4 ms·

This is something that's bugged me about BitLocker for ages: What's the point of encrypting your disks if the computer automatically decrypts them anyway? The o

This is something that's bugged me about BitLocker for ages: What's the point of encrypting your disks if the computer automatically decrypts them anyway? The only situation I can see where this helps you is if someone steals your disk but not your computer, but that seems very unlikely to me. Maybe if someone just clones the disk, but again, it seems much more likely to me that if you're a high enough value target to do that, a bad actor would just grab your device.

pixl97 1y ago
Bitlocker has options to require a pin/password/network attestation at boot. Most people don't use it, but it exists. Also, a lot of data theft is from after a disk is disposed of and reused. Bitlocker prevents that from happening.
lostmsu 1y ago
It does decrypt them. But then what? How are you the thief going to extract them or data from RAM of a working machine?
- lkjdsklf 1y ago
  If it’s decrypted, you don’t need to steal it from RAM. You just do normal file operations and copy the files
  - adgjlsfhk1 1y ago
    you need to login to do that. The point of bitlocker is that it prevents filesystem access from a different OS install.
cesarb 1y ago
> What's the point of encrypting your disks if the computer automatically decrypts them anyway? The important detail you're missing is: the computer automatically decrypts your disks if you're booting into that operating system. Try booting into something else (like a Linux CD), and you'll see that the TPM does not release the encryption key (the way it works is that each step of the boot sequence records into the TPM what's going on, and the TPM will only release the key if the sequence matches what it expects). The point is that the disks will only be decrypted when booting into the expected OS, and that this OS will require you to login before giving anyone access to your files. > The only situation I can see where this helps you is if someone steals your disk but not your computer, but that seems very unlikely to me. It'll also help if someone steals the computer but does not have your login password; they can boot into Windows, the files will be decrypted while booted into Windows, but without logging into your account, they are not accessible. Of course, unless you're using memory encryption (which I don't think is normally available on normal non-server devices), someone with the right hardware knowledge and an expensive set of hardware tools could in theory manipulate the RAM to get access.
hulitu 1y ago
> What's the point of encrypting your disks if the computer automatically decrypts them anyway? Your security. We also back up your key in the cloud, in case you forget it. /s
theatomheart 1y ago
Maybe YOUR computer decrypts the disk automatically, if you set yours up that way. My Linux computer does nothing automatically that I dont know about, especially decrypting my disk. All my clients use Windows but even that decryption requires authentication, not automatic for anyone even the CEO.

pixl97 1y ago

Bitlocker has options to require a pin/password/network attestation at boot. Most people don't use it, but it exists. Also, a lot of data theft is from after a disk is disposed of and reused. Bitlocker prevents that from happening.

lostmsu 1y ago

It does decrypt them. But then what? How are you the thief going to extract them or data from RAM of a working machine?

lkjdsklf 1y ago
If it’s decrypted, you don’t need to steal it from RAM. You just do normal file operations and copy the files
- adgjlsfhk1 1y ago
  you need to login to do that. The point of bitlocker is that it prevents filesystem access from a different OS install.

cesarb 1y ago

> What's the point of encrypting your disks if the computer automatically decrypts them anyway? The important detail you're missing is: the computer automatically decrypts your disks if you're booting into that operating system. Try booting into something else (like a Linux CD), and you'll see that the TPM does not release the encryption key (the way it works is that each step of the boot sequence records into the TPM what's going on, and the TPM will only release the key if the sequence matches what it expects). The point is that the disks will only be decrypted when booting into the expected OS, and that this OS will require you to login before giving anyone access to your files. > The only situation I can see where this helps you is if someone steals your disk but not your computer, but that seems very unlikely to me. It'll also help if someone steals the computer but does not have your login password; they can boot into Windows, the files will be decrypted while booted into Windows, but without logging into your account, they are not accessible. Of course, unless you're using memory encryption (which I don't think is normally available on normal non-server devices), someone with the right hardware knowledge and an expensive set of hardware tools could in theory manipulate the RAM to get access.

hulitu 1y ago

> What's the point of encrypting your disks if the computer automatically decrypts them anyway? Your security. We also back up your key in the cloud, in case you forget it. /s

theatomheart 1y ago

Maybe YOUR computer decrypts the disk automatically, if you set yours up that way. My Linux computer does nothing automatically that I dont know about, especially decrypting my disk. All my clients use Windows but even that decryption requires authentication, not automatic for anyone even the CEO.