5 ms·

There are some motherboards that can store the encription key so that you don't need to type the pasword again when booting. BitLocker supports it. What a great

There are some motherboards that can store the encription key so that you don't need to type the pasword again when booting. BitLocker supports it. What a great technology. It saves your life!

wfunction 11y ago
Sounds like it completely defeats the point of encryption.
- jhallenworld 11y ago
  You could store the key (or password to the key) in the TPM in order to prevent BIOS, bootloader or option ROM tampering. An issue is that too many things could affect the TPM PCR values (for example, plug in a USB stick even though you don't boot from it- I think this is a mistake in the spec), so users get used to typing in the backup password and may not notice that a root-kit was installed.
  - MichaelGG 11y ago
    In my experience of using Bitlocker for years, it's very rare that I have to enter the backup password. Even when I changed the default PCRs used.
theandrewbailey 11y ago
It works great until $MALICIOUS_ENTITY unexpectedly takes your laptop, turns it on, and gathers unencrypted data.
- yebyen 11y ago
  I think the point of this feature (TPM? at least as I've seen it implemented on laptops) is that you can have a signed bootloader and encrypted drive such that, you don't need a passphrase to boot the OS (the TPM has it, or equivalent), your TPM verifies you are booting a trusted OS (that means it will actually authenticate users in the usual way and check their authorization before granting them access to data) ... and nobody who just picks up your laptop can either read your files without your password, or remove the drive and gain access to your files without the TPM. Whether that chain all works as I imagine or not, I can't say and I haven't investigated to be able to say. I don't know if all it takes to gain access to the TPM in reality is (physical access to the machine), a USB stick with EFI booting, and any signed OS that will verify you are a root user authorized by that USB stick, which anyone who has $99 can get on their own, or just download Ubuntu or RedHat on your own can get. That would be a pretty big let-down if that was really all you needed, though.
  - MichaelGG 11y ago
    The threat is that they could do a cold-RAM attack and read the key off the RAM. That does require a bit more physical access than just turning it on. The other big threat is that TPMs are probably cheaply built, and anyone with decent hardware skills can probably pop the key out of the TPM. I haven't seen the TPMs in laptops boasting anything like FIPS-140-2 Level 4 validation or any real tamper proof abilities. But for common users, a TPM+Bitlocker transparently deals with the issue of "left laptop in taxi". Microsoft, AFAIK, allows TPM+Bitlocker in lieu of a smartcard for remote access.
  - mjg59 11y ago
    The TPM doesn't verify that you're booting a trusted OS as such. Each component of the boot process is hashed and that hash copied into the TPM, and the secret is encrypted in a blob that includes the expected hash values. If the hash values differ, the TPM will refuse to decrypt the secret. So booting a different signed OS won't give you the secret - even though you're a trusted OS, the TPM hashes will be different and the secret will remain encrypted.
    - yebyen 11y ago
      That makes good sense. Thanks for explaining.

There are some motherboards that can store the encription key so that you don't need to type the pasword again when booting. BitLocker supports it. What a great technology. It saves your life!

wfunction 11y ago

Sounds like it completely defeats the point of encryption.

jhallenworld 11y ago
You could store the key (or password to the key) in the TPM in order to prevent BIOS, bootloader or option ROM tampering. An issue is that too many things could affect the TPM PCR values (for example, plug in a USB stick even though you don't boot from it- I think this is a mistake in the spec), so users get used to typing in the backup password and may not notice that a root-kit was installed.
- MichaelGG 11y ago
  In my experience of using Bitlocker for years, it's very rare that I have to enter the backup password. Even when I changed the default PCRs used.

theandrewbailey 11y ago

It works great until $MALICIOUS_ENTITY unexpectedly takes your laptop, turns it on, and gathers unencrypted data.

yebyen 11y ago
I think the point of this feature (TPM? at least as I've seen it implemented on laptops) is that you can have a signed bootloader and encrypted drive such that, you don't need a passphrase to boot the OS (the TPM has it, or equivalent), your TPM verifies you are booting a trusted OS (that means it will actually authenticate users in the usual way and check their authorization before granting them access to data) ... and nobody who just picks up your laptop can either read your files without your password, or remove the drive and gain access to your files without the TPM. Whether that chain all works as I imagine or not, I can't say and I haven't investigated to be able to say. I don't know if all it takes to gain access to the TPM in reality is (physical access to the machine), a USB stick with EFI booting, and any signed OS that will verify you are a root user authorized by that USB stick, which anyone who has $99 can get on their own, or just download Ubuntu or RedHat on your own can get. That would be a pretty big let-down if that was really all you needed, though.
- MichaelGG 11y ago
  The threat is that they could do a cold-RAM attack and read the key off the RAM. That does require a bit more physical access than just turning it on. The other big threat is that TPMs are probably cheaply built, and anyone with decent hardware skills can probably pop the key out of the TPM. I haven't seen the TPMs in laptops boasting anything like FIPS-140-2 Level 4 validation or any real tamper proof abilities. But for common users, a TPM+Bitlocker transparently deals with the issue of "left laptop in taxi". Microsoft, AFAIK, allows TPM+Bitlocker in lieu of a smartcard for remote access.
- mjg59 11y ago
  The TPM doesn't verify that you're booting a trusted OS as such. Each component of the boot process is hashed and that hash copied into the TPM, and the secret is encrypted in a blob that includes the expected hash values. If the hash values differ, the TPM will refuse to decrypt the secret. So booting a different signed OS won't give you the secret - even though you're a trusted OS, the TPM hashes will be different and the secret will remain encrypted.
  - yebyen 11y ago
    That makes good sense. Thanks for explaining.