4 ms·

I was a little dismayed to learn that 'supports linux' is regarded as an indicator that a machine could be easier to compromise :o

Hello71 3y ago
you could also say that "supports linux" allowed them to discover and remedy this vulnerability which would likely have still existed without linux support, thus making the device stronger for both windows and linux users.
londons_explore 3y ago
It's understandable though... 'supports linux' tends to mean secure boot isn't enforced, and you have a much higher chance of being able to just boot from a USB and dump the disk... I was disappointed when I installed linux on my laptop to find that a default ubuntu install could mount and decrypt a bitlocker encrypted windows drive with no trouble - while I was under the impression that the encryption keys were locked deep in the TPM and couldn't be extracted by anything but a securely booted windows installation.
- masfuerte 3y ago
  This is quite sensible. By default, you don't want a hardware failure to make your data irretrievable. You need to explicitly opt-in. https://superuser.com/questions/1299600/is-a-volume-with-bitlocker-waiting-for-activation-encrypted-or-not https://superuser.com/questions/1299600/is-a-volume-with-bit...
  - quietbritishjim 3y ago
    > By default, you don't want a hardware failure to make your data irretrievable. Er, what? Of course you do! At least if you've chosen to encrypt it. That's the whole point of doing so! Using Bitlocker is the explicit opt-in.
    - masfuerte 3y ago
      When I installed Windows 10 Bitlocker was turned on from the get go. I didn't choose it. Then it grumbled that it was "waiting for activation", which led me to the superuser post I linked to.
      - quietbritishjim 3y ago
        Ah ok that's different. Yes you want the computer to be (effectively) unencrypted until you say so, but that should be really clear too.
      - mewse-hn 3y ago
        Yep Microsoft has started trying to do bitlocker-by-default, it sits at "waiting for activation" until the user signs into windows with a microsoft account and then it ties the bitlocker to the person's microsoft account. Then an errant bios update can brick the computer. (Please don't) ask me how I know.
    - Dalewyn 3y ago
      Windows 11 (and maybe Windows 10?) default to Bitlocker activated if it realizes it's installed on a laptop or other mobile device. This means it's an opt-out situation and the user probably isn't aware that a boot failure or hardware failure can brick all his data that he really should keep backups of.
    - willis936 3y ago
      Indeed and it's always good practice to keep the key backed up somewhere safe. Often times you need to manually enter the bitlocker key after a hardware change. This is only slightly inconvenient and exactly what should happen. Popular linux distros being behind Windows on this front is one of the key reasons I still daily Windows.
- bri3d 3y ago
  > a default ubuntu install could mount and decrypt a bitlocker encrypted windows drive with no trouble This means BitLocker was off or "Pending Activation," so the Volume Master Key (VMK) was available in plaintext rather than sealed. When BitLocker is "On," the default is to seal the VMK using TPM PCRs 0, 2, 4, 7, and 11, so tampering with the Firmware (PCR0), UEFI Extensions (PCR2), UEFI Boot (PCR4), Secure Boot State (PCR7), or the BitLocker state itself (PCR11) will result in a failure to decrypt the key. Of course, there are vulnerabilities at every stage (especially sniffing key material as it transits the TPM), but the concept is reasonably sound.
  - drited 3y ago
    Is this why people elsewhere in this thread are saying that a bios update can brick a machine which uses bitlocker? I guess if a user doesn't have the key saved, a bios update would result in a request for the decryption key that can't be satisfied?
    - bri3d 3y ago
      Right, a BIOS upgrade will break the hash chain, because the system has gone and replaced the current trusted early boot software with new early boot software.
- mistrial9 3y ago
  malicious and/or willfully ignorant rumor -- supports linux is only prevented by manipulative and secretly negotiated boot locking from Redmond and friends
- pdntspa 3y ago
  You can always encrypt the drive with VeraCrypt, no TPM needed
compromimk 3y ago
[flagged]
deleted 3y ago
[deleted]

Hello71 3y ago

you could also say that "supports linux" allowed them to discover and remedy this vulnerability which would likely have still existed without linux support, thus making the device stronger for both windows and linux users.

londons_explore 3y ago

It's understandable though... 'supports linux' tends to mean secure boot isn't enforced, and you have a much higher chance of being able to just boot from a USB and dump the disk... I was disappointed when I installed linux on my laptop to find that a default ubuntu install could mount and decrypt a bitlocker encrypted windows drive with no trouble - while I was under the impression that the encryption keys were locked deep in the TPM and couldn't be extracted by anything but a securely booted windows installation.

masfuerte 3y ago
This is quite sensible. By default, you don't want a hardware failure to make your data irretrievable. You need to explicitly opt-in. https://superuser.com/questions/1299600/is-a-volume-with-bitlocker-waiting-for-activation-encrypted-or-not https://superuser.com/questions/1299600/is-a-volume-with-bit...
- quietbritishjim 3y ago
  > By default, you don't want a hardware failure to make your data irretrievable. Er, what? Of course you do! At least if you've chosen to encrypt it. That's the whole point of doing so! Using Bitlocker is the explicit opt-in.
  - masfuerte 3y ago
    When I installed Windows 10 Bitlocker was turned on from the get go. I didn't choose it. Then it grumbled that it was "waiting for activation", which led me to the superuser post I linked to.
    - quietbritishjim 3y ago
      Ah ok that's different. Yes you want the computer to be (effectively) unencrypted until you say so, but that should be really clear too.
    - mewse-hn 3y ago
      Yep Microsoft has started trying to do bitlocker-by-default, it sits at "waiting for activation" until the user signs into windows with a microsoft account and then it ties the bitlocker to the person's microsoft account. Then an errant bios update can brick the computer. (Please don't) ask me how I know.
  - Dalewyn 3y ago
    Windows 11 (and maybe Windows 10?) default to Bitlocker activated if it realizes it's installed on a laptop or other mobile device. This means it's an opt-out situation and the user probably isn't aware that a boot failure or hardware failure can brick all his data that he really should keep backups of.
  - willis936 3y ago
    Indeed and it's always good practice to keep the key backed up somewhere safe. Often times you need to manually enter the bitlocker key after a hardware change. This is only slightly inconvenient and exactly what should happen. Popular linux distros being behind Windows on this front is one of the key reasons I still daily Windows.
bri3d 3y ago
> a default ubuntu install could mount and decrypt a bitlocker encrypted windows drive with no trouble This means BitLocker was off or "Pending Activation," so the Volume Master Key (VMK) was available in plaintext rather than sealed. When BitLocker is "On," the default is to seal the VMK using TPM PCRs 0, 2, 4, 7, and 11, so tampering with the Firmware (PCR0), UEFI Extensions (PCR2), UEFI Boot (PCR4), Secure Boot State (PCR7), or the BitLocker state itself (PCR11) will result in a failure to decrypt the key. Of course, there are vulnerabilities at every stage (especially sniffing key material as it transits the TPM), but the concept is reasonably sound.
- drited 3y ago
  Is this why people elsewhere in this thread are saying that a bios update can brick a machine which uses bitlocker? I guess if a user doesn't have the key saved, a bios update would result in a request for the decryption key that can't be satisfied?
  - bri3d 3y ago
    Right, a BIOS upgrade will break the hash chain, because the system has gone and replaced the current trusted early boot software with new early boot software.
mistrial9 3y ago
malicious and/or willfully ignorant rumor -- supports linux is only prevented by manipulative and secretly negotiated boot locking from Redmond and friends
pdntspa 3y ago
You can always encrypt the drive with VeraCrypt, no TPM needed

compromimk 3y ago

[flagged]

deleted 3y ago

[deleted]