3 ms·

Shouldn't the TPM/hard disk be password protected? What's even the point of the TPM when you can just sniff out the key without it?

by ginko 5y ago

michaelt 5y ago
> What's even the point of the TPM Normal full disk encryption needs you to enter two passwords - one to decrypt the disk, another a minute or two later to log into the operating system. Your corporate IT helpdesk can remotely reset the latter password if you forget it, but the former can't be remotely reset. And if several people need to be able to boot a shared computer, they need to share the disk encryption password (which isn't winning any security awards). Between the TPM and Secure Boot, the intention is that you sacrifice a certain amount of security - but in exchange, you can have only a single password prompt, a password IT can remotely reset, and no shared boot password.
- ginko 5y ago
  >And if several people need to be able to boot a shared computer, they need to share the disk encryption password (which isn't winning any security awards). At least with LUKS you can have multiple passwords for unlocking a disk so you can have one master password and user password(s) for the same machine. Having to enter two passwords doesn't seem like a big issue for high security HW like a CEO's laptop. In fact that's standard procedure at my company.
  - sva_ 5y ago
    If you use LUKS full disk encryption you can also just suspend it while logged in, so you only need to enter the LUKS password on resume.
  - Sebb767 5y ago
    > At least with LUKS you can have multiple passwords for unlocking a disk Luks implements this by encrypting the actual key multiple times, once with each password. So if one person turns evil before you remove their password or a password is leaked, you can still consider the disk compromised.
- tbyehl 5y ago
  > can't be remotely reset In an Active Directory environment, Group Policy can store BitLocker recovery keys within AD. Self-service key recovery and rotation is an option with Intune and other device management platforms. In the context of a personal computer, signing in with or linking a Microsoft account can provide the same functionality. > shared computer BitLocker Network Unlock solves this for fixed-location devices.
- upofadown 5y ago
  Could you just set the OS to auto log you in to eliminate the second password?

Shouldn't the TPM/hard disk be password protected? What's even the point of the TPM when you can just sniff out the key without it?

by ginko 5y ago

Shouldn't the TPM/hard disk be password protected? What's even the point of the TPM when you can just sniff out the key without it?

michaelt 5y ago

> What's even the point of the TPM Normal full disk encryption needs you to enter two passwords - one to decrypt the disk, another a minute or two later to log into the operating system. Your corporate IT helpdesk can remotely reset the latter password if you forget it, but the former can't be remotely reset. And if several people need to be able to boot a shared computer, they need to share the disk encryption password (which isn't winning any security awards). Between the TPM and Secure Boot, the intention is that you sacrifice a certain amount of security - but in exchange, you can have only a single password prompt, a password IT can remotely reset, and no shared boot password.

ginko 5y ago
>And if several people need to be able to boot a shared computer, they need to share the disk encryption password (which isn't winning any security awards). At least with LUKS you can have multiple passwords for unlocking a disk so you can have one master password and user password(s) for the same machine. Having to enter two passwords doesn't seem like a big issue for high security HW like a CEO's laptop. In fact that's standard procedure at my company.
- sva_ 5y ago
  If you use LUKS full disk encryption you can also just suspend it while logged in, so you only need to enter the LUKS password on resume.
- Sebb767 5y ago
  > At least with LUKS you can have multiple passwords for unlocking a disk Luks implements this by encrypting the actual key multiple times, once with each password. So if one person turns evil before you remove their password or a password is leaked, you can still consider the disk compromised.
tbyehl 5y ago
> can't be remotely reset In an Active Directory environment, Group Policy can store BitLocker recovery keys within AD. Self-service key recovery and rotation is an option with Intune and other device management platforms. In the context of a personal computer, signing in with or linking a Microsoft account can provide the same functionality. > shared computer BitLocker Network Unlock solves this for fixed-location devices.
upofadown 5y ago
Could you just set the OS to auto log you in to eliminate the second password?