11–20 of 37 posts
Definitely save those recovery keys, because BitLocker loves freaking out after BIOS updates or minor hardware changes. I think I had to enter mine after a GPU firmware update.
So whose computer is it at this point? MS encrypts your data, but keeps the recovery key. Let's say you encrypt the drive, and then travel outside the country and come back. The border patrol officer says "I want to see everything on your hard drive" and you refuse, being an American citizen and all. They call Microsoft and recover all the data...
I mean, good? Physical access to a device shouldn’t automatically mean all your data is with the wind. Theoretically this was already on for “new” devices since sometime in the Windows 10 timeframe.
Very few people have backups... OTOH, SSDs tend to fail as bricks with no hope of any data recovery.
The best part is Windows doesn't even notify you about it. It will show you numerous useless notifications and now even ads, but it won't notify you that it has encrypted all your data. As that would be too "intrusive".
I already know of one case where all data was lost. Somehow recovery key was not stored in Microsoft account.
If they started offering reasonable ways to opt out of all telemetry and advertising (ie: without buying enterprise/using third party software and crossing your fingers) I could almost be tempted to dual boot for the games/software that don't run well in wine/proton.
I wouldn't be particularly opposed to paying for the privilege either, but don't make me buy X copies to be eligible.
This could lead to more data being lost than from ransomware. The best part is Windows doesn't even notify you about it. It will show you numerous useless notifications and now even ads, but it won't notify you that it has encrypted all your data. As that would be too "intrusive". I already know of one case where all data was lost. Somehow recovery key was not stored in Microsoft account.
Definitely save those recovery keys, because BitLocker loves freaking out after BIOS updates or minor hardware changes. I think I had to enter mine after a GPU firmware update.
I guess it's because measured boot doesn't like the new system state? But then I wonder: Whose responsibility is it to tell the TPM that the system has been legitimately changed? (Or am I completely off track here?)
Hence you'll often notice UEFI updaters turning off bitlocker.
I've seen HP devices tell you what the value of PCR0 will be for each given update, meaning you can know beforehand what that will be, and prepare by locking measured boot to that value before rebooting.
In Linux with systemd-measure, there's an option to lock to a signed manifest for PCR11, so you can have updated kernels (UKIs, for example), able to boot, while still locking the measured boot to the kernel image, initrd, cmdline, and public key used to sign the values. At that point, your OS distribution (or yourself) can take control of that process. It doesn't help for firmware updates though, as far as I know, unless you can prepare and ship an updated PCR policy, and your OS distribution is unlikely to be tightly integrated with your hardware vendor to do that, so it will likely fall onto the user, or to unlock the disk while doing those updates.
Earlier quoted context omitted.
I think they're saved to your Microsoft account by default now. And, since Microsoft likes to pretend an account is required to even install Windows now, most people will likely have a linked account.
I think it will lead to lots of lost data. Kind of like how your kid's old ipad loses its mind and your apple id password doesn't work and the data is lost. This kind of thing should be super-explicit when setting things up, and they should provide a way out.
Also is "on by default" the right wording for something that needs a registry change to turn off? That just seems like it's forced with a workaround that they'll remove at some point.
Last point, does that mean that windows is going to take a massive speed penalty going forward since they also default to their slow software encryption over hardware encryption?
Man this kinda blows. I'm hoping that W12 will have all this Vista-esk transition crap sorted out by the time it launches.