{"slug": "bitlocker", "name": "BitLocker", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 5, "commenters": 40, "warners": 20, "score": -10.272, "rising": -1.64, "first": "2025-11-06", "latest": "2026-07-02", "why": "BitLocker wraps the key, meaning even if the TPM were compromised, one would still have to brute-force the PIN for the actual key.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 5, "neutral": 13, "compare": 3, "warn": 22}, "spark": [0, 0, 3, 0, 0, 1, 1, 0, 0, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "BitLocker wraps the key, meaning even if the TPM were compromised, one would still have to brute-force the PIN for the actual key.", "kind": "", "icon": true, "domain": null, "github_repo": null, "official_url": "https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/", "pricing": "", "aliases": ["BitLocker"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 770722672, "item_id": 48170167, "url": "https://news.ycombinator.com/item?id=48170167", "by": "gruez", "date": "2026-05-17", "stance": "recommend", "quote": "I'm not aware of any bitlocker exploits that work on TPM + pin", "excerpt": ">so they had to make a seemingly ridiculous statement (because who in their right mind would trust bitlocker) to call attention that \"something is very wrong\" Alternately, they don't want people to rely on abandonware for security. Also, despite the conspiracy theories of backdoors I'm not aware of any bitlocker exploits that work on TPM + pin, which is the intended \"secure\" configuration[1]. All exploits rely on TPM", "context": "", "use_case": "full-disk encryption", "switched_from": "", "story": "Security researcher says Microsoft built a Bitlocker backdoor, releases exploit"}, {"id": 747885264, "item_id": 46742829, "url": "https://news.ycombinator.com/item?id=46742829", "by": "pregnenolone", "date": "2026-01-24", "stance": "recommend", "quote": "Your average thief won\u2019t be able to steal any data from a device protected with BitLocker\u2019s TPM-based encryption", "excerpt": "I\u2019m not trying to defend Microsoft, but so much of the stuff here is just painful to read. People shouting about backdoors, FBI, Linux, VeraCrypt \u2013 in completely bizarre combinations. It's astonishing what kind of garbage people come up with based on a superficial understanding of the topic. First of all, the fact that Windows uploads recovery keys to Microsoft accounts is nothing new and has been known for a long ti", "context": "", "use_case": "full-disk encryption on Windows", "switched_from": "", "story": "Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops"}, {"id": 747839296, "item_id": 46739956, "url": "https://news.ycombinator.com/item?id=46739956", "by": "masfuerte", "date": "2026-01-23", "stance": "recommend", "quote": "if you explicitly enable bitlocker then the key is no longer stored on the disk and it is secure", "excerpt": "There was a great blog post a few years ago that reverse engineered the on-disk data structures and demonstrated extracting the key. Of course, I can't find it now. Microsoft themselves [1] say: > If a device uses only local accounts, then it remains unprotected even though the data is encrypted. There is a further condition: if you explicitly enable bitlocker then the key is no longer stored on the disk and it is se", "context": "", "use_case": "", "switched_from": "", "story": "Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops"}, {"id": 747779808, "item_id": 46736238, "url": "https://news.ycombinator.com/item?id=46736238", "by": "Aurornis", "date": "2026-01-23", "stance": "recommend", "quote": "I use BitLocker on my Windows box without uploading the keys.", "excerpt": "> Switch to an OS where this requirement doesn't come into play I use BitLocker on my Windows box without uploading the keys. I don't even have it connected to a Microsoft account. This isn't a requirement.", "context": "", "use_case": "disk encryption", "switched_from": "", "story": "Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops"}, {"id": 744626896, "item_id": 46539181, "url": "https://news.ycombinator.com/item?id=46539181", "by": "pregnenolone", "date": "2026-01-08", "stance": "recommend", "quote": "BitLocker wraps the key, meaning even if the TPM were compromised, one would still have to brute-force the PIN for the actual key.", "excerpt": "> Bitlocker encryption key in plaintext Actually, this is not the case. BitLocker wraps the key, meaning even if the TPM were compromised, one would still have to brute-force the PIN for the actual key. It\u2019s cryptsetup on Linux that stores the