Hacker News Reader

Comment by watermelon0 | Hacker News Reader

I think the main issue with the default BitLocker configuration is that you must have recovery key saved somewhere (either on OneDrive, printed out, or on some other storage).

If something changes with the hardware/software configuration, and TPM unlock doesn't work, your data is lost, unless you have access to the recovery key.

This is completely different compared to other platforms, where you use a separate password (Linux LUKS), account password (macOS), or PIN (iOS, Android) to unlock the drive.

View on HN

How is a recovery key different from a a password or pin? They are both just a string you need to enter during the recovery process and if you have lost that string you cannot unlock the drive

They are randomly generated and therefore high entropy.

You have to enter them on every boot before the OS will be able to decrypt the drive. On windows, the key is loaded into memory automatically almost all of the time, and only if it thinks something goes wrong does it suddenly stop working. Or in the case of my colleague, because windows changed his recovery key without notifying him that his backup key was no longer valid. (It deleted it because it thought his key escrow policy had changed, and since that requires generating a new key, it has to delete the old key. Unfortunately escrow policy hadn’t actually changed, so all backup unlocking sources all still had the old key)

The difference is that it's neither expected nor practical to memorize your recovery key.

It’s no different at all to LUKS if you use TPM unlock.

That's true, but LUKS with TPM unlock is something that you have to go out of your way to set up, not something that gets enabled on your system automatically even if you have no idea what it is or how it works.

Your understanding of BitLocker is off.

1. There always is a recovery key, not only in the default configuration. And you should always have a copy of it stored somewhere else than on the same computer.

2. Your software configuration does not influence BitLocker, unless of course you manually wipe TPM or reset your BitLocker PIN. Your hardware configuration also does not influence BitLocker, unless you swap the TPM chip, of course. I'm also not counting changes to the boot order etc that could break TPM mode (no PIN) because messing with the PC on that level can cause damage to any Computer, not only BitLocker protected ones.

3. BitLocker also can use a separate password (or PIN) to unlock the drive, which also protects against certain attacks that are possible with TPM mode (no PIN)

Reply on news.ycombinator.com