Hacker News Reader

Comment by controversial97 | Hacker News Reader

Lots of people and small companies just buy a windows laptop and are unaware that the harddrive/ssd is encrypted with bitlocker.

People who avoid making a Microsoft account to log on to a windows computer, or who don't have access to the email address they used can find themselves in difficulty later when windows won't boot or it wants the bitlocker key for some reason. You can't get their files off the drive by connecting it to another machine because the bitlocker key is not available.

Yes, people should have backups and copies of their keys but they very commonly don't.

View on HN

Most small companies will login with a microsoft account and have the key saved by default to https://myaccount.microsoft.com/

If you don't sign in with a microsoft account bitlocker isn't enabled by default. When you setup bitlocker it "forces" you to make a backup of the key

I was under the impression that BitLocker does not default to being on, even with a Microsoft account. That's kind of dangerous if they have changed that without at least a warning.

If you do a volume order, I think you can ask for it to be turned on by default.

I recently got a new MSI laptop, came with Windows 11 - I immediately wiped the drive and installed Windows 10(Home edition), few days later installed a new BIOS update and the laptop asked me for a bitlocker key......but I never encrypted the drive??? What's even weirder is that I logged into the Microsoft recovery thing and it had the recovery key for it????? So it does seem to be the default behaviour now.

This makes absolutely 0 sense. Bitlocker cannot be setup on Windows 10 Home edition.

Well I upgraded to Pro about two days later, so maybe the upgrade did it? But either way, there was absolutely zero indication that the drive is getting encrypted or that it's going to save my recovery key to my Microsoft account.

It's called "device encryption" which seems to do the same thing and they allow it for Windows 10 home. It's confusing.

It's bitlocker but only activates if you log into a MS account in which case it:

* silently activates

* silently sends the key to MS.

And this is the only way to have it on home.

Ah. Which is probably what happened to me as I've signed into my MS account.

Windows marks the device as bitlocker enables somewhere in the EFI partition or GPT disklabels. I needed to wipe the whole disk to have windows cease with bitlocker bootscreens.

I can say from personal experience that for at least five years it has been common for small companies to buy a laptop direct from Dell and for it to have a bitlocker encrypted drive without anyone choosing that.

IME with win 11 pro, it won't encrypt the drive if you (jump through hoops to) create a local account. But as soon as you link it to MS, it will encrypt it.

It is default on in win 11, which is probably a huge privacy improvement for a majority of users. The recovery is sent to microsoft with your microsoft account, but against 99% of attacks (petty criminals stealing your laptop) this suffices.

If you fall into the category of users that distrust microsoft with their key, you can take active action and configure bitlocker yourself.

Reply on news.ycombinator.com