It’s good, for privacy and all of course, but I remember here a Dell BIOS upgrade that basically wiped the TPM2.0 and so windows was asking for the recovery bitlocker key at boot. I have them on a encrypted USB key and anyway I can access my MS account from another device to find the key and type it.
But I’m sure a lot of people will basically say “well, fuck, I don’t have the key”, guaranteed.
Which brings me to the question, how is Microsoft doing this, where will people’s keys be located? Do they force everybody to put in an USB stick?
From what I can tell when a customer brings in a computer they can’t boot and give me a look of “what did you just say to me you little shit” when I ask them if they can log into their microsoft account, they don’t give you a key.
Don’t know don’t care, anyone with half a brain saw windows was a sinking ship around the time they started putting ads in a $150 software but if that wasn’t enough forcing you to decline ads every 2 weeks or whatever is just psychopathic behavior so is the degraded search, I unironically would choose chrome Os or Ios over windows theses days especially since the world has moved to browsers and os doesn’t matter but any way you look at it the steam deck has proven windows has about as necessary as AOL these days, if you’re still using windows that’s a you problem, backwards compatibility be dammed you should not be relying on this company for anything crucial it can’t be trusted.
I don’t understand why you replied.
Because they need to feel superior.
The Linux boys on this site actually make me want to try it less.
They’re the Rick and Morty fans all over again.
Hahahahahaha, oh yes, another “I have no idea how the world works Windows sucks” commenters.
Come back when you’ve managed a 10,000 computer enterprise.
No, wait, come back after managing a 12 computer SMB.
People who run 10,000 computers runs Linux its all but necessary for the low level access, user access control and maintenance, also you need far fewer people to deploy and manage.
Also maybe not 10,000 but I manage a network of 50
I always worry the the backup USB drive would be dead.
I guess I’m one minority but kind of like an ability to fetch the key from the web. Doing that securely of course can be tough.
Web. USB. Printout in a safe. On my phone. In Keypass. Etc, etc.
I’m not relying on a single copy.
Where’s your encrypted USB recovery key stored?! Is it encrypted USBs all the way down?
volume encrypted with veracrypt, it asks for a password to be mounted
This one is especially fun on windows 11 home. At least it was some time ago on some machine i worked on. Since home doesn’t have the bitlocker settings fully you cannot disable bitlocker encryption. It would also auto enable sometimes even if you don’t have a microsoft account, which means it doesn’t back the key up anywhere. Not sure it does that anymore, i hope not, but i expect a lot of people to lose their data to this crap in the future.
In either case at least i find that full disk encryption on most machines is just overkill as it only really protects in the scenario the device is stolen and someone tries to pull data off of it that way. But in the vast majority of cases when people get their data stolen its done with malware, which disk encryption does /nothing/ to prevent.
In the scenario in which your computer is forgotten or stolen, it would offer some comfort knowing that the data on the computer is not accessible.
We have a “policy” in our household that everything that has personal data should be encrypted. That is just for cases in which we lose the device or it gets stolen. That makes it a purely financial loss, and not as invasive / uncomfortable.
But on the other hand my household are not average users. So it might not work well for other people.
when it automatically enables on win11 home, it doesn’t actually “enable” until you do sign-in to windows with a microsoft account so it has a place to stash the recovery key.
and, i have not had any difficulty turning the encryption off on win11 home systems.
Tom’s Hardware tested this software version of BitLocker last year and found it could slow drives by up to 45 percent.
WTF‽ In Linux full disk encryption overhead is minimal:
While in pure I/O benchmarks like FIO there is an obvious impact to full disk encryption and other synthetic workloads, across the real-world benchmarks the performance impact of running under full disk encryption tended to be minimal
https://www.phoronix.com/review/hp-devone-encrypt/5
There’s like five million ways you can use disk encryption on Linux though and not all of them are very performant. So keep that in mind if you see other benchmarks showing awful performance (use the settings Phoronox used).
I suspect Microsoft made some poor decisions in regards to disk encryption (probably because of bullshit/insecure-by-design FIPS compliance) and now they’re stuck with them.
[…] device encryption will be enabled by default when you first sign in or set up a device with a Microsoft account or work / school account.
For devices with a TPM, this has literally been the case since Windows 10 1803 back in 2018.
But that’s not the case for Windows Home, is it? The FDE setting just takes me to a page to upgrade to Pro. My laptop does have TPM.
It is, Secure boot and the TPM must both be enabled.
If you check Msinfo32 / “System Information” with admin rights, there is a “device encryption” listing that maybhave additional information.
There are rare instances where a device won’t support automatic encryption due to “Un-allowed DMA capable bus/device(s) detected” which requires a registry tweak to work around
Un-allowed DMA capable bus/device(s)
And there it is in msinfo!
Thanks very much. I’ve been using veracrypt for years, it’s good to know that I have another option (especially to simplify things for family members).
This has been happening for a lot longer than just Windows 11.
