Hacker News Reader

Comment by tpurves | Hacker News Reader

I was a little dismayed to learn that 'supports linux' is regarded as an indicator that a machine could be easier to compromise :o

View on HN

It's understandable though... 'supports linux' tends to mean secure boot isn't enforced, and you have a much higher chance of being able to just boot from a USB and dump the disk...

I was disappointed when I installed linux on my laptop to find that a default ubuntu install could mount and decrypt a bitlocker encrypted windows drive with no trouble - while I was under the impression that the encryption keys were locked deep in the TPM and couldn't be extracted by anything but a securely booted windows installation.

This is quite sensible. By default, you don't want a hardware failure to make your data irretrievable. You need to explicitly opt-in.

https://superuser.com/questions/1299600/is-a-volume-with-bit...

> By default, you don't want a hardware failure to make your data irretrievable.

Er, what? Of course you do! At least if you've chosen to encrypt it. That's the whole point of doing so! Using Bitlocker is the explicit opt-in.

When I installed Windows 10 Bitlocker was turned on from the get go. I didn't choose it. Then it grumbled that it was "waiting for activation", which led me to the superuser post I linked to.

Ah ok that's different. Yes you want the computer to be (effectively) unencrypted until you say so, but that should be really clear too.

Yep Microsoft has started trying to do bitlocker-by-default, it sits at "waiting for activation" until the user signs into windows with a microsoft account and then it ties the bitlocker to the person's microsoft account.

Then an errant bios update can brick the computer.

(Please don't) ask me how I know.

Windows 11 (and maybe Windows 10?) default to Bitlocker activated if it realizes it's installed on a laptop or other mobile device.

This means it's an opt-out situation and the user probably isn't aware that a boot failure or hardware failure can brick all his data that he really should keep backups of.

Indeed and it's always good practice to keep the key backed up somewhere safe. Often times you need to manually enter the bitlocker key after a hardware change. This is only slightly inconvenient and exactly what should happen.

Popular linux distros being behind Windows on this front is one of the key reasons I still daily Windows.

> a default ubuntu install could mount and decrypt a bitlocker encrypted windows drive with no trouble

This means BitLocker was off or "Pending Activation," so the Volume Master Key (VMK) was available in plaintext rather than sealed.

When BitLocker is "On," the default is to seal the VMK using TPM PCRs 0, 2, 4, 7, and 11, so tampering with the Firmware (PCR0), UEFI Extensions (PCR2), UEFI Boot (PCR4), Secure Boot State (PCR7), or the BitLocker state itself (PCR11) will result in a failure to decrypt the key. Of course, there are vulnerabilities at every stage (especially sniffing key material as it transits the TPM), but the concept is reasonably sound.

Is this why people elsewhere in this thread are saying that a bios update can brick a machine which uses bitlocker? I guess if a user doesn't have the key saved, a bios update would result in a request for the decryption key that can't be satisfied?

Right, a BIOS upgrade will break the hash chain, because the system has gone and replaced the current trusted early boot software with new early boot software.

malicious and/or willfully ignorant rumor -- supports linux is only prevented by manipulative and secretly negotiated boot locking from Redmond and friends

You can always encrypt the drive with VeraCrypt, no TPM needed

you could also say that "supports linux" allowed them to discover and remedy this vulnerability which would likely have still existed without linux support, thus making the device stronger for both windows and linux users.

Reply on news.ycombinator.com