key on the TPM in plaintext. This vulnerability has been known for quite a while and nothing has been done about it so far. https://arxiv.org/abs/2304.14717 https://github.com/", "context": "", "use_case": "Windows disk encryption", "switched_from": "", "story": "Tailscale state file encryption no longer enabled by default"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 780297232, "item_id": 48768577, "url": "https://news.ycombinator.com/item?id=48768577", "by": "LtWorf", "date": "2026-07-02", "stance": "warn", "quote": "https://www.techspot.com/news/112410-security-researcher-microsoft-secretly-built-backdoor-bitlocker-releases.html", "excerpt": "https://www.techspot.com/news/112410-security-researcher-microsoft-secretly-built-backdoor-bitlocker-releases.html", "context": "", "use_case": "", "switched_from": "", "story": "Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory"}, {"id": 780225792, "item_id": 48764112, "url": "https://news.ycombinator.com/item?id=48764112", "by": "IngoBlechschmid", "date": "2026-07-02", "stance": "warn", "quote": "I would never trust it a second, being property and known for issues.", "excerpt": "Okay, yes, sure. It definitely is the most-used encryption software for Windows. But I would never trust it a second, being property and known for issues. You likely know that, but for the benefit of others: 38C3 - Windows BitLocker: Screwed without a Screwdriver https://media.ccc.de/v/38c3-windows-bitlocker-screwed-without-a-screwdriver https://www.youtube.com/watch?v=5eNtT2p12cM", "context": "", "use_case": "", "switched_from": "", "story": "Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory"}, {"id": 776610912, "item_id": 48538182, "url": "https://news.ycombinator.com/item?id=48538182", "by": "LtWorf", "date": "2026-06-15", "stance": "warn", "quote": "bitlocker had a backdoor for the NSA so it's actually possible to use that to recover the data", "excerpt": "OH no worries bitlocker had a backdoor for the NSA so it's actually possible to use that to recover the data. https://cybernews.com/security/researcher-releases-bitlocker-bypass-and-privilege-escalation-exploit/", "context": "", "use_case": "", "switched_from": "", "story": "Windows 11 users are tired of MS account requirements creeping into everything"}, {"id": 773101344, "item_id": 48318834, "url": "https://news.ycombinator.com/item?id=48318834", "by": "somenameforme", "date": "2026-05-28", "stance": "warn", "quote": "Bitlocker is insecure and backdoored", "excerpt": "Read the write up on YellowKey. [1] It sounds like, in at least some instances, he's publishing official Microsoft backdoors probably used by US intelligence agencies et al. It turns out that Bitlocker is insecure and backdoored. Something noooobody expected that after TrueCrypt just mysteriously and suddenly shut their doors one day, removed all downloads, and recommended everybody move to Microsoft's BitLocker. lol", "context": "", "use_case": "Disk encryption", "switched_from": "", "story": "GitHub bans security researcher who posted zero-day Windows exploits"}]}], "who": [], "tags": [], "use_cases": ["disk encryption", "full-disk encryption", "disk encryption unlock", "full disk encryption", "full-disk encryption on windows", "windows disk encryption"], "compared": [{"slug": "microsoft-windows", "name": "Microsoft Windows", "co": 6, "switched_from": 0, "switched_to": 0}, {"slug": "veracrypt", "name": "VeraCrypt", "co": 3, "switched_from": 1, "switched_to": 0}, {"slug": "systemd-cryptenroll", "name": "systemd-cryptenroll", "co": 4, "switched_from": 0, "switched_to": 0}, {"slug": "filevault", "name": "FileVault", "co": 4, "switched_from": 0, "switched_to": 0}, {"slug": "luks", "name": "LUKS", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "onedrive", "name": "OneDrive", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "truecrypt", "name": "TrueCrypt", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "windows-11", "name": "Windows 11", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=46735545", "title": "Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops", "mentions": 15}, {"url": "https://news.ycombinator.com/item?id=48168856", "title": "Security researcher says Microsoft built a Bitlocker backdoor, releases exploit", "mentions": 11}, {"url": "https://news.ycombinator.com/item?id=48130519", "title": "Microsoft BitLocker \u2013 YellowKey zero-day exploit", "mentions": 6}, {"url": "https://news.ycombinator.com/item?id=48129789", "title": "Mystery Microsoft bug leaker keeps the zero-days