Perfect, this will finally lock out all the old people of their devices because they forget their bitlocker password :D
this post was submitted on 14 Aug 2024
303 points (100.0% liked)
Technology
68526 readers
3160 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
I guess they'll use TPM. I'm so excited to tell half of my "clients" (all seniors in the village) that they are fucked because their Laptop died.
Yeah, this makes sense for corporate environments with keys backed up to a centralized location like Active Directory. Not for consumers with no reasonable way to keep some key like this in a safe place as a "break glass in case of emergency" option.
It backs up to the Microsoft Account
Still, some people create an @outlook.com email, set up no recovery options, forget the password, and find themselves locked out.
How do you get to your Microsoft account when your computer is locked?
If you're doing things properly, you'll know your Microsoft account password or have it in a password manager (and maybe have other account recovery options available like getting a password reset email etc.), and have a separate password for the PC you're locked out of, which would be the thing you'd forgotten. If someone isn't computer-literate, it's totally plausible that they'd forget both passwords, have no password manager, and not have set up a recovery email address, and they'd lose all their data if they couldn't get into their machine.
load more comments
(4 replies)
load more comments
(3 replies)
load more comments
(1 replies)
You don't need your hard drive if all your files have been secretly moved to OneDrive taps forehead.
All 5 GB of them. Wait ...
load more comments
(1 replies)
load more comments
(1 replies)
It's good, for privacy and all of course, but I remember here a Dell BIOS upgrade that basically wiped the TPM2.0 and so windows was asking for the recovery bitlocker key at boot. I have them on a encrypted USB key and anyway I can access my MS account from another device to find the key and type it.
But I'm sure a lot of people will basically say "well, fuck, I don't have the key", guaranteed.
Which brings me to the question, how is Microsoft doing this, where will people's keys be located? Do they force everybody to put in an USB stick?
load more comments
(11 replies)
load more comments
(4 replies)
[…] device encryption will be enabled by default when you first sign in or set up a device with a Microsoft account or work / school account.
For devices with a TPM, this has literally been the case since Windows 10 1803 back in 2018.
load more comments
(3 replies)
Tom’s Hardware tested this software version of BitLocker last year and found it could slow drives by up to 45 percent.
WTF‽ In Linux full disk encryption overhead is minimal:
While in pure I/O benchmarks like FIO there is an obvious impact to full disk encryption and other synthetic workloads, across the real-world benchmarks the performance impact of running under full disk encryption tended to be minimal
https://www.phoronix.com/review/hp-devone-encrypt/5
There's like five million ways you can use disk encryption on Linux though and not all of them are very performant. So keep that in mind if you see other benchmarks showing awful performance (use the settings Phoronox used).
I suspect Microsoft made some poor decisions in regards to disk encryption (probably because of bullshit/insecure-by-design FIPS compliance) and now they're stuck with them.
This one is especially fun on windows 11 home. At least it was some time ago on some machine i worked on. Since home doesn't have the bitlocker settings fully you cannot disable bitlocker encryption. It would also auto enable sometimes even if you don't have a microsoft account, which means it doesn't back the key up anywhere. Not sure it does that anymore, i hope not, but i expect a lot of people to lose their data to this crap in the future.
In either case at least i find that full disk encryption on most machines is just overkill as it only really protects in the scenario the device is stolen and someone tries to pull data off of it that way. But in the vast majority of cases when people get their data stolen its done with malware, which disk encryption does /nothing/ to prevent.
load more comments
(2 replies)
The anti-MS here is annoying. They set up online accounts by default to improve usability and its complaints about privacy. They set up full disk encryption at rest by default to improve privacy and its complaints about usability.
Setting up online accounts and allowing login via online accounts is fine. Forcing the use of an online account to use an operating system is not OK. They are actively blocking workarounds people use to setup their machine with a local account only.
Providing an easy (perhaps upon installation or first login) method to enable full disk encryption is a good thing. Automatically doing it without user intervention is not.
I would say that enabling it by default and offering a way to disable it before it happens on a laptop makes sense. I have bitlocker enabled on my laptop. But I cannot see any real reason to put it on my desktop. The number of cases where bitlocker on my desktop makes sense are too few to bother with the potential for problems it brings.
The two things are also linked, I suspect they will tie in your bitlocker unlock keys to the microsoft account they force you to login with on computer/windows setup. Should you lose access through any means you could lose access to your account, you're one misclick/hardware change away from bricking your system.
I also wonder, say for example your Microsoft account becomes banned/deleted through some obscure TOS violation and your PC doesn't have any local accounts configured. Are you locked out of your PC?
I'm not anti microsoft. I'm anti a lot of their recent actions, and cynical about their overall intentions regarding them.
These are valid complaints tho.
They set up online accounts by default to improve usability
Hahahahaha, you're kidding, right? Or do you genuinely believe this?
Unless you mean usability for MS tracking and telemetry of home users who lack the expertise of enterprise IT (which uses Windows Pro, and disables/blocks the MS tracking via Group Policy, which isn't available on Windows Home).
