Hacker News Reader

Comment by layer8 | Hacker News Reader

Windows supports multiple accounts, hence an account password doesn’t apply to Bitlocker, which encrypts the main Windows partition as a whole. You need a separate Bitlocker password that the boot loader requests from the user before Windows proper is loaded, and before any accounts come into play.

View on HN

I am aware (and my point of comparison is LUKS, where the separate password is extremely in-your-face). But my impression from Windows was that, in the default FDE configuration, the (measured?) OS boots up, pulls the FDE key from the TPM with no user input, then presents the user with a login screen. So in ideal world the data is exactly as secure against a thief as the account password or passwords, thus my mention of them.

This article, however, says that this setup does not protect the data at all against a thief willing to pay $100 lifetime (not per machine), which seems an absurdly low bar. (And I’d wager you can go even lower by wiring up a cheap devboard—basically everything has a SPI peripheral these days.) I mean, liquid nitrogen is not exactly expensive either, but it does require some fuss, whereas the attack in TFA could be made essentially as easy as opening the case.

I’d say that as soon as Windows fully boots up, you have a much larger attack surface anyway, even if you can’t log in due to the account password. Though I can’t point at anything specific off the top of my head.

Is there anything you could access from the keyboard or touchpad? Seems easy enough to only accept the inputs that the login screen needs and nothing else.

Only DMA comes to mind but it requires a non-hardened configuration which isn't that common on recent laptops + OS.

Very rarely are drivers, including USB drivers, written to assume a hostile device (see e.g. the PS3). Frankly, they rarely seem to be written by people who care about software at all. (I still can’t get over the very first Zenbook, which suffered spontaneous deaths under Linux because the ACPI bytecode in the firmware tried to initialize a nonexistent IDE controller. And people say it’s Linux that has a hardware support problem.) So this is a somewhat valid concern.

But I still can’t get over the idea where the default configuration of BitLocker is completely useless for basically anything except working around storage devices that will lie to you and not erase things you told them to. I just refuse to accept that’s in any way sane.

Reply on news.ycombinator.com