Comment by dijit | Hacker News Reader

Comment by dijit | Hacker News Reader

Parent Full thread

Flicking a button to turn something on is not what I'm talking about, that's normally the easy part of any setup, and I judge people harshly who only take that aspect of something into consideration when discussing systems.

Brittle is what happens when you haven't logged on to the machine in 60 days, trust with AD is broken, TPM has a glitch and wipes the in device key and forces you into recovery... or god forbid you service the laptop and now you have to enter recovery mode.

Then you're in a nightmare, trying to give someone a super long passphrase over the phone is a not-too-uncommon occurance.

That's assuming you have a good policy for storing the recovery keys. Too loose and they're handed out to everyone, sort of defeating the purpose: too strict and you need the IT department (or specific members), and its still predicated on the notion that you have a policy for it... Given that Admins are a dying breed... I don't think this is workable.

If you compare with Filevault on MacOS: which tracks the credentials of the logged in user; there's no "issue" if the device loses trust because ultimately you always use the real unlock key: not something cached in a "secure storage".

Having dealt with FileVault in this context, it's also frustrating; it's really common to have it fail to follow the logged-in user's credentials, and if you use any kind of federated login, you will frequently get users with FileVault passwords that are either ahead of or behind their system login password.

I think both approaches are valid trade-offs and I think that the default Secure Boot BitLocker configuration, for all its architectural tradeoffs, can probably be credited for an enormous amount of data loss mitigation originating from used hard drives alone.

maybe i am missing something, but how did veracrypt solve all of the admin and policy issues you’re bringing up? (specifically for large enterprise fleets)

If you use your key every day you tend not to forget it.

If I as an admin give you your key: it is “leaked” effectively.

>If you use your key every day you tend not to forget it.

hoping users don’t forget their password is a very weak policy.

specifically, the policy and admin points you brought up above, how does veracrypt solve them?

You don't have remote back ups enabled?

veracrypt does not include a remote backup system

Of the work, not of the encryption.

we're talking about veracrypt vs. bitlocker in a managed enterprise environment.

whether there are backups or whatever else is irrelevant because it would be true in both the veracrypt and the bitlocker scenario.

We are talking about IT policies. I don't know what YOU think we're talking about.

We're sort of talking about two things and conflating them.

I'm sort of talking about my user experience of the system, and I'm getting it in the neck from helpdesk.

Enterprise rollouts are different from anything I actually deliver, despite pushing out thousands of windows servers: I have complete control over those.

Same as my local PC.

But as a user on a PC I'd buy from a store, I'm not going to forget my password without expecting to lose access to my system.

>We're sort of talking about two things and conflating them. [...] But as a user on a PC I'd buy from a store

i said multiple times that i was talking about a managed fleet in an enterprise environment, and even specifically said that i dont typically recommend bitlocker for personal use, so i am not really sure what to say here. i was really clear.

Yes, but I still think we've been talking passed each other.

I doubled down on "it's fine but not excellent" when I should have pulled away and explained that the main issues I have are about bitlocker as a user.

Have you never gone on vacation and forgotten your daily-use password upon return?

Nop.

Our helpdesk deals with 2-300 users per day that logon every single day yet forgot their password.

This type of thinking doesn't work in large enough orgs dealing with end users.

Reply on news.ycombinator.com