The reason for defaulting to an MS account, and making it practically required (they even hide creating a local account during setup if it has a network connection), is to capture even more user data and telemetry.
Now, defaulting to encryption is a good thing. But, the way to do it is to explain during setup (and have a process for) saving the key to another device immediately after setup - such as a thumb drive. Or even printing it, saving it to a text file, etc, etc.
It should also explain how critical it is, and not to trust saving it to a single device/location.
Agreed. The immature iamsosmart user base is making me strongly consider leaving Lemmy for good. There just aren't enough actual professionals here for any serious discussion in a technical community. It's just a bunch of 20-year-olds who think they have the world figured out. And they all downvote based on emotion rather than facts (which I am quite prepared for).
Microsoft accounts, OneDrive, and BitLocker are absolutely great features for the average user providing SSO, cloud storage with ransomware-proof backups, and seamless full-disk encryption.
I love Linux too, but there seems to be no room for nuance on Lemmy. These children are insufferable.
If they are so great, why do they need to be continuously shoved down the throats of users who don't want them? That's the part everyone hates. The dark patterns everywhere. My OS should do exactly as I tell it without trying to trick me or sell me something, not the other way around.
load more comments
(3 replies)
I lost all of my data on a tablet that had Bitlocker installed without my knowledge. Not one time was I ever told that my drive was encrypted or that there was even something called Bitlocker or that I should write down some password or code. Bitlocker activated because of an OS update, and I had no way to unlock it so I had to wipe the drive. I don't have an MS account, because I have no need to give MS all of my data, so I couldn't unlock it that way either. And no, I'm not a 20 year old; I'm someone who has used computers since before the internet and have no interest in setting up a corporate account for every watch, shoe, phone, video game, car, etc. I have no interest in giving MS all of my pictures, documents, emails, and browsing history.
load more comments
(9 replies)
load more comments
(4 replies)
I think this is a step in the right direction. Everyone can lose a portable device or it can get stolen, so protecting the potentially sensitive data is important.
I think what people are complaining about is not full-disk encryption itself, but the fact that people are not used to being responsible for their cryptographic keys.
I think we should educate people regarding this responsibility. We did it with regular keys we use to unlock our homes.
Are they even saved by default in an MS account? Because if I'd link one, I would expect them to at least prompt me
load more comments
(3 replies)
This will make people angry in waves as updates break bitlocker and cohorts don't have their key, a new one each time
This has been happening for a lot longer than just Windows 11.
Several people I've spoken to, who have purchased OEM computers from the likes of Dell, HP, Lenovo and others, did not know that bitlocker FDE was enabled, and they were not aware that they needed to back up their recovery key.
On at least one occasion, this caused someone to lose the contents of their laptop when Windows failed to finish booting into the OS. The drive was fine as far as I could tell, but the content on the drive would not complete the boot up sequence and would bsod/boot loop the system, so data retrieval was not possible without the recovery key, which they did not have. That was a Windows 10 Dell system from 2020 or so.
My opinion is that FDE is a good thing.
My advice is if you have FDE enabled, backup your recovery keys. It's easy, but it won't directly save to a file on the filesystem that's locked by the key to which the recovery key applies. The easiest workaround is to "print" it, then use the built in Microsoft print to PDF, then dump it wherever you want. Afterwards, put it somewhere safe. Doesn't matter where, but anywhere that isn't the encrypted drive. Maybe Google drive, maybe a USB flash drive, maybe email it to yourself. I dunno, just somewhere you can retrieve if that system isn't working.
When you're done doing that, go check the same on your parents computers, friends, brothers and sisters..... If they're someone you care about, and they have a windows computer, check. Get those recovery keys backed up somewhere.
Do the average Windows user really need BitLocker device encryption? They don't. The only users who need BitLocker are business' and government workers.
Also 99% of Windows users are going to get locked out of their computers.
Everyone needs drive encryption.
And no, 99% of Windows users aren't going to get locked out.
99% of Windows boxes are business boxes, which already are encrypted (and if they aren't, that's some bad IT).
This really only affects Home users, who don't enable encryption because they don't know any better. I have no doubt we'll see quite a few people have issues because they lose their key and can't recover their data. This is why MS should provide clear directions during setup about storing the key. Instead they're going to keep it in people's OneDrive/365 account. Such a bad idea. Now I've gotta write documentation for friends and family about what NOT to do during setup.
load more comments
(1 replies)
It still uses the TPM by default, instead of requireing a passphrase to be typed in on boot to unlock the keys. This still makes it an insecure mess.
https://yewtu.be/watch?v=wTl4vEednkQ
https://github.com/stacksmashing/pico-tpmsniffer
https://github.com/stacksmashing/LPCClocklessAnalyzer
Microsoft NEVER cares about your security. They just do the absolute bare minimum for compliance with stupid standards, and then advertise it as some crazy security improvement. Corporations lie to you all the time. If you want some actual security, you need to start using FOSS software. Most importantly a FOSS, Linux-based OS, and set it up with LUKS passphrase-based encryption.
view more: next ›