Anyway, if you rely on BitLocker in TPM mode (boot without PIN), you should know that anyone can steal your computer, sniff 32 bytes off of the LPC bus, stick them into libbde, and decrypt your disk. Yes, it's that easy. Solder 7 wires to $favorite_fpga_board, decrypt drive.
-
-
Ah crap.
-
This mode also opens up all coldboot attacks by design, but TPM1.2 support encrypted+signed comms (TPM_EstablishTransport), so BitLocker might as well use it. Could provision a RSA key, and pin it in the BCD (protected by SecureBoot)
End of conversation
New conversation -
-
-
Tell me, who believes getting automatically logged in after cold boot is secure? It should be obvious to everyone using #FDE against physical access, that encryption key(s) only protected by the platform means platform can decrypt the disk.
-
Lots of people don't understand that there is a difference between typing a password at the BitLocker screen and typing a password at the Windows login screen.
End of conversation
New conversation -
-
-
Also note it is the ONLY mode available to “Home” licensed users. I.E. all consumer-markered devices.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.