4 ms·

> I have not been able to find a laptop without Bitlocker enabled by default since the Windows 8.1 era We use HP Pro/Elite Desk/Book at work. They arrive with

> I have not been able to find a laptop without Bitlocker enabled by default since the Windows 8.1 era We use HP Pro/Elite Desk/Book at work. They arrive with Windows 10 Pro and with BitLocker disabled. They have had a TPM and everything for many years, now. Latest such PC I've seen was manufactured in February 2022 (Elitebook 840 G8). > But in any case, the problem is that Microsoft itself should be required to face these problems; under no circumstance should it be that by default MS gets their signatures to work for free but everyone else needs to have extra UI to manage them. The thing is that if the PC comes with Windows pre-installed, then the certificates should be enrolled. But if not, maybe there shouldn't be any certificate? I guess my point is that it's unreasonable to expect a manufacturer to ship a computer with a bunch of certificates. I'd even say that it wouldn't be that secure.

bobkazamakis 4y ago
> I guess my point is that it's unreasonable to expect a manufacturer to ship a computer with a bunch of certificates. I'd even say that it wouldn't be that secure. How exactly do you think a root trust should be established? Should it just boot up and start grabbing whatever certificates it thinks might be authentic over the network?
- vladvasiliu 4y ago
  Of course not. But the issue is that if there's a "root" certificate installed, then we're more or less in the current situation, where MS has that root certificate and anyone else who wants to have a bootloader must get it signed by MS. Sure, there could be some kind of "neutral" entity in charge of this, but the issue remains. Then there's also the issue of managing certificate revocations. Don't know how that works, currently. Maybe via firmware updates? But then, older computers are SoL. Instead, what I think should be done, is to improve the workflow and documentation for installing one's own certificates. It's what I do on my own PC to run Arch (whose bootloader is not signed by MS) and I also signed MS's certificates so I can dual-boot. But the whole process is somewhat involved, it's not a simple "click a few buttons and you're done" kind of deal.
  - mjg59 4y ago
    >Then there's also the issue of managing certificate revocations. Revocation updates are in the form of authenticated UEFI variable blobs. They can be applied regardless of OS and don't require a firmware update.
- admax88qqq 4y ago
  Ship with no certificates, and Trust on First Use the certificate of whatever OS is installed first. There fixed it. No extra hoops for any OS. Extra hoops if you wish to change OS, which could increase security>
AshamedCaptain 4y ago
I am precisely typing this from an store-bought HP Elite laptop from 2017 (!) and it definitely came with Bitlocker enabled. In fact, HP explicitly says that all their laptops with modern standby (which again is most of them, and explicitly the Elitebook 840) come with Bitlocker on !! https://support.hp.com/us-en/document/c06458046 https://support.hp.com/us-en/document/c06458046 You could have said Acer or some other lesser-known brand and I would have not been able to counter, but HP? Are you sure "work" didn't configure Bitlocker to be disabled ?
- vladvasiliu 4y ago
  > Are you sure "work" didn't configure Bitlocker to be disabled ? Absolutely. I took the PC out of the box myself ("I am work") and I know we don't have our supplier do anything to the PCs before they send them to us, because we remaster them first thing. My PC didn't go through that process because it's not one of the models everyone else uses and I don't use Windows. --- edit: there's talk on a page referenced by your link about "Device Encryption" (as opposed to Drive encryption) which is activated when the PC is joined to a domain. This did actually happen, but out of the box the drive was not encrypted. The reason I know is because I went to enable regular Bitlocker but then stopped because I didn't have a separate drive on hand to save the recovery key.
  - AshamedCaptain 4y ago
    > there's talk on a page referenced by your link about "Device Encryption" (as opposed to Drive encryption) which is activated when the PC is joined to a domain. Device encryption, disk encryption, and Bitlocker are actually the same thing. The reason is that Windows Home doesn't have "Bitlocker" which means it can't do external (aka non-boot) disk encryption, so they call the resulting feature "Device encryption", but it's still Bitlocker. My only guess is that you didn't login with a Microsoft account, since it is a requirement and "you don't use Windows". But obviously, the majority of people do login with a Microsoft account, and judging from HP's own support page plus the amount of people I can google claiming to have lost their recovery keys on the same laptop model you have ... I'm quite sure it is enabled by default.

bobkazamakis 4y ago

> I guess my point is that it's unreasonable to expect a manufacturer to ship a computer with a bunch of certificates. I'd even say that it wouldn't be that secure. How exactly do you think a root trust should be established? Should it just boot up and start grabbing whatever certificates it thinks might be authentic over the network?

vladvasiliu 4y ago
Of course not. But the issue is that if there's a "root" certificate installed, then we're more or less in the current situation, where MS has that root certificate and anyone else who wants to have a bootloader must get it signed by MS. Sure, there could be some kind of "neutral" entity in charge of this, but the issue remains. Then there's also the issue of managing certificate revocations. Don't know how that works, currently. Maybe via firmware updates? But then, older computers are SoL. Instead, what I think should be done, is to improve the workflow and documentation for installing one's own certificates. It's what I do on my own PC to run Arch (whose bootloader is not signed by MS) and I also signed MS's certificates so I can dual-boot. But the whole process is somewhat involved, it's not a simple "click a few buttons and you're done" kind of deal.
- mjg59 4y ago
  >Then there's also the issue of managing certificate revocations. Revocation updates are in the form of authenticated UEFI variable blobs. They can be applied regardless of OS and don't require a firmware update.
admax88qqq 4y ago
Ship with no certificates, and Trust on First Use the certificate of whatever OS is installed first. There fixed it. No extra hoops for any OS. Extra hoops if you wish to change OS, which could increase security>

AshamedCaptain 4y ago

I am precisely typing this from an store-bought HP Elite laptop from 2017 (!) and it definitely came with Bitlocker enabled. In fact, HP explicitly says that all their laptops with modern standby (which again is most of them, and explicitly the Elitebook 840) come with Bitlocker on !! https://support.hp.com/us-en/document/c06458046 https://support.hp.com/us-en/document/c06458046 You could have said Acer or some other lesser-known brand and I would have not been able to counter, but HP? Are you sure "work" didn't configure Bitlocker to be disabled ?

vladvasiliu 4y ago
> Are you sure "work" didn't configure Bitlocker to be disabled ? Absolutely. I took the PC out of the box myself ("I am work") and I know we don't have our supplier do anything to the PCs before they send them to us, because we remaster them first thing. My PC didn't go through that process because it's not one of the models everyone else uses and I don't use Windows. --- edit: there's talk on a page referenced by your link about "Device Encryption" (as opposed to Drive encryption) which is activated when the PC is joined to a domain. This did actually happen, but out of the box the drive was not encrypted. The reason I know is because I went to enable regular Bitlocker but then stopped because I didn't have a separate drive on hand to save the recovery key.
- AshamedCaptain 4y ago
  > there's talk on a page referenced by your link about "Device Encryption" (as opposed to Drive encryption) which is activated when the PC is joined to a domain. Device encryption, disk encryption, and Bitlocker are actually the same thing. The reason is that Windows Home doesn't have "Bitlocker" which means it can't do external (aka non-boot) disk encryption, so they call the resulting feature "Device encryption", but it's still Bitlocker. My only guess is that you didn't login with a Microsoft account, since it is a requirement and "you don't use Windows". But obviously, the majority of people do login with a Microsoft account, and judging from HP's own support page plus the amount of people I can google claiming to have lost their recovery keys on the same laptop model you have ... I'm quite sure it is enabled by default.