coming", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=48763035", "title": "Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=48533101", "title": "Windows 11 users are tired of MS account requirements creeping into everything", "mentions": 1}], "sentiment_by_month": {"2025-11": {"warn": 2}, "2025-12": {}, "2026-01": {"recommend": 3, "neutral": 9, "warn": 2, "compare": 2}, "2026-02": {"neutral": 1, "warn": 1}, "2026-03": {}, "2026-04": {"neutral": 1, "recommend": 1}, "2026-05": {"warn": 14, "neutral": 2, "recommend": 1, "compare": 1}, "2026-06": {"warn": 1}, "2026-07": {"warn": 2}, "2026-08": {}, "2026-09": {}, "2026-10": {}}, "quotes": [{"id": 780297232, "item_id": 48768577, "url": "https://news.ycombinator.com/item?id=48768577", "by": "LtWorf", "date": "2026-07-02", "stance": "warn", "quote": "https://www.techspot.com/news/112410-security-researcher-microsoft-secretly-built-backdoor-bitlocker-releases.html", "excerpt": "https://www.techspot.com/news/112410-security-researcher-microsoft-secretly-built-backdoor-bitlocker-releases.html", "context": "", "use_case": "", "switched_from": "", "story": "Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory"}, {"id": 780225792, "item_id": 48764112, "url": "https://news.ycombinator.com/item?id=48764112", "by": "IngoBlechschmid", "date": "2026-07-02", "stance": "warn", "quote": "I would never trust it a second, being property and known for issues.", "excerpt": "Okay, yes, sure. It definitely is the most-used encryption software for Windows. But I would never trust it a second, being property and known for issues. You likely know that, but for the benefit of others: 38C3 - Windows BitLocker: Screwed without a Screwdriver https://media.ccc.de/v/38c3-windows-bitlocker-screwed-without-a-screwdriver https://www.youtube.com/watch?v=5eNtT2p12cM", "context": "", "use_case": "", "switched_from": "", "story": "Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory"}, {"id": 776610912, "item_id": 48538182, "url": "https://news.ycombinator.com/item?id=48538182", "by": "LtWorf", "date": "2026-06-15", "stance": "warn", "quote": "bitlocker had a backdoor for the NSA so it's actually possible to use that to recover the data", "excerpt": "OH no worries bitlocker had a backdoor for the NSA so it's actually possible to use that to recover the data. https://cybernews.com/security/researcher-releases-bitlocker-bypass-and-privilege-escalation-exploit/", "context": "", "use_case": "", "switched_from": "", "story": "Windows 11 users are tired of MS account requirements creeping into everything"}, {"id": 773101344, "item_id": 48318834, "url": "https://news.ycombinator.com/item?id=48318834", "by": "somenameforme", "date": "2026-05-28", "stance": "warn", "quote": "Bitlocker is insecure and backdoored", "excerpt": "Read the write up on YellowKey. [1] It sounds like, in at least some instances, he's publishing official Microsoft backdoors probably used by US intelligence agencies et al. It turns out that Bitlocker is insecure and backdoored. Something noooobody expected that after TrueCrypt just mysteriously and suddenly shut their doors one day, removed all downloads, and recommended everybody move to Microsoft's BitLocker. lol", "context": "", "use_case": "Disk encryption", "switched_from": "", "story": "GitHub bans security researcher who posted zero-day Windows exploits"}, {"id": 770810992, "item_id": 48175687, "url": "https://news.ycombinator.com/item?id=48175687", "by": "ranger_danger", "date": "2026-05-17", "stance": "warn", "quote": "But the files on the disk must still be decrypted somehow. The key must be stored somewhere.", "excerpt": "> Bitlocker can be suspended But the files on the disk must still be decrypted somehow. The key must be stored somewhere. According to this: https://windowsforum.com/threads/pause-bitlocker-before-bios-or-firmware-updates-in-windows-10-11.415353/ > BitLocker is now suspended, which means the drive remains encrypted, but Windows temporarily stores the unlock information so firmware changes won\u2019t immediately trigger re", "context": "", "use_case": "Full-disk encryption", "switched_from": "", "story": "Security researcher says Microsoft built a Bitlocker backdoor, releases exploit"}, {"id": 770788000, "item_id": 48174250, "url": "https://news.ycombinator.com/item?id=48174250", "by": "bigyabai", "date": "2026-05-17", "stance": "warn", "quote": "Bitlocker was laughed at whenever you mentioned it by name, there was not a single engineer I met that took it seriously", "excerpt": "I commented because I've worked with regulated institutions where FDE was standard across the org. Bitlocker was laughed at whenever you mentioned