Several people I’ve spoken to, who have purchased OEM computers from the likes of Dell, HP, Lenovo and others, did not know that bitlocker FDE was enabled, and they were not aware that they needed to back up their recovery key.
On at least one occasion, this caused someone to lose the contents of their laptop when Windows failed to finish booting into the OS. The drive was fine as far as I could tell, but the content on the drive would not complete the boot up sequence and would bsod/boot loop the system, so data retrieval was not possible without the recovery key, which they did not have. That was a Windows 10 Dell system from 2020 or so.
My opinion is that FDE is a good thing.
My advice is if you have FDE enabled, backup your recovery keys. It’s easy, but it won’t directly save to a file on the filesystem that’s locked by the key to which the recovery key applies. The easiest workaround is to “print” it, then use the built in Microsoft print to PDF, then dump it wherever you want. Afterwards, put it somewhere safe. Doesn’t matter where, but anywhere that isn’t the encrypted drive. Maybe Google drive, maybe a USB flash drive, maybe email it to yourself. I dunno, just somewhere you can retrieve if that system isn’t working.
When you’re done doing that, go check the same on your parents computers, friends, brothers and sisters… If they’re someone you care about, and they have a windows computer, check. Get those recovery keys backed up somewhere.
I think this is a step in the right direction. Everyone can lose a portable device or it can get stolen, so protecting the potentially sensitive data is important.
I think what people are complaining about is not full-disk encryption itself, but the fact that people are not used to being responsible for their cryptographic keys.
I think we should educate people regarding this responsibility. We did it with regular keys we use to unlock our homes.
This will make people angry in waves as updates break bitlocker and cohorts don’t have their key, a new one each time
Can’t wait to get a million tickets about this. -_-
If you’re getting tickets, I assume you mean at work? What’s a business doing running Home and no Domain? This isn’t an issue on machines joined to a domain.
I work at an MSP, so we have clients who refuse to pay money to have good tech. Plenty of them have no domain, use Home, and just cheap out and then get mad when they have constant issues. We try to tell them to buy better shit, but they don’t wanna hear it. 🤷♀️
Rofl.
The vast majority of small business do run on Home have no clue wtf a domain is. Probably share files via google drive rather than a file server.
This is good but they need better guidance to nontechnical users how to backup their keys. Cloud backup now that they are trying to make local accounts illegal I suppose.
Clownstrike taught them nothing…
What does Crowdstrike have to do with Bitlocker?
Clearly you didn’t do any machine recovery during that fiasco or you wouldn’t ask. When the machines crashed the only fix was to get in and delete the offending file, but as Windows wouldn’t load up you had to unlock the drive to get in with a working OS.
Ok, but what lesson was Microsoft supposed to learn from the Crowdstrike fiasco that have to do with the implementation of Bitlocker in personal devices?
Are you suggesting that OS drive encryption should never be implemented due to the fact that computers might sometimes need to be accessed without the OS booting up? That doesn’t really make sense. That’s what Bitlocker keys are for, to unlock the drive if needed.
OK buddy, you can be right if it’s that important to you.
I don’t know everything about what happened during the Crowdstrike fiasco since it didn’t directly affect my company, so I’m asking questions. I don’t really care about being right. If you were talking about something I don’t know, I’m glad to learn new things about that incident. Why get defensive on something like this instead of just clarifying your point?
OK, I may have misread the intent. Sorry.
Basically for any machine with bitlocker on it we had to unlock the drive before getting the ability to load an external OS to go on to that drive and remove the problem file. The built in Windows was completely borked. For a home user that’s generally quick and easy to do, in any corporate environment it will take hours if not days to get that unlock code and meanwhile nothing can get done meaning business grinds to a halt and waits.
As for what happened in the first place, Crowdstrike updated a file for their nanny app which has kernel (lowest OS level) access so when their app choked on the bad update it crashed the kernel which meant Windows couldn’t even load much less run.
The two aren’t directly related but one made the other significantly harder to fix with any speed.
deleted by creator
I hope it does not affect performance
If you read that article it’s only slow on systems that don’t have hardware acceleration, which basically isn’t any system from the past half a decade at least (and definitely not anything that would have a compatible TPM)
I’m rocking a 12-year-old 3930k with BitLocker on all drives and it’s perfectly fine.
Do the average Windows user really need BitLocker device encryption? They don’t. The only users who need BitLocker are business’ and government workers.
Also 99% of Windows users are going to get locked out of their computers.
Everyone needs drive encryption.
And no, 99% of Windows users aren’t going to get locked out.
99% of Windows boxes are business boxes, which already are encrypted (and if they aren’t, that’s some bad IT).
This really only affects Home users, who don’t enable encryption because they don’t know any better. I have no doubt we’ll see quite a few people have issues because they lose their key and can’t recover their data. This is why MS should provide clear directions during setup about storing the key. Instead they’re going to keep it in people’s OneDrive/365 account. Such a bad idea. Now I’ve gotta write documentation for friends and family about what NOT to do during setup.
This is why MS should provide clear directions during setup about storing the key.
