as it was is the default, but describes it through what it's not, which makes the sentence a bit confusing) - look at the linked Microsoft documentation for confirmation.
WhyNotHugo 5y ago
My guess is that this is more "user-friendly". Even though it decreases security substantially, they can still use lots of fancy words in the technical description, and only someone with knowledge in the field will understand how most of it is BS.
coaksford 5y ago
Bitlocker actually has multiple keys. There's one key to encrypt your data. There's a volume master key that encrypts the data encryption key. And then there are zero or more key protectors for the volume master key. One of those can be the TPM (or TPM with PIN), one can be a long password, one can be a recovery key (IIRC 48 decimal digits), and I believe there are other options as well. Each one is independently capable of decrypting the volume master key, which in turn decrypts the data encryption key, which in turn decrypts the data. So ideally you'd just get your recovery key and store it someplace well protected like a safe or a password manager.

redtexture 5y ago

Care to desribe the experience, and what was lost to you?

com2kid 5y ago
Now that I remember, there is a separate key stored by the corporation that can also unlock the drive.

0942v8653 5y ago

It seems like it'd be possible to have a separate recovery key stored by the company in addition to the regular password.

Osiris 5y ago
That's how my employer does it but it's for less than a hundred devices so we just provide security the key after turning on FileVault.
JonathonW 5y ago
I don't recall whether or not it's the default, but Bitlocker can do this on domain-joined machines-- they get automatically backed up into Active Directory where they can be retrieved from the computer account's properties (or there's a tool in RSAT that can find them).

koyote 5y ago

> But then again it does require people to have a unique bitlocker PW, and if they ever forget it, everything on the machine is gone for good. (Which I've actually been bitten by, oops!) I am not sure if it was the same system, but at a company I worked for we also had a boot password for bitlocker. People would sometimes forget it or bitlocker would somehow corrupt itself. IT was usually able to fix it though. I believe they were able to print out some kind of longer master password that could be used to unlock the machine.

aksss 5y ago
That would probably be the recovery password, which is a long string of gobblydigook. In corporate environment, the recovery password is backed up to the user's Azure AD account and logged by the configuration manager (like InTune, probably 3rd party ones too).
EvanAnderson 5y ago
Commonly machines will be configured (via Group Policy) to store their Bitlocker recovery keys in Active Directory (where they are readable by only privileged users). (It would be nice if MSFT would do with Bitlocker recovery keys what they do with EFS recovery keys, and encrypt them with a public key. At that point popping Active Directory wouldn't be enough to get Bitlocker recovery keys-- you'd need a private key that, hopefully, was stored offline or in an HSM.)

naikrovek 5y ago

> I am honestly shocked that isn't the default for bitlocker. manual PIN entry IS the default for BitLocker, and the article states this.

detaro 5y ago
It isn't, and you are misparsing the sentence in the article (it is saying the configuration as it was is the default, but describes it through what it's not, which makes the sentence a bit confusing) - look at the linked Microsoft documentation for confirmation.

WhyNotHugo 5y ago

My guess is that this is more "user-friendly". Even though it decreases security substantially, they can still use lots of fancy words in the technical description, and only someone with knowledge in the field will understand how most of it is BS.

coaksford 5y ago

Bitlocker actually has multiple keys. There's one key to encrypt your data. There's a volume master key that encrypts the data encryption key. And then there are zero or more key protectors for the volume master key. One of those can be the TPM (or TPM with PIN), one can be a long password, one can be a recovery key (IIRC 48 decimal digits), and I believe there are other options as well. Each one is independently capable of decrypting the volume master key, which in turn decrypts the data encryption key, which in turn decrypts the data. So ideally you'd just get your recovery key and store it someplace well protected like a safe or a password manager.