Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

In this case, they're talking about the Bitlocker disk encryption PIN, which is in _addition_ to the Windows password, or more common now, PIN. You can set them both to the same thing if you choose.

The disk PIN on boot is uncommon/harder to do for home users, but it's a common setup in the corpo world. Enforced by AD, or Intune.



A disk PIN shouldn’t add much extra security, though, unless the login password isn’t actually used to key the encryption.


I'm not aware that Windows uses your login key to encrypt anything on the disk, but maybe Windows 11 does it differently than <=10.

The disk password actually encrypts the disk, so you can't just pull the disk out and read it, or boot Linux from a flash drive and read it.

You can do the above attacks when all that's set is a Windows password. In fact, you could even modify the OS at that point so it logs and exfiltrates passwords in the future.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: