Hacker News Reader

Comment by sgerenser | Hacker News Reader

Doesn’t windows use full disk encryption like macOS does these days? How would you unencrypted the boot drive without the password?

View on HN

There's Bitlocker but it's optional and has to be enabled by the user.

There is also "Device Encryption"[1] that is separate from BitLocker and works in any version of Windows 10/11 as long TPM is available (and AFAIK is also turned on by default). BitLocker is only available in the Pro versions.

[1]: https://support.microsoft.com/en-us/windows/turn-on-device-e...

Amazing. Apple has had FileVault for 20 years (although it’s only in the past 9 years or so that it’s been enabled by default).

Windows Bitlocker is the FDE product that Microsoft uses. It’s not enabled by default. It is possible to have Bitlocker disabled and password auth enabled.

At least on my corporate Windows laptop, the Bitlocker password is restricted to numeric digits only. Coupled with natural human laziness, and brute forcing looks fairly feasible.

Even if the PIN was only 4 digits you would be very unlikely to successfully bruteforce it. The TPM will throttle you after a few tries and lock you out for an increasing amount of time after each further attempt.

An attacker might get 10 good tries before continuing becomes pointless, so unless the PIN is one of 1234 4321 0000 1111 2222 you're probably safe.

Note: TPM2.0 allows alphanumerical PINs but I think you need a group policy for Windows to allow it.

Reply on news.ycombinator.com