Hacker News Reader

Comment by lostmsu | Hacker News Reader

I just nuked my home server Ubuntu and installed Windows. Canonical is still unable to make reliable TPM-unlocked full disk encryption, unacceptable for me as a data hoarder. https://bugs.launchpad.net/snapd/+bug/2045417

View on HN

This is something that's bugged me about BitLocker for ages: What's the point of encrypting your disks if the computer automatically decrypts them anyway? The only situation I can see where this helps you is if someone steals your disk but not your computer, but that seems very unlikely to me. Maybe if someone just clones the disk, but again, it seems much more likely to me that if you're a high enough value target to do that, a bad actor would just grab your device.

Bitlocker has options to require a pin/password/network attestation at boot. Most people don't use it, but it exists.

Also, a lot of data theft is from after a disk is disposed of and reused. Bitlocker prevents that from happening.

It does decrypt them. But then what? How are you the thief going to extract them or data from RAM of a working machine?

If it’s decrypted, you don’t need to steal it from RAM.

You just do normal file operations and copy the files

you need to login to do that. The point of bitlocker is that it prevents filesystem access from a different OS install.

> What's the point of encrypting your disks if the computer automatically decrypts them anyway?

The important detail you're missing is: the computer automatically decrypts your disks if you're booting into that operating system. Try booting into something else (like a Linux CD), and you'll see that the TPM does not release the encryption key (the way it works is that each step of the boot sequence records into the TPM what's going on, and the TPM will only release the key if the sequence matches what it expects).

The point is that the disks will only be decrypted when booting into the expected OS, and that this OS will require you to login before giving anyone access to your files.

> The only situation I can see where this helps you is if someone steals your disk but not your computer, but that seems very unlikely to me.

It'll also help if someone steals the computer but does not have your login password; they can boot into Windows, the files will be decrypted while booted into Windows, but without logging into your account, they are not accessible. Of course, unless you're using memory encryption (which I don't think is normally available on normal non-server devices), someone with the right hardware knowledge and an expensive set of hardware tools could in theory manipulate the RAM to get access.

> What's the point of encrypting your disks if the computer automatically decrypts them anyway?

Your security. We also back up your key in the cloud, in case you forget it. /s

Maybe YOUR computer decrypts the disk automatically, if you set yours up that way. My Linux computer does nothing automatically that I dont know about, especially decrypting my disk. All my clients use Windows but even that decryption requires authentication, not automatic for anyone even the CEO.

But somehow the malware infested/backdoored alternative has more appeal? Even more than the myriad of other distros, or DIY options for that matter? Doesn't click.

> myriad of other distros, or DIY options for that matter

Have you ever seen a working configuration? The only other distro that advertises it out of the box is Fedora. And maybe it is better in this respect than Ubuntu, but I already wasted a few days dealing with the fallout, so maybe I'll try it next year.

Manual - maybe. But is spending time learning yet another distro worth the Windows license?

re: malware/backdoored

I am not running self-wafered CPU, so backdoors at certain levels are outside of the threat model.

If anything, Ubuntu was "malware" in the sense that it didn't work as advertised. https://documentation.ubuntu.com/core/how-to-guides/manage-u...

> After entering a valid key, Ubuntu Core will decrypt the device, proceed with the boot, and restore the TPM from the recovered key. The recovery keys will remain the same and do not need to be retrieved again.

The restore TPM bit just didn't happen.

Ubuntu is historically unstable and unreliable, in my experience. I would never suggest it for home or work use.

Don't use Ubuntu?

That's exactly what I thought and acted.

Reply on news.ycombinator.com