Back in January Microsoft encrypted all my hard drives without saying anything. I was playing around with a dual boot yesterday and somehow aggravated Secureboot. So my C: panicked and required a 40 character key to unlock.
Your key is backed up to the Microsoft account associated with your install. Which is considerate to the hackers. (and saved me from a re-install) But if you’ve got an unactivated copy, local account, or don’t know your M$ account credentials, your boned.
Control Panel > System Security > Bitlocker Encryption.
BTW, I was aware that M$ was doing this and even made fun of the effected users. Karma.
Why would you not want to encrypt your files? My Linux systems are encrypted too.
Not using Bitlocker is not the same as not encrypting your stuff.
I know, I just meant why would someone willingly disable Bitlocker?
I mean… the premise of the thread seems like a good enough reason, doesn’t it?
And even if it doesn’t, if one is already using a different encryption solution that doesn’t rely on TPM and secureboot silliness, what possible reason could there be not to disable Bitlocker?
Some of the things mentioned in the OP don’t actually happen in real life, though. Bitlocker is only automatically activated if you use a Microsoft account to log in, and why wouldn’t you know the account credentials if it’s what you use to log in?
TPM is optional (but recommended) for Bitlocker. Practically every computer released in the past 10 years has TPM support.
Secure boot is needed to ensure that the boot is secure and thus it’s okay to load the encryption key. Without it, a root kit could be injected that steals the encryption key.
You generally want to use TPM and secure boot on Linux too, not just on Windows.
Years ago I thought I was being smart encrypting my home dir on my Linux server. I found out the hard way this prevents remote login over ssh using public key encryption, as the .ssh dir is in the home dir, which is encrypted unless you are already logged in at the time! So every time I wanted to ssh in, I had to plug in a monitor and log in on the console first.
You can install Dropbear into your initramfs and configure it to allow entering the encryption key via SSH. Example guide I found: https://www.cyberciti.biz/security/how-to-unlock-luks-using-dropbear-ssh-keys-remotely-in-linux/
You do have to have an unencrypted
/boot, but the rest of the system can be encrypted. This uses a separateauthorized_keysfile embedded within the initramfs.Thanks!
Bitlocker is only as secure as Microsoft is. If someone hacks your account, they’ve got your keys. And Micosoft stores that key in plain text.
It sounds like you’re complaining about both approaches.
If Microsoft doesn’t have the key: You can’t recover your files if you lose it.
If Microsoft does have the key: An attacker could get in and take it (unlikely if you have two factor auth though) and you need to trust Microsoft.
How do you know this, though? It could be encrypted using your account password as a key or seed.
Microsoft is very much encouraging passwordless accounts. Mine only has a passkey with MFA.