it by name, there was not a single engineer I met that took it seriously (even the Windows daily drivers). Microsoft Windows is consistently identified as the weakest link for securing sensitive data, one job even had a no-fly policy for Windows laptops in case they were m", "context": "", "use_case": "", "switched_from": "", "story": "Security researcher says Microsoft built a Bitlocker backdoor, releases exploit"}, {"id": 770769952, "item_id": 48173122, "url": "https://news.ycombinator.com/item?id=48173122", "by": "mananaysiempre", "date": "2026-05-17", "stance": "warn", "quote": "even if I think it exposes an unwisely large attack surface", "excerpt": "> A normal reboot always [forces the TPM pin entry screen], even a 'hot' reboot. In TPM-only mode, I only see the screen\u2014which asks for an recovery key that serves an alternative to the TPM-borne secret, not for whatever you are calling the \u201cTPM PIN\u201d here\u2014whenever I update the firmware or the bootloader (the latter from the other side of the dual-boot setup). Otherwise it boots straight to the login screen, which mes", "context": "", "use_case": "", "switched_from": "", "story": "Security researcher says Microsoft built a Bitlocker backdoor, releases exploit"}, {"id": 770764432, "item_id": 48172777, "url": "https://news.ycombinator.com/item?id=48172777", "by": "motohagiography", "date": "2026-05-17", "stance": "warn", "quote": "it is perniciously misleading to ship a sabotaged product on which these legally consequential  decisions get made around the world", "excerpt": "if you have ever dealt with a regulated institution, they have an obligation to publicly report lost and stolen devices that contain PII/PHI as a breach, and the people whose data was on the device must be notified. It's a huge deal that has board level involvement when it occurs. The ONLY control that mitigates this risk is disk encryption, and it is perniciously misleading to ship a sabotaged product on which these", "context": "", "use_case": "disk encryption", "switched_from": "", "story": "Security researcher says Microsoft built a Bitlocker backdoor, releases exploit"}, {"id": 770752320, "item_id": 48172020, "url": "https://news.ycombinator.com/item?id=48172020", "by": "pregnenolone", "date": "2026-05-17", "stance": "warn", "quote": "I seriously doubt it because that would require breaking or exploiting the TPM itself.", "excerpt": "Lots and lots of smattering around here. If anything, this is a secure boot flaw (and partially TPM), but that is a separate conversation. Also, it's been known for years that TPM based encryption should always be protected with a PIN for truly sensitive data: https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/countermeasures The author claims to be able to bypass T", "context": "", "use_case": "", "switched_from": "", "story": "Security researcher says Microsoft built a Bitlocker backdoor, releases exploit"}, {"id": 770746928, "item_id": 48171683, "url": "https://news.ycombinator.com/item?id=48171683", "by": "layer8", "date": "2026-05-17", "stance": "neutral", "quote": "when I do use bitlocker, I use it with a PIN", "excerpt": "My company doesn\u2019t require use of Bitlocker at all, because all actual work happens on computers on-premises (which you can remote-login into). External devices are outside the security boundary. But when I do use bitlocker, I use it with a PIN.", "context": "", "use_case": "disk encryption", "switched_from": "", "story": "Security researcher says Microsoft built a Bitlocker backdoor, releases exploit"}, {"id": 770736784, "item_id": 48171049, "url": "https://news.ycombinator.com/item?id=48171049", "by": "866-RON-0-FEZ", "date": "2026-05-17", "stance": "compare", "quote": "This doesn't seem an attack on BitLocker so much as it is an attack on the secure boot chain.", "excerpt": "> What Microsoft is doing here in general they are selling something that is not secure. They are selling it as as full disk encryption but it's not. But you can configure Linux LUKS in the exact same way. This doesn't seem an attack on BitLocker so much as it is an attack on the secure boot chain. The value of PIN-less unlock is if your threat model is limited to the disk being disposed of or removed from the machin", "context": "", "use_case": "", "switched_from": "", "story": "Security researcher says Microsoft built a Bitlocker backdoor, releases exploit"}, {"id": 770722672, "item_id": 48170167, "url": "https://news.ycombinator.com/item?id=48170167", "by": "gruez", "date": "2026-05-17", "stance": "recommend", "quote": "I'm not aware of