Hacker News Reader

Comment by com2kid | Hacker News Reader

> Secondly, to avoid the problem in this article, you should have an external password necessary to unlock the drive; not a TPM. This is, of course, not what most people do, since typing in passwords is tedious.

Back when I worked at MS, a PW was required on boot to deencrypt the drive.

I am honestly shocked that isn't the default for bitlocker. But then again it does require people to have a unique bitlocker PW, and if they ever forget it, everything on the machine is gone for good. (Which I've actually been bitten by, oops!)

View on HN

> But then again it does require people to have a unique bitlocker PW, and if they ever forget it, everything on the machine is gone for good. (Which I've actually been bitten by, oops!)

I am not sure if it was the same system, but at a company I worked for we also had a boot password for bitlocker. People would sometimes forget it or bitlocker would somehow corrupt itself. IT was usually able to fix it though. I believe they were able to print out some kind of longer master password that could be used to unlock the machine.

Commonly machines will be configured (via Group Policy) to store their Bitlocker recovery keys in Active Directory (where they are readable by only privileged users).

(It would be nice if MSFT would do with Bitlocker recovery keys what they do with EFS recovery keys, and encrypt them with a public key. At that point popping Active Directory wouldn't be enough to get Bitlocker recovery keys-- you'd need a private key that, hopefully, was stored offline or in an HSM.)

That would probably be the recovery password, which is a long string of gobblydigook. In corporate environment, the recovery password is backed up to the user's Azure AD account and logged by the configuration manager (like InTune, probably 3rd party ones too).

Bitlocker actually has multiple keys. There's one key to encrypt your data. There's a volume master key that encrypts the data encryption key. And then there are zero or more key protectors for the volume master key. One of those can be the TPM (or TPM with PIN), one can be a long password, one can be a recovery key (IIRC 48 decimal digits), and I believe there are other options as well. Each one is independently capable of decrypting the volume master key, which in turn decrypts the data encryption key, which in turn decrypts the data.

So ideally you'd just get your recovery key and store it someplace well protected like a safe or a password manager.

It seems like it'd be possible to have a separate recovery key stored by the company in addition to the regular password.

That's how my employer does it but it's for less than a hundred devices so we just provide security the key after turning on FileVault.

I don't recall whether or not it's the default, but Bitlocker can do this on domain-joined machines-- they get automatically backed up into Active Directory where they can be retrieved from the computer account's properties (or there's a tool in RSAT that can find them).

My guess is that this is more "user-friendly".

Even though it decreases security substantially, they can still use lots of fancy words in the technical description, and only someone with knowledge in the field will understand how most of it is BS.

> I am honestly shocked that isn't the default for bitlocker.

manual PIN entry IS the default for BitLocker, and the article states this.

It isn't, and you are misparsing the sentence in the article (it is saying the configuration as it was is the default, but describes it through what it's not, which makes the sentence a bit confusing) - look at the linked Microsoft documentation for confirmation.

Care to desribe the experience, and what was lost to you?

Now that I remember, there is a separate key stored by the corporation that can also unlock the drive.

Reply on news.ycombinator.com