Now I’ve gotta write documentation for friends and family about what NOT to do during setup.
Okay. You need to write documentation for your friends and family, but Microsoft have clear directions.
The anti-MS here is annoying. They set up online accounts by default to improve usability and its complaints about privacy. They set up full disk encryption at rest by default to improve privacy and its complaints about usability.
These are valid complaints tho.
From powerusers yes, and taking away their options is nonsense. But for the general populace it is arguably a good thing.
How?
Most users have no clue, lose passwords, security is not something they think about at all. So arguably for these people setting up with an account, having them pay for 365, all their files are encrypted at least and backed up to OneDrive automatically, no user setup required. The whole ordeal is actually pretty sleek for people that just want to use their computer to sync their photos, browse the web and watch some videos. The Microsoft authenticator can store passwords, edge syncs everything… they even have a solution for syncing the co plete config of your windows to a second device… you log in and it’s exactly like my other PC.
I helped plenty of people migrate to their new laptop like this. I go through checking the setup on their old PC… everything is synced and done. Advise them on the new laptop they buy, and the new one is setup in under 15 minutes… no hassle at all.
They set up online accounts by default to improve usability
Hahahahaha, you’re kidding, right? Or do you genuinely believe this?
Unless you mean usability for MS tracking and telemetry of home users who lack the expertise of enterprise IT (which uses Windows Pro, and disables/blocks the MS tracking via Group Policy, which isn’t available on Windows Home).
The reason for defaulting to an MS account, and making it practically required (they even hide creating a local account during setup if it has a network connection), is to capture even more user data and telemetry.
Now, defaulting to encryption is a good thing. But, the way to do it is to explain during setup (and have a process for) saving the key to another device immediately after setup - such as a thumb drive. Or even printing it, saving it to a text file, etc, etc.
It should also explain how critical it is, and not to trust saving it to a single device/location.
Agreed. The immature iamsosmart user base is making me strongly consider leaving Lemmy for good. There just aren’t enough actual professionals here for any serious discussion in a technical community. It’s just a bunch of 20-year-olds who think they have the world figured out. And they all downvote based on emotion rather than facts (which I am quite prepared for).
Microsoft accounts, OneDrive, and BitLocker are absolutely great features for the average user providing SSO, cloud storage with ransomware-proof backups, and seamless full-disk encryption.
I love Linux too, but there seems to be no room for nuance on Lemmy. These children are insufferable.
I lost all of my data on a tablet that had Bitlocker installed without my knowledge. Not one time was I ever told that my drive was encrypted or that there was even something called Bitlocker or that I should write down some password or code. Bitlocker activated because of an OS update, and I had no way to unlock it so I had to wipe the drive. I don’t have an MS account, because I have no need to give MS all of my data, so I couldn’t unlock it that way either. And no, I’m not a 20 year old; I’m someone who has used computers since before the internet and have no interest in setting up a corporate account for every watch, shoe, phone, video game, car, etc. I have no interest in giving MS all of my pictures, documents, emails, and browsing history.
Bitlocker activated because of an OS update
This did not happen. You did something to enable it.
I don’t have an MS account, because I have no need to give MS all of my data
If you had one, all of your data would have been safe in OneDrive and easily recoverable. But I’m sure the irony is completely lost on all the anti-MS people here. Nah, it must be Microsoft’s fault you didn’t have backups when you broke your tablet.
Bitlocker activates when you enter an incorrect OS password too many times. I had my tablet set to unlock without a password or pass code, so I never used whatever pass code I set up a year and a half earlier. After one of the OS updates it forced me to log in with a pass code. I tried some pass codes I thought I might have used, thinking that worst case I would have to do a time delay before trying again… because again, MS never told me Bitlocker was installed and never told me it had a password and never told me I should write down whatever password Bitlocker set for itself and never told me that Bitlocker would lock my entire harddrive if I entered an incorrect password too many times.
But go ahead and keep telling me it’s my fault MS added something so intrusive without telling me.
Bitlocker activates when you enter an incorrect OS password too many times.
This is completely false. Please stop spreading misinformation. You clearly have no idea how BitLocker works, nor Secure Boot, BCD, TPM, or PCRs. Or anything really.
Maybe you should stick to an iPad. I’m done replying to this blithering nonsense.
Where is /c/confidentlyincorrect when you need it?
Very first goddamn bullet: “Entering the wrong PIN too many times”
That’s the BitLocker PIN, not the OS PIN. Go away.
Cool, let all the dumb fuck time vampires suffer. I won’t be helping anyone with shit. “Shoulda bought a Mac”
A Mac? Hahahaha, what a fucking joke.
Hey, what version of AutoDesk is on Mac these days? Catia?
Oh, yea, none. There are thousands of other software and $ reasons why “just buy a Mac” is a moronic answer.
Well, you probably can’t anyway. Your (l)users are not going to have their BitLocker keys, and it’s virtually guaranteed they won’t even know what that is. So it’s a total wipe and reinstall for you, my friend.
Exactly, it’s wonderful news!
