4 ms·
I’m not trying to defend Microsoft, but I think people are being a bit dramatic. It's a fairly reasonable default setting for average users who simply want thei
by pregnenolone 9mo ago
I’m not trying to defend Microsoft, but I think people are being a bit dramatic. It's a fairly reasonable default setting for average users who simply want their data protected from theft. On the other hand, users should be able to opt out from the outset, and above all, without having to fiddle with the manage-bde CLI or group policy settings.
With Intel Panther Lake (I'm not sure about AMD), Bitlocker will be entirely hardware-accelerated using dedicated SoC engines – which is a huge improvement and addresses many commonly known Full Disk Encryption vulnerabilities. However, in my opinion some changes still need to be made, particularly for machines without hardware acceleration support:
- Let users opt out of storing recovery keys online during setup.
- Let users choose between TPM or password based FDE during setup and let them switch between those options without forcing them to deal with group policies and the CLI.
- Change the KDF to a memory-hard KDF - this is important for both password and PIN protected FDE. It's 2026 - we shouldn't be spamming SHA256 anymore.
- Remove the 20 char limit from PIN protectors and make them alphanumerical by default. Windows 11 requires TPM 2.0 anyway so there's no point in enforcing a 20 char limit.
- Enable TPM parameter encryption for the same reasons outlined above.
- hinkley 9mo agoIf you don’t think Intel put back doors into that then I fear for the future.
- pregnenolone 9mo ago> If you don’t think Intel put back doors into that then I fear for the future. If that’s what you’re worried about, you shouldn’t be using computers at all. I can pretty much guarantee that Linux will adopt SoC based hardware acceleration because the benefits – both in performance and security – outweigh the theoretical risks.
- hinkley 9mo agoThey resisted hardware RNG when it first was introduced. Brian Cantrill is trying to end this nonsense but we shall see if they end up being the lone voice or not.
- tosti 9mo agoGood luck modifying my .config And if it's not there, a patch is pretty easy to write. It's not like there's no source code ;)
- RockRobotRock 9mo ago>It's a fairly reasonable default setting for average users who simply want their data protected from theft. Apple asks you when you set up your Mac if you want to do this. You can just ask the user, Microsoft!
- pregnenolone 9mo agoIt’s not that simple because most people will instinctively click ‘no’ without fully understanding the risks. They'll assume that as long as they don't forget their password, it’ll be fine – which is the case on Macs because, unlike PCs, Mac hardware is locked down. Mac users won’t ever be required to enter a recovery key just because they’ve installed an update.