4 ms·

The first point was not entirely obvious before this—your laptop being stolen is essentially the weakest[1] class of threats against which full-disk encryption

The first point was not entirely obvious before this—your laptop being stolen is essentially the weakest[1] class of threats against which full-disk encryption makes sense, and Windows makes a big deal against not requiring anything but your usual account password for that. Is the “trusted” hardware in the TPM even doing anything now? Is boot measurement also spoofable? (Also, this is just offensive levels of dumb—why is the key material just strolling along the bus here in plain view? There isn’t even a key exchange protocol or anything.) [1] People are also talking about secure erase here, which, okay, is weaker, but FDE + a EEPROM in a socket that you can pull out and physically destroy does that part just as effectively.

vladvasiliu 3y ago
The windows password is not required for Bitlocker. It doesn't work like macos' filevault. You can configure a dedicated password for bitlocker, or a pin (can be alphanumeric) in addition to the tpm, but there's no link between that and your windows account once the os is booted. I think MS' point about the standard bitlocker setup is that people can't just steal the drive and mount it in their own PC, they need your specific PC. And also, that windows is secure enough that if you have the correct PC with the drive and the OS boots, you can't open the windows session (which by default requires a password). So in this context, bitlocker adds some security while being "transparent".
layer8 3y ago
Windows supports multiple accounts, hence an account password doesn’t apply to Bitlocker, which encrypts the main Windows partition as a whole. You need a separate Bitlocker password that the boot loader requests from the user before Windows proper is loaded, and before any accounts come into play.
- mananaysiempre 3y ago
  I am aware (and my point of comparison is LUKS, where the separate password is extremely in-your-face). But my impression from Windows was that, in the default FDE configuration, the (measured?) OS boots up, pulls the FDE key from the TPM with no user input, then presents the user with a login screen. So in ideal world the data is exactly as secure against a thief as the account password or passwords, thus my mention of them. This article, however, says that this setup does not protect the data at all against a thief willing to pay $100 lifetime (not per machine), which seems an absurdly low bar. (And I’d wager you can go even lower by wiring up a cheap devboard—basically everything has a SPI peripheral these days.) I mean, liquid nitrogen is not exactly expensive either, but it does require some fuss, whereas the attack in TFA could be made essentially as easy as opening the case.
  - layer8 3y ago
    I’d say that as soon as Windows fully boots up, you have a much larger attack surface anyway, even if you can’t log in due to the account password. Though I can’t point at anything specific off the top of my head.
    - plonk 3y ago
      Is there anything you could access from the keyboard or touchpad? Seems easy enough to only accept the inputs that the login screen needs and nothing else.
    - gquere 3y ago
      Only DMA comes to mind but it requires a non-hardened configuration which isn't that common on recent laptops + OS.
      - mananaysiempre 3y ago
        Very rarely are drivers, including USB drivers, written to assume a hostile device (see e.g. the PS3). Frankly, they rarely seem to be written by people who care about software at all. (I still can’t get over the very first Zenbook, which suffered spontaneous deaths under Linux because the ACPI bytecode in the firmware tried to initialize a nonexistent IDE controller. And people say it’s Linux that has a hardware support problem.) So this is a somewhat valid concern. But I still can’t get over the idea where the default configuration of BitLocker is completely useless for basically anything except working around storage devices that will lie to you and not erase things you told them to. I just refuse to accept that’s in any way sane.

vladvasiliu 3y ago

The windows password is not required for Bitlocker. It doesn't work like macos' filevault. You can configure a dedicated password for bitlocker, or a pin (can be alphanumeric) in addition to the tpm, but there's no link between that and your windows account once the os is booted. I think MS' point about the standard bitlocker setup is that people can't just steal the drive and mount it in their own PC, they need your specific PC. And also, that windows is secure enough that if you have the correct PC with the drive and the OS boots, you can't open the windows session (which by default requires a password). So in this context, bitlocker adds some security while being "transparent".

layer8 3y ago

Windows supports multiple accounts, hence an account password doesn’t apply to Bitlocker, which encrypts the main Windows partition as a whole. You need a separate Bitlocker password that the boot loader requests from the user before Windows proper is loaded, and before any accounts come into play.

mananaysiempre 3y ago
I am aware (and my point of comparison is LUKS, where the separate password is extremely in-your-face). But my impression from Windows was that, in the default FDE configuration, the (measured?) OS boots up, pulls the FDE key from the TPM with no user input, then presents the user with a login screen. So in ideal world the data is exactly as secure against a thief as the account password or passwords, thus my mention of them. This article, however, says that this setup does not protect the data at all against a thief willing to pay $100 lifetime (not per machine), which seems an absurdly low bar. (And I’d wager you can go even lower by wiring up a cheap devboard—basically everything has a SPI peripheral these days.) I mean, liquid nitrogen is not exactly expensive either, but it does require some fuss, whereas the attack in TFA could be made essentially as easy as opening the case.
- layer8 3y ago
  I’d say that as soon as Windows fully boots up, you have a much larger attack surface anyway, even if you can’t log in due to the account password. Though I can’t point at anything specific off the top of my head.
  - plonk 3y ago
    Is there anything you could access from the keyboard or touchpad? Seems easy enough to only accept the inputs that the login screen needs and nothing else.
  - gquere 3y ago
    Only DMA comes to mind but it requires a non-hardened configuration which isn't that common on recent laptops + OS.
    - mananaysiempre 3y ago
      Very rarely are drivers, including USB drivers, written to assume a hostile device (see e.g. the PS3). Frankly, they rarely seem to be written by people who care about software at all. (I still can’t get over the very first Zenbook, which suffered spontaneous deaths under Linux because the ACPI bytecode in the firmware tried to initialize a nonexistent IDE controller. And people say it’s Linux that has a hardware support problem.) So this is a somewhat valid concern. But I still can’t get over the idea where the default configuration of BitLocker is completely useless for basically anything except working around storage devices that will lie to you and not erase things you told them to. I just refuse to accept that’s in any way sane.