Hacker News Reader

Comment by wildmusings | Hacker News Reader

* Secure Boot

* BitLocker: Hard-drive encryption backed by TPM & Secure Boot

With the above two and DMA protection, physical access attacks become very difficult.

* Virtual Secure Mode (VSM) - separate OS running on the hypervisor that can perform sensitive operations. Which enables:

1. Device Guard - Runs code integrity protection, i.e. only allowing signed code to run, from within the VSM.

2. Credential Guard - Runs user-mode security subsystem (LSA) inside VSM.

View on HN

Regarding hard drive encryption backed by TPM, a) this has been a thing since Win7, and b) google tells me it only works OOTB on Win10 if you sign into Windows with your Microsoft account; how many people do that?

If that's the secret sauce that makes Win10 so much better, color me unimpressed. And neither of those features offer additional protection against zero-days (neither does VSM), which are what the TFA discusses.

It only works OOTB with a Microsoft Account because the OS needs a place to backup the key. The alternative is that if the user forgets their password, they lose their data forever. You can still turn it on manually very easily with a local account.

I am running Bitlocker without a Microsoft Account. You can just print out the recovery key instead (or you can just configure bitlocker through command line).

> With the above two and DMA protection, physical access attacks become very difficult.

Physical attacks aren't part of my threat model on a desktop PC. Indeed these protections feel more like DRM - trying to protect the computer from the (legitimate) user.

Preventing unsigned code from running, and choosing which sources of software you do want to trust, is not just for DRM. It severely reduces the attack surface of a device and makes it much harder for user error to cause a compromise. Accidentally getting compromised is possible for advanced users, let alone the most tech-illiterate person in the company.

iOS being totally locked down in this way is no small part of why exploits for that platform sell for so much more money than exploits for other platforms. Of course, it is also used for DRM on that platform.

And to add to my previous comment, I can't see why you would want to keep your laptop or desktop unencrypted. If someone steals your computer, they have access to all of your data.

And without Secure Boot and/or TPM-backed key management, hard disk encryption becomes vulnerable to someone planting a modified boot loader or firmware on your system.

Weren't all of those in 8?

Reply on news.ycombinator.com