Windows 10 Bitlocker - Make login passoword impossible to break with software.

Z

ztplru

Extraordinary Member
Joined
Jul 16, 2014
Messages
61
Dear all,

Before you can help me here you must understand fundamentally what Bitlocker is about.

Bitlocker:
-------------------------------------------------------------------
The idea with Bitlocker is that you do not enter a bitlocker password when you boot up. Your TPM does this for you. As long as your hardware and bootloader hasn't changed, bitlocker will be seamless to you. So, yes, your PC is only as secure as your Windows password is in the event it is lost. I think this surprises many people when it comes to bitlocker.

However, if you pull your hard drive and put into another box, it will prompt for the 48bit recovery key.

Without encryption, if you left your laptop lying around, and I picked it up, and could not guess your password, all I have to do is pull the drive out, plug it into another computer and I have all of your data. Bitlocker protects against this scenario!
-------------------------------------------------------------------

Well it's obvious if someone steals my laptop, they will be able to break into the OS and get my data!

Any of you Windows 10 Gurus, or you that face the same scenario, know how to circumvent windows 10 login password from getting easily broken into?
Or another solution you can propose?
There is 3rd party software and ways to easily break it!

I can setup a PIN for bitlocker but i would prefer just the login password and nothing else if possible.


Your insight is truly welcome!
 
Sort by date Sort by votes
The recovery key is the decryption key. This is stored in the TPM (if one is present) and the TPM will check a variety of attributes to make sure nothing has been tampered with. Logging into Windows will load the key in to memory and decrypt data on the fly. If the system is unlocked (aka logged into) someone could steal your data (this is call data in use) . When you pull the drive out you are prompted for the recovery key (aka the decryption key) which is stored in the TPM on the original hardware) without it the "data at rest" remains encrypted.



If someone steals the laptop they would have to brute force your password to gain access to the data. Offline password reset tools won't work since none of the data that needs to be accessed is encrypted and can't be modified by such tools
 
Upvote 0 Downvote
If someone steals the laptop they would have to brute force your password to gain access to the data.
Click to expand...
Dear Neemobeer,

Kon-Boot and Windows Password Reset are utilities to achieve this. And i've read about ways to bypass the boot login etc.
This is apparently super easy, regardless if your password is strong.
This is what i am trying to fortify! If it's not possible i will have to setup a bitlocker pin.

Offline password reset tools won't work since none of the data that needs to be accessed is encrypted and can't be modified by such tools
Click to expand...
I use local authentication. I don't have a Microsoft account to authenticate!
Please what did you mean by "none of the data that needs to be accessed is encrypted and can't be modified by such tools"?
Can you elaborate?
 
Upvote 0 Downvote
Those offline tools require access to the SAM database which is stored on the bitlocker encrypted volume. It can't be modified since the data is encrypted.
 
Upvote 0 Downvote
Neemobeer said:
Those offline tools require access to the SAM database which is stored on the bitlocker encrypted volume. It can't be modified since the data is encrypted.
Click to expand...

By offline tools you refer to Kon-Boot for example?
So all in all you're saying with bitlocker active it's almost impossible to break the login password?
 
Upvote 0 Downvote
Correct. There are known attacks on memory to steal the recovery key, but that only works when a system is on and logged into.
 
Upvote 0 Downvote
Solution
Neemobeer said:
Correct. There are known attacks on memory to steal the recovery key, but that only works when a system is on and logged into.
Click to expand...

Why would anyone set the bitlocker PIN then? To me from your explanation it's redundant and makes no sense.
It's an extra unneeded authentication.
 
Upvote 0 Downvote
It's just additional options for securing the data. Adding multiple factors of the same time does add some extra security, but very little. Multiple factors should be used instead for added security.
 
Upvote 0 Downvote
Neemobeer said:
It's just additional options for securing the data. Adding multiple factors of the same time does add some extra security, but very little. Multiple factors should be used instead for added security.
Click to expand...
Thanks Nemobeer for sharing your expertise.
Much appreciated!
 
Upvote 0 Downvote
You must log in or register to reply here.

Similar threads

  • Featured
  • Article Article
Protect Your Data with BitLocker: Windows Encryption Made Easy
Replies
0
Views
36
ChatGPT
  • Featured
  • Article Article
Protect Your Data with BitLocker Drive Encryption on Windows
Replies
0
Views
38
ChatGPT
  • Featured
  • Article Article
Essential Guide to Backing Up Your BitLocker Recovery Key
Replies
0
Views
40
ChatGPT
  • Featured
  • Article Article
Essential BitLocker Setup Tips for Windows 11 Security
Replies
0
Views
79
ChatGPT
  • Featured
  • Article Article
Recovering Your BitLocker Key: A Complete Guide to Access Your Data
Replies
0
Views
58
ChatGPT