3 ms·

Bitlocker is the Windows one, that's essentially known to be compromised, right? Not saying that it's useless, might be fine for certain work environments, but

by jrm4 3y ago

Bitlocker is the Windows one, that's essentially known to be compromised, right? Not saying that it's useless, might be fine for certain work environments, but I wouldn't rely on it for anything truly personal.

FirmwareBurner 3y ago
>Bitlocker is the Windows one, that's essentially known to be compromised, right? It's not compromised if you set a PIN/passkey, aka use it correctly. Technically, the lock on your house door is also compromised since any pro locksmith can open it within a few minutes, but that doesn't mean it's now useless to keep locking your door since most casual thieves aren't pro locksmiths and laptop thieves aren't gonna be black-hat hackers/security researchers. Such security solutions are there to discourage low hanging fruits of amateur bad actors(99,99% of them) and make them give up and use their time somewhere else.
- vladvasiliu 3y ago
  > It's not compromised if you set a PIN/passkey, aka use it correctly. The issue is that you have to go out of your way to set it up this way. Last I checked, you couldn't just add a PIN. You had to enable it through GPO.
  - GordonS 3y ago
    IIRC you can set a PIN without fiddling with security settings or GPOs, but if you want to use a password instead of a PIN, then you've got to jump through some hoops to enable that. It always struck me as a very, very strange design choice - why make it so difficult?!
    - vladvasiliu 3y ago
      Just checked on my up-to-date win 11 22h2 pro. I can't set a pin by default. > Computer Config / Admin templates / Win components / Bitlocker / Os Drive / Require additional authentication at startup > If you disable or do not configure this policy setting, users can configure only basic options on computers with a TPM. This enables tpm + pin and / or password unlock. But only numeric pins. If you want alphanumeric, or "enhanced", pins, you have to enable a separate GPO in the same place: allow enhanced pins for startup. > If you disable or do not configure this policy setting, enhanced PINs will not be used.
  - FirmwareBurner 3y ago
    It's on for corporate users, but I assume because it would be a terrible UX for consumers, having users always enter a PIN code at boot/re-boot and would make them throw their PCs out the window. It's even worse if you use a Bluetooth keyboard as that doesn't work at BIOS level so you'd have to plug in an USB keyboard just to enter your PIN on boot. Would be maddening and people would just turn it off.
jeroenhd 3y ago
I'm not aware of any proven compromise of Bitlocker. There are some bugs (Bitlocker disabling itself during certain updates and not re-enabling it after a BSOD during the update process) but I haven't heard of any way for an attacker who doesn't have full code execution already to bypass encryption. If you set a PIN you should be safe, otherwise the attacker can try to use various exploits or other methods to access the drives. For fTPM based encryption, the entire system should be safer because the keys don't traverse an accessible bus like this. The vulnerability also applies to other encryption systems using the TPM, like LUKS disk encryption.
- hedora 3y ago
  It sends escrow keys to your employer in enterprise environments. I’d be a bit surprised if the azure compromise a few weeks ago didn’t also give the attackers access to the escrow keys for customer vms, etc.
  - jeroenhd 3y ago
    That's not a bypass, though, that's part of the design. If you're storing critical business info on company hardware that your boss can't access when you leave/get hurt, encryption becomes a business risk. I don't know if key escrow is also fucked as well after the recent breach, but so far I haven't heard anything about it.
- als0 3y ago
  > The vulnerability also applies to other encryption systems using the TPM, like LUKS disk encryption. No, this is a Bitlocker problem. Systemd LUKS disk encryption uses encryption on the bus by enabling TPM encrypted sessions: https://github.com/systemd/systemd/commit/acbb504eaf1be51572b1c0d0d490ac478bc41c64 https://github.com/systemd/systemd/commit/acbb504eaf1be51572...
  - jeroenhd 3y ago
    I stand corrected, I'm glad systemd finally implemented encrypted TPM communication. I really don't understand why Microsoft is still allowing their keys to be MITM'd. I really should switch from Grub to systemd but the lack of boot time configuration (and, slightly less importantly, theming support) still makes me prefer Grub.
shuntress 3y ago
> might be fine for certain work environments, but I wouldn't rely on it for anything truly personal Funny, I feel the same way but to an opposite conclusion. Hardware-locked encryption is basically the last thing I want on my notes/projects/code/pictures/etc.
jrm4 3y ago
so the answer is yes, yet downvoted to zero. weird.
jrm4 3y ago
So again, I'm right and still downvoted. Anyway, I hadn't done much homework on it, but the thing that let me presume this pretty well was when Truecrypt was likely canaried and they told us to go to Bitlocker. So, Hacker News, gonna do anything about your pro MS trolls? Would be nice.

