4 ms·

I think the main issue with the default BitLocker configuration is that you must have recovery key saved somewhere (either on OneDrive, printed out, or on some

I think the main issue with the default BitLocker configuration is that you must have recovery key saved somewhere (either on OneDrive, printed out, or on some other storage). If something changes with the hardware/software configuration, and TPM unlock doesn't work, your data is lost, unless you have access to the recovery key. This is completely different compared to other platforms, where you use a separate password (Linux LUKS), account password (macOS), or PIN (iOS, Android) to unlock the drive.

TowerTall 1y ago
How is a recovery key different from a a password or pin? They are both just a string you need to enter during the recovery process and if you have lost that string you cannot unlock the drive
- nly 1y ago
  They are randomly generated and therefore high entropy.
- manwe150 1y ago
  You have to enter them on every boot before the OS will be able to decrypt the drive. On windows, the key is loaded into memory automatically almost all of the time, and only if it thinks something goes wrong does it suddenly stop working. Or in the case of my colleague, because windows changed his recovery key without notifying him that his backup key was no longer valid. (It deleted it because it thought his key escrow policy had changed, and since that requires generating a new key, it has to delete the old key. Unfortunately escrow policy hadn’t actually changed, so all backup unlocking sources all still had the old key)
- josephcsible 1y ago
  The difference is that it's neither expected nor practical to memorize your recovery key.
bigfatkitten 1y ago
It’s no different at all to LUKS if you use TPM unlock.
- josephcsible 1y ago
  That's true, but LUKS with TPM unlock is something that you have to go out of your way to set up, not something that gets enabled on your system automatically even if you have no idea what it is or how it works.
7bit 1y ago
Your understanding of BitLocker is off. 1. There always is a recovery key, not only in the default configuration. And you should always have a copy of it stored somewhere else than on the same computer. 2. Your software configuration does not influence BitLocker, unless of course you manually wipe TPM or reset your BitLocker PIN. Your hardware configuration also does not influence BitLocker, unless you swap the TPM chip, of course. I'm also not counting changes to the boot order etc that could break TPM mode (no PIN) because messing with the PC on that level can cause damage to any Computer, not only BitLocker protected ones. 3. BitLocker also can use a separate password (or PIN) to unlock the drive, which also protects against certain attacks that are possible with TPM mode (no PIN)

TowerTall 1y ago

How is a recovery key different from a a password or pin? They are both just a string you need to enter during the recovery process and if you have lost that string you cannot unlock the drive

nly 1y ago
They are randomly generated and therefore high entropy.
manwe150 1y ago
You have to enter them on every boot before the OS will be able to decrypt the drive. On windows, the key is loaded into memory automatically almost all of the time, and only if it thinks something goes wrong does it suddenly stop working. Or in the case of my colleague, because windows changed his recovery key without notifying him that his backup key was no longer valid. (It deleted it because it thought his key escrow policy had changed, and since that requires generating a new key, it has to delete the old key. Unfortunately escrow policy hadn’t actually changed, so all backup unlocking sources all still had the old key)
josephcsible 1y ago
The difference is that it's neither expected nor practical to memorize your recovery key.

bigfatkitten 1y ago

It’s no different at all to LUKS if you use TPM unlock.

josephcsible 1y ago
That's true, but LUKS with TPM unlock is something that you have to go out of your way to set up, not something that gets enabled on your system automatically even if you have no idea what it is or how it works.

7bit 1y ago

Your understanding of BitLocker is off. 1. There always is a recovery key, not only in the default configuration. And you should always have a copy of it stored somewhere else than on the same computer. 2. Your software configuration does not influence BitLocker, unless of course you manually wipe TPM or reset your BitLocker PIN. Your hardware configuration also does not influence BitLocker, unless you swap the TPM chip, of course. I'm also not counting changes to the boot order etc that could break TPM mode (no PIN) because messing with the PC on that level can cause damage to any Computer, not only BitLocker protected ones. 3. BitLocker also can use a separate password (or PIN) to unlock the drive, which also protects against certain attacks that are possible with TPM mode (no PIN)