logoalt Hacker News

Dylan16807today at 6:31 AM1 replyview on HN

1) These systems are set up for automatic decryption. It's super obvious that if you can successfully attack windows between unlock and user login, you can get to the files. If this is such an attack, it's not a flaw with bitlocker itself.

2) Is it unreasonable to say "show it"?

3) Correct, we shouldn't jump to conclusions.

4) It's not known-insecure but it is known-enormous-attack-surface.


Replies

iscoelhotoday at 6:43 AM

1) Except that the entire premise behind BitLocker TPM's security relies on the login screen as a hard security boundary, and thus any attack on the login screen is an attack on BitLocker. It is semantics to dispute this and certainly fits "downplaying."

2) I'm sure many organizations are thankful that the researcher has decided not to release that exploit chain at this time. I am hopeful that Microsoft will not be as dismissive and will resolve it before it is publicly released.

3) It distracts from the point. The point is that Microsoft's security record is so bad that many of the vulnerabilities appear deliberate and obvious enough to be backdoors.

4) Yes, this also fits the definition of downplaying.

show 1 reply