by jrm4 3y ago

FirmwareBurner 3y ago

>Bitlocker is the Windows one, that's essentially known to be compromised, right? It's not compromised if you set a PIN/passkey, aka use it correctly. Technically, the lock on your house door is also compromised since any pro locksmith can open it within a few minutes, but that doesn't mean it's now useless to keep locking your door since most casual thieves aren't pro locksmiths and laptop thieves aren't gonna be black-hat hackers/security researchers. Such security solutions are there to discourage low hanging fruits of amateur bad actors(99,99% of them) and make them give up and use their time somewhere else.

vladvasiliu 3y ago
> It's not compromised if you set a PIN/passkey, aka use it correctly. The issue is that you have to go out of your way to set it up this way. Last I checked, you couldn't just add a PIN. You had to enable it through GPO.
- GordonS 3y ago
  IIRC you can set a PIN without fiddling with security settings or GPOs, but if you want to use a password instead of a PIN, then you've got to jump through some hoops to enable that. It always struck me as a very, very strange design choice - why make it so difficult?!
  - vladvasiliu 3y ago
    Just checked on my up-to-date win 11 22h2 pro. I can't set a pin by default. > Computer Config / Admin templates / Win components / Bitlocker / Os Drive / Require additional authentication at startup > If you disable or do not configure this policy setting, users can configure only basic options on computers with a TPM. This enables tpm + pin and / or password unlock. But only numeric pins. If you want alphanumeric, or "enhanced", pins, you have to enable a separate GPO in the same place: allow enhanced pins for startup. > If you disable or do not configure this policy setting, enhanced PINs will not be used.
- FirmwareBurner 3y ago
  It's on for corporate users, but I assume because it would be a terrible UX for consumers, having users always enter a PIN code at boot/re-boot and would make them throw their PCs out the window. It's even worse if you use a Bluetooth keyboard as that doesn't work at BIOS level so you'd have to plug in an USB keyboard just to enter your PIN on boot. Would be maddening and people would just turn it off.

jeroenhd 3y ago

I'm not aware of any proven compromise of Bitlocker. There are some bugs (Bitlocker disabling itself during certain updates and not re-enabling it after a BSOD during the update process) but I haven't heard of any way for an attacker who doesn't have full code execution already to bypass encryption. If you set a PIN you should be safe, otherwise the attacker can try to use various exploits or other methods to access the drives. For fTPM based encryption, the entire system should be safer because the keys don't traverse an accessible bus like this. The vulnerability also applies to other encryption systems using the TPM, like LUKS disk encryption.

hedora 3y ago
It sends escrow keys to your employer in enterprise environments. I’d be a bit surprised if the azure compromise a few weeks ago didn’t also give the attackers access to the escrow keys for customer vms, etc.
- jeroenhd 3y ago
  That's not a bypass, though, that's part of the design. If you're storing critical business info on company hardware that your boss can't access when you leave/get hurt, encryption becomes a business risk. I don't know if key escrow is also fucked as well after the recent breach, but so far I haven't heard anything about it.
als0 3y ago
> The vulnerability also applies to other encryption systems using the TPM, like LUKS disk encryption. No, this is a Bitlocker problem. Systemd LUKS disk encryption uses encryption on the bus by enabling TPM encrypted sessions: https://github.com/systemd/systemd/commit/acbb504eaf1be51572b1c0d0d490ac478bc41c64 https://github.com/systemd/systemd/commit/acbb504eaf1be51572...
- jeroenhd 3y ago
  I stand corrected, I'm glad systemd finally implemented encrypted TPM communication. I really don't understand why Microsoft is still allowing their keys to be MITM'd. I really should switch from Grub to systemd but the lack of boot time configuration (and, slightly less importantly, theming support) still makes me prefer Grub.

shuntress 3y ago

> might be fine for certain work environments, but I wouldn't rely on it for anything truly personal Funny, I feel the same way but to an opposite conclusion. Hardware-locked encryption is basically the last thing I want on my notes/projects/code/pictures/etc.

jrm4 3y ago

so the answer is yes, yet downvoted to zero. weird.

jrm4 3y ago

So again, I'm right and still downvoted. Anyway, I hadn't done much homework on it, but the thing that let me presume this pretty well was when Truecrypt was likely canaried and they told us to go to Bitlocker. So, Hacker News, gonna do anything about your pro MS trolls? Would be nice.