3 ms·

> What does that do for me to stop malware? Bitlocker is only protecting an offline system LUKS also only protects an online system. So why are you using it?

> What does that do for me to stop malware? Bitlocker is only protecting an offline system LUKS also only protects an online system. So why are you using it? Oh, I think I know, if you are on Windows it's bad to use BitLocker because it's made by Microsoft and it doesn't protect against malware, but if you're on Linux of course you use LUKS, it's a sensible thing to do. Got it.

croes 2y ago
The point is Linux doesn't enforce useless hardware that on top could be used against the user. Same with MS's recall feature. A Windows PC is just C but not P anymore.
doubled112 2y ago
Back in my retail computer technician and sales days, it wasn’t uncommon for somebody to lose their Bitlocker keys, and encryption did what it was designed to do - make the data unreadable without them. Sometimes they didn’t even understand what they enabled. To that customer, Bitlocker itself was a threat. In my small sample size, I’ve seen that more often than lost laptops. I’ve also seen many more malware infections. Tying encryption to the TPM, which is the default, makes it easier to lose those keys. With LUKS I choose my own password. It’s an important implementation difference, especially if it is going to do it by default. Warning a person “you will lose all data if you don’t write this down” in big bold red text is sometimes not enough. Does tying those keys to your MS account fix that failure method?
- EvanAnderson 2y ago
  > Does tying those keys to your MS account fix that failure method? Yes. Bitlocker recovery keys are escrowed to the Microsoft account. I've relied on this recover data from a family member's PC when it failed and they had unknowingly opted-in to Bitlocker (a Microsoft Surface Laptop running Windows 10 S Mode).
  - r2_pilot 2y ago
    >> Does tying those keys to your MS account fix that failure method? >Yes. Bitlocker recovery keys are escrowed to the Microsoft account. Which then opens the door to other attack vectors, even government.
    - doubled112 2y ago
      I’d imagine most people would like some insurance in the event of loss or theft, but are not worried about government. I’m vulnerable to the $8 wrench attack, but enjoy knowing it is only a VISA problem if I leave it a laptop the bus.
      - r2_pilot 2y ago
        I mention that only because it's one avenue. I figured obviously on a place like Hacker News that malicious agents aside from government could also compromise the security of 3rd party-held keys; as always security is a matter of difficult tradeoffs and anticipated threat categories.
      - seabass-labrax 2y ago
        I'm genuinely curious to know how VISA helps (or doesn't) in your analogy - what is a 'VISA problem'?
        doubled112 2y ago
        Mostly a joke, but I swipe a card and the problem goes away. No need to worry anymore.
        seabass-labrax 2y ago
        Ah, thank you; I get it now: you don't need to worry about data theft because the drive was encrypted, so the only remaining problem is buying a replacement - a 'VISA' problem. I rather like that way of putting it; I might use it myself :)

croes 2y ago

The point is Linux doesn't enforce useless hardware that on top could be used against the user. Same with MS's recall feature. A Windows PC is just C but not P anymore.

doubled112 2y ago

Back in my retail computer technician and sales days, it wasn’t uncommon for somebody to lose their Bitlocker keys, and encryption did what it was designed to do - make the data unreadable without them. Sometimes they didn’t even understand what they enabled. To that customer, Bitlocker itself was a threat. In my small sample size, I’ve seen that more often than lost laptops. I’ve also seen many more malware infections. Tying encryption to the TPM, which is the default, makes it easier to lose those keys. With LUKS I choose my own password. It’s an important implementation difference, especially if it is going to do it by default. Warning a person “you will lose all data if you don’t write this down” in big bold red text is sometimes not enough. Does tying those keys to your MS account fix that failure method?

EvanAnderson 2y ago
> Does tying those keys to your MS account fix that failure method? Yes. Bitlocker recovery keys are escrowed to the Microsoft account. I've relied on this recover data from a family member's PC when it failed and they had unknowingly opted-in to Bitlocker (a Microsoft Surface Laptop running Windows 10 S Mode).
- r2_pilot 2y ago
  >> Does tying those keys to your MS account fix that failure method? >Yes. Bitlocker recovery keys are escrowed to the Microsoft account. Which then opens the door to other attack vectors, even government.
  - doubled112 2y ago
    I’d imagine most people would like some insurance in the event of loss or theft, but are not worried about government. I’m vulnerable to the $8 wrench attack, but enjoy knowing it is only a VISA problem if I leave it a laptop the bus.
    - r2_pilot 2y ago
      I mention that only because it's one avenue. I figured obviously on a place like Hacker News that malicious agents aside from government could also compromise the security of 3rd party-held keys; as always security is a matter of difficult tradeoffs and anticipated threat categories.
    - seabass-labrax 2y ago
      I'm genuinely curious to know how VISA helps (or doesn't) in your analogy - what is a 'VISA problem'?
      - doubled112 2y ago
        Mostly a joke, but I swipe a card and the problem goes away. No need to worry anymore.
        seabass-labrax 2y ago
        Ah, thank you; I get it now: you don't need to worry about data theft because the drive was encrypted, so the only remaining problem is buying a replacement - a 'VISA' problem. I rather like that way of putting it; I might use it myself :)