3 ms·

>Bitlocker is the Windows one, that's essentially known to be compromised, right? It's not compromised if you set a PIN/passkey, aka use it correctly. Technic

>Bitlocker is the Windows one, that's essentially known to be compromised, right? It's not compromised if you set a PIN/passkey, aka use it correctly. Technically, the lock on your house door is also compromised since any pro locksmith can open it within a few minutes, but that doesn't mean it's now useless to keep locking your door since most casual thieves aren't pro locksmiths and laptop thieves aren't gonna be black-hat hackers/security researchers. Such security solutions are there to discourage low hanging fruits of amateur bad actors(99,99% of them) and make them give up and use their time somewhere else.

vladvasiliu 3y ago
> It's not compromised if you set a PIN/passkey, aka use it correctly. The issue is that you have to go out of your way to set it up this way. Last I checked, you couldn't just add a PIN. You had to enable it through GPO.
- GordonS 3y ago
  IIRC you can set a PIN without fiddling with security settings or GPOs, but if you want to use a password instead of a PIN, then you've got to jump through some hoops to enable that. It always struck me as a very, very strange design choice - why make it so difficult?!
  - vladvasiliu 3y ago
    Just checked on my up-to-date win 11 22h2 pro. I can't set a pin by default. > Computer Config / Admin templates / Win components / Bitlocker / Os Drive / Require additional authentication at startup > If you disable or do not configure this policy setting, users can configure only basic options on computers with a TPM. This enables tpm + pin and / or password unlock. But only numeric pins. If you want alphanumeric, or "enhanced", pins, you have to enable a separate GPO in the same place: allow enhanced pins for startup. > If you disable or do not configure this policy setting, enhanced PINs will not be used.
- FirmwareBurner 3y ago
  It's on for corporate users, but I assume because it would be a terrible UX for consumers, having users always enter a PIN code at boot/re-boot and would make them throw their PCs out the window. It's even worse if you use a Bluetooth keyboard as that doesn't work at BIOS level so you'd have to plug in an USB keyboard just to enter your PIN on boot. Would be maddening and people would just turn it off.

vladvasiliu 3y ago

> It's not compromised if you set a PIN/passkey, aka use it correctly. The issue is that you have to go out of your way to set it up this way. Last I checked, you couldn't just add a PIN. You had to enable it through GPO.

GordonS 3y ago
IIRC you can set a PIN without fiddling with security settings or GPOs, but if you want to use a password instead of a PIN, then you've got to jump through some hoops to enable that. It always struck me as a very, very strange design choice - why make it so difficult?!
- vladvasiliu 3y ago
  Just checked on my up-to-date win 11 22h2 pro. I can't set a pin by default. > Computer Config / Admin templates / Win components / Bitlocker / Os Drive / Require additional authentication at startup > If you disable or do not configure this policy setting, users can configure only basic options on computers with a TPM. This enables tpm + pin and / or password unlock. But only numeric pins. If you want alphanumeric, or "enhanced", pins, you have to enable a separate GPO in the same place: allow enhanced pins for startup. > If you disable or do not configure this policy setting, enhanced PINs will not be used.
FirmwareBurner 3y ago
It's on for corporate users, but I assume because it would be a terrible UX for consumers, having users always enter a PIN code at boot/re-boot and would make them throw their PCs out the window. It's even worse if you use a Bluetooth keyboard as that doesn't work at BIOS level so you'd have to plug in an USB keyboard just to enter your PIN on boot. Would be maddening and people would just turn it off.