3 ms·

What is in that docx file? What is this backdoor that will crack a personal Bitlocker drive encrypted with a PIN? There is (another) 'backdoor' that I know abou

What is in that docx file? What is this backdoor that will crack a personal Bitlocker drive encrypted with a PIN? There is (another) 'backdoor' that I know about which is only a backdoor because people don't generally know it exists, but if you use your Windows account to log in with Windows and decrypt the Bitlocker drive, it stores your key in the cloud so that you can unlock it by using the MS account as a 'password reset' feature. I am sure this exists because people don't understand that the question 'I encrypted my drive and forget the password, how do I fix it' is 'you can't', unless you make the encryption worthless by having the key somewhere other people can access. But MS really doesn't care because it also allows businesses to unlock their employee's machines, and a business's concerns are the only concerns MS cares about, and only partially and only sometimes.

Grimeton 2y ago
This allows you to write a binary to the system's memory that is then read by Windows on startup, stored on the hard drive and executed with system privileges. The sheer existance of the feature came to light when people began to wonder why Lenovo is able to install their install service every time after they did a clean installation. They went as far as changing the hard drive and the service still reappeared. Asking Lenovo what was going on, Lenovo replied with the information about this and Microsoft had to come up with some documentation. Its existance was neither communicated to the public nor documented anywhere in Microsoft's documentation. Just google the name and be surprised how you cannot find anything about it on Microsoft's pages besides this one document.
- Eisenstein 2y ago
  Bitlocker has never been marketed as a consumer solution for privacy, it has been marketed as a way for companies to lock down their data if an employee's laptop get stolen or they get fired and don't return it. Anyone that expects that Bitlocker would keep their data private in all cases where they do not personally unlock it is naive.
- jasomill 2y ago
  While apparently undocumented, you can disable WPBT execution by adding a value to the registry: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /f /t REG_DWORD /v DisableWpbtExecution /d 1
  - Grimeton 2y ago
    Yeah another reason why I don't like this. This isn't documented either I cannot verify if it's true and if it does what it's supposed to do. The whole feature shouldn't be there in the first place and while WBPT has been documented since Windows 8, similar features have existed way before that and where never documented.

Grimeton 2y ago

This allows you to write a binary to the system's memory that is then read by Windows on startup, stored on the hard drive and executed with system privileges. The sheer existance of the feature came to light when people began to wonder why Lenovo is able to install their install service every time after they did a clean installation. They went as far as changing the hard drive and the service still reappeared. Asking Lenovo what was going on, Lenovo replied with the information about this and Microsoft had to come up with some documentation. Its existance was neither communicated to the public nor documented anywhere in Microsoft's documentation. Just google the name and be surprised how you cannot find anything about it on Microsoft's pages besides this one document.

Eisenstein 2y ago
Bitlocker has never been marketed as a consumer solution for privacy, it has been marketed as a way for companies to lock down their data if an employee's laptop get stolen or they get fired and don't return it. Anyone that expects that Bitlocker would keep their data private in all cases where they do not personally unlock it is naive.
jasomill 2y ago
While apparently undocumented, you can disable WPBT execution by adding a value to the registry: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /f /t REG_DWORD /v DisableWpbtExecution /d 1
- Grimeton 2y ago
  Yeah another reason why I don't like this. This isn't documented either I cannot verify if it's true and if it does what it's supposed to do. The whole feature shouldn't be there in the first place and while WBPT has been documented since Windows 8, similar features have existed way before that and where never documented.