Asklemmy

To expand: both bitlocker and LUKS (what OP probably uses on Linux) can unlock without userinput from TPM or require a user password or use the TPM and a password. Its just the defaults are different. In all cases, the TPM/passwords are used to decrypt the Volume Master Key that is used to de/encrypt the actual disk. If you change your password you don't have to reencrypt 2TB of hard drive and wait 20+h.

With TPM only unlock, secure boot/verified boot is used to ensure the hard disk is accessed using the correct operating system and no meaningful changes have been made to the system since the last boot. With bitlocker, several vulnerabilities in bitlocker allow full decryption in TPM only mode because windows is fundamentally broken. So you should always use pin+TPM unlock.

PS. about the encrypted user data: that is not part of bitlocker. It encrypts the whole drive and that's it. DPAPI is a windows component that encrypts some user data with the user password. For example chrome cookies are saved in DPAPI so even an administrator can not read your cookies while you are not logged in to the system (if you log in they can read everything)

I doubt that it is the case - it encrypts ~~disk~~ partition , not user specific data AFAIK. It has a single key AFAIK.

That is not the point of TPM only unlock. Tell me, can you access the files on a windows system that automatically unlocks bitlocker and then boots to the windows login screen? What can you read without a user password? If you try to boot a different OS and read the data from there, the bitlocker encrypted drive will not be automatically unlocked.

Bitlocker TPM only mode is ment to protect against a stolen hard drive and attacks in which the whole laptop is accessed by attackers (like someone breaking into your hotel room while you are at breakfast). Now bitlocker is broken in TPM only mode and many vulnerabilities exist, but conceptually its purpose is not only to protect against a stolen hard drive.

Are you really worried about the case where a thief steals the hard drive but not the rest of the computer?

Even if the thief steals the entire computer, BitLocker/LUKS and SecureBoot provide a reasonable level of protection against data theft. Yes, the drive (or bits of it anyway) are automatically decrypted (the whole drive is never decrypted, just the data requested by the OS). However, it still prevents the attacker from accessing that data outside the intended operating system, which makes data theft much harder. An attacker would also need a valid account to login to the system to start accessing data. It's not an insurmountable hurdle, but it does mean that just having the computer isn't the same as having the data.

Without encryption, once a thief has the computer, they have the data. They don't need a valid account to access the data and they can even boot into a tool to reset passwords on the primary OS and start using it. Last I checked, chntpw still works with Windows 11. That sort of thing fails with encryption, even with TPM only. The TPM will not release the encryption key to an OS if SecureBoot fails. Granted, there is the YellowKey backdoor, but that was probably Microsoft giving the FBI a helping hand. But, that falls outside the intended design.

It also protects you from malicious apps running outside of windows - they can't manipulate the file system. Also an attacker would have hard time breaking into your disk/OS if they get control of your machine. If ~~he~~ they try to boot from another device, bitlocker won't decrypt the windows partition automatically.

Yes, that is infact the situation Bitlocker wants to protect you from. Correct. I mean we can argue that's not the case you need it to protect against but if we're looking at non-drive-retrieval situations, then you can just have a password at the BIOS-level, you don't need to encrypt the actual drive. Might as well save yourself the little CPU usage for encrypting/decrypting.

Bitlocker is specifically for th idea that someone circumvents any on-boot password and just takes the drive out, reading your files off of it directly.

Like any security measure it is not to be applied in isolation.

Wouldn’t that data be inaccessible if encrypted? You would still need to login to access it. You wouldn’t be able to drop the drive on another machine if it’s encrypted.

There's other approaches to automatically unlocking. For example, you can combine Clevis with Tang to use Network Bound Disk Encryption, which lets you automatically decrypt only when on a trusted network.

You can have multiple different LUKS keys, and any of them can be used to decrypt the disk. This lets you automatically unlock via a network server when your system is at home, while still prompting for an unlock password when not at home.

At my workplace, our laptops have two LUKS keys - one for me and one for IT / tech support. It lets IT boot the system (eg if I send it in for repair) without having to know my LUKS password.