Hacker News Reader

Would be this something that can be avoided by setting up BitLocker with the encryption password to be provided at boot time by the user? Because that's the way I've always configured it when I've used Windows in the past, due to me being paranoid and suspicious about the default "key saved on TPM" approach.

View on HN

Yes, if the key isn't in the TPM then it can't be sniffed. Secure boot would need to be enabled to protect against the threat model bitlocker is only good for here. Alternatively using a PIN would mean the key is only exposed once the PIN is typed (still vulnerable to a hardware attack, but requires physical modification).

Reply on news.ycombinator.com