11 ms·

If you’re at all serious about security and not user convenience, you deploy BitLocker with a PIN instead of TPM only. And then a whole class of vulnerabilities

If you’re at all serious about security and not user convenience, you deploy BitLocker with a PIN instead of TPM only. And then a whole class of vulnerabilities goes away.

solenoid0937 3mo ago
It's probably all security theater. There's only so much trust you can put into some shitty vendor's TPM implementation
- Terr_ 3mo ago
  "Disk must be in expected hardware environment" versus "Same environment plus PIN" makes a huge difference if a thief simply steals a whole computer.
  - deleted 3mo ago
    [deleted]
xnickb 3mo ago
If you are at all serious about security you don't consider Windows. Depending on how serious you are you also don't consider MacOS. And then you kinda have a couple of things to chose from but ultimately you need to build your own security depending on your attack/threat model
- kube-system 3mo ago
  And then depending on how "serious" you are you also don't consider Linux. But also, threat models and the best way to mitigate them aren't really a linear scale of being <unserious> to <serious>, but a complex consideration of a particular situation.
- PaulHoule 3mo ago
  People just plain suck at opsec. Like Che Guevara might have had a longer career as a revolutionary if he'd used his one time pads only once. Back in the late 1980s it was clear that it would be no problem at all to hook up a hard drive to a digital phone exchange and record all the calls! I had a strict policy of "don't talk about anything illegal using electronic communication" even when it was rather banal stuff like selling weed. The carelessness of people at Facebook documenting policies that nobody in their right mind would document boggles my mind: you might as well leave it mysterious why you didn't crack down on scam ads, for instance. When I've been involved in minor conspiracies, say when we had an HR problem with another employee, I've always made the point to meet furtively in person and avoid leaving a paper trail so that I'd never need to explain an email I wrote in front of an unfriendly audience.
GordonS 3mo ago
If you're really serious, you use a strong password, not a PIN.
dlcarrier 3mo ago
Just a PIN? For most people that's a 4-digit number, which has a worst-case scenario of 10,000 attempts and a median of only a few hundred. Why not use a full 8-digit password?
- jjmarr 3mo ago
  Because the TPM effectively rate limits brute forcing of the key. https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/tpm-fundamentals#anti-hammering https://learn.microsoft.com/en-us/windows/security/hardware-... > For example, when BitLocker is used with a TPM + PIN configuration, the number of PIN guesses is limited over time. A TPM 2.0 in this example could be configured to allow only 32 PIN guesses immediately, and then only one more guess every two hours. This totals a maximum of about 4,415 guesses per year. If the PIN is four digits, all 9999 possible PIN combinations could be attempted in a little over two years.
  - dlcarrier 3mo ago
    In that case, the median would still be just over a month, if the PINs were entered in order of how commonly they are used. Even the worst case of two years is still soon enough for a lot of data still be useful. Also, how is the time limit enforced? With hardware access, it would be easy to change time or increase the clock rate, as well as many other side-channel attacks that could eliminate the wait altogether.
    - shakna 3mo ago
      Most enterprises require a 12 digit code, to meet a specific security standard. Bruteforcing that, with hardware access restricted by TPM, would take a very, very long time.
    - charcircuit 3mo ago
      The time limit is enforced by the TPM itself which defends against tampering.
      - 3mo ago

If you’re at all serious about security and not user convenience, you deploy BitLocker with a PIN instead of TPM only. And then a whole class of vulnerabilities goes away.

solenoid0937 3mo ago

It's probably all security theater. There's only so much trust you can put into some shitty vendor's TPM implementation

Terr_ 3mo ago
"Disk must be in expected hardware environment" versus "Same environment plus PIN" makes a huge difference if a thief simply steals a whole computer.
- deleted 3mo ago
  [deleted]

xnickb 3mo ago

If you are at all serious about security you don't consider Windows. Depending on how serious you are you also don't consider MacOS. And then you kinda have a couple of things to chose from but ultimately you need to build your own security depending on your attack/threat model

kube-system 3mo ago
And then depending on how "serious" you are you also don't consider Linux. But also, threat models and the best way to mitigate them aren't really a linear scale of being <unserious> to <serious>, but a complex consideration of a particular situation.
PaulHoule 3mo ago
People just plain suck at opsec. Like Che Guevara might have had a longer career as a revolutionary if he'd used his one time pads only once. Back in the late 1980s it was clear that it would be no problem at all to hook up a hard drive to a digital phone exchange and record all the calls! I had a strict policy of "don't talk about anything illegal using electronic communication" even when it was rather banal stuff like selling weed. The carelessness of people at Facebook documenting policies that nobody in their right mind would document boggles my mind: you might as well leave it mysterious why you didn't crack down on scam ads, for instance. When I've been involved in minor conspiracies, say when we had an HR problem with another employee, I've always made the point to meet furtively in person and avoid leaving a paper trail so that I'd never need to explain an email I wrote in front of an unfriendly audience.

GordonS 3mo ago

If you're really serious, you use a strong password, not a PIN.

dlcarrier 3mo ago

Just a PIN? For most people that's a 4-digit number, which has a worst-case scenario of 10,000 attempts and a median of only a few hundred. Why not use a full 8-digit password?

jjmarr 3mo ago
Because the TPM effectively rate limits brute forcing of the key. https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/tpm-fundamentals#anti-hammering https://learn.microsoft.com/en-us/windows/security/hardware-... > For example, when BitLocker is used with a TPM + PIN configuration, the number of PIN guesses is limited over time. A TPM 2.0 in this example could be configured to allow only 32 PIN guesses immediately, and then only one more guess every two hours. This totals a maximum of about 4,415 guesses per year. If the PIN is four digits, all 9999 possible PIN combinations could be attempted in a little over two years.
- dlcarrier 3mo ago
  In that case, the median would still be just over a month, if the PINs were entered in order of how commonly they are used. Even the worst case of two years is still soon enough for a lot of data still be useful. Also, how is the time limit enforced? With hardware access, it would be easy to change time or increase the clock rate, as well as many other side-channel attacks that could eliminate the wait altogether.
  - shakna 3mo ago
    Most enterprises require a 12 digit code, to meet a specific security standard. Bruteforcing that, with hardware access restricted by TPM, would take a very, very long time.
  - charcircuit 3mo ago
    The time limit is enforced by the TPM itself which defends against tampering.
    - 3mo ago