nothackingnothacking@infosec.exchange
Jun 30, 2026, 1:42 AMRegarding the recent windows affair, you should probobly not use TPM based disc encryption (like default bitlocker)
Password based disc encryption works like this: the computer boots up, prompts you for a password, and uses that to decrypt your data. If someone steals the computer, it's mathematically impossible for them to see any of that data. However, if the computers breaks, you can plug the drive into another computer and decrypt it using your password.
TPM based encryption uses a chip in your computer which watches the boot process. If it's satisfied that the OS is unmodified, it sends the key to the processor.
This is bad for two reasons:
First, it does not actually protect your data if the machine is stolen: since the attacker can full boot it up without a password, any vulnerability in the OS will let them steal the data. This includes exploits that haven't been found yet, since the attackers can just keep the machine offline to prevent it from updating.
... also, the chip can't detect hardware tampering: it's possible to use a logic analyzer to intercept it's communication and read out the key.
Second, it will cause dataloss if your computer or operating system breaks. Since the key is stored in hardware, the drive cannot be unlocked from another computer, even if you need to do so. A live USB environment won't work either because the TPM will see that the boot chain is different and refuse to provide the key.
(Microsoft will of course insist that you are using it wrong, and didn't write down the 48 digit recovery key... but I've yet to see someone actually do that.)
TLDR; This configuration provides minimum security while maximizing the risk of dataloss.
Password based disc encryption works like this: the computer boots up, prompts you for a password, and uses that to decrypt your data. If someone steals the computer, it's mathematically impossible for them to see any of that data. However, if the computers breaks, you can plug the drive into another computer and decrypt it using your password.
TPM based encryption uses a chip in your computer which watches the boot process. If it's satisfied that the OS is unmodified, it sends the key to the processor.
This is bad for two reasons:
First, it does not actually protect your data if the machine is stolen: since the attacker can full boot it up without a password, any vulnerability in the OS will let them steal the data. This includes exploits that haven't been found yet, since the attackers can just keep the machine offline to prevent it from updating.
... also, the chip can't detect hardware tampering: it's possible to use a logic analyzer to intercept it's communication and read out the key.
Second, it will cause dataloss if your computer or operating system breaks. Since the key is stored in hardware, the drive cannot be unlocked from another computer, even if you need to do so. A live USB environment won't work either because the TPM will see that the boot chain is different and refuse to provide the key.
(Microsoft will of course insist that you are using it wrong, and didn't write down the 48 digit recovery key... but I've yet to see someone actually do that.)
TLDR; This configuration provides minimum security while maximizing the risk of dataloss.