any bitlocker exploits that work on TPM + pin", "excerpt": ">so they had to make a seemingly ridiculous statement (because who in their right mind would trust bitlocker) to call attention that \"something is very wrong\" Alternately, they don't want people to rely on abandonware for security. Also, despite the conspiracy theories of backdoors I'm not aware of any bitlocker exploits that work on TPM + pin, which is the intended \"secure\" configuration[1]. All exploits rely on TPM", "context": "", "use_case": "full-disk encryption", "switched_from": "", "story": "Security researcher says Microsoft built a Bitlocker backdoor, releases exploit"}, {"id": 770720624, "item_id": 48170039, "url": "https://news.ycombinator.com/item?id=48170039", "by": "dataflow", "date": "2026-05-17", "stance": "warn", "quote": "", "excerpt": "They claim they have TPM + PIN exploit too, though how credible it is remains to be seen. https://deadeclipse666.blogspot.com/2026/05/were-doing-silent-patches-now-huh-also.html", "context": "", "use_case": "", "switched_from": "", "story": "Security researcher says Microsoft built a Bitlocker backdoor, releases exploit"}, {"id": 770720368, "item_id": 48170023, "url": "https://news.ycombinator.com/item?id=48170023", "by": "layer8", "date": "2026-05-17", "stance": "warn", "quote": "without which Bitlocker isn\u2019t secure anyway", "excerpt": "Better writeup: https://infosec.exchange/@wdormann/116565129854382214 The published exploit doesn\u2019t affect Bitlocker with a PIN, without which Bitlocker isn\u2019t secure anyway. The original author claims they have an exploit that also works with a PIN, but hasn\u2019t disclosed it yet.", "context": "", "use_case": "", "switched_from": "", "story": "Security researcher says Microsoft built a Bitlocker backdoor, releases exploit"}, {"id": 770708240, "item_id": 48169265, "url": "https://news.ycombinator.com/item?id=48169265", "by": "mynameisvlad", "date": "2026-05-17", "stance": "neutral", "quote": "The non-cloud methods for recovering the key have been the same since Bitlocker was released 19 years ago.", "excerpt": "The non-cloud methods for recovering the key have been the same since Bitlocker was released 19 years ago. https://support.microsoft.com/en-us/windows/find-your-bitlocker-recovery-key-6b71ad27-0b89-ea08-f143-056f5ab347d6", "context": "", "use_case": "", "switched_from": "", "story": "Security researcher says Microsoft built a Bitlocker backdoor, releases exploit"}, {"id": 770312016, "item_id": 48144501, "url": "https://news.ycombinator.com/item?id=48144501", "by": "Joel_Mckay", "date": "2026-05-14", "stance": "warn", "quote": "TPM tamper detection and bitlocker disagree.", "excerpt": "TPM tamper detection and bitlocker disagree. Backup your key first... https://support.microsoft.com/en-us/windows/back-up-your-bitlocker-recovery-key-e63607b4-77fb-4ad3-8022-d6dc428fbd0d Just about any *nix platform is a better experience now, but many Steam games are still windows only. =3", "context": "", "use_case": "", "switched_from": "", "story": "Porting 3D Movie Maker to Linux"}, {"id": 770267584, "item_id": 48141724, "url": "https://news.ycombinator.com/item?id=48141724", "by": "bri3d", "date": "2026-05-14", "stance": "neutral", "quote": "", "excerpt": "> If the TPM required a PIN to extract anything, I think there would be no need to manually decrypt anything in software as they show with the python code. Like I specifically pointed out, it's belt and suspenders. > Of course I could be wrong... please feel free to provide more info. From https://blog.scrt.ch/2024/10/28/privilege-escalation-through-tpm-sniffing-when-bitlocker-pin-is-enabled/ : > Indeed, by analysing", "context": "", "use_case": "disk encryption", "switched_from": "", "story": "Microsoft BitLocker \u2013 YellowKey zero-day exploit"}, {"id": 770249616, "item_id": 48140601, "url": "https://news.ycombinator.com/item?id=48140601", "by": "ranger_danger", "date": "2026-05-14", "stance": "warn", "quote": "", "excerpt": "> you can just get an LPE to access the running Windows environment after it boots Or if you have physical access, you can probe the TPM chip with a SPI decoder to get the key directly: https://post-cyberlabs.github.io/Offensive-security-publications/posts/2024_09_tpmandpin/ Another method is via PXE (still not patched on most systems apparently): https://github.com/andigandhi/bitpixie > TPM+PIN should actually mean ", "context": "", "use_case": "Full-disk encryption", "switched_from": "", "story": "Mystery Microsoft bug leaker keeps the zero-days coming"}, {"id": 770194608, "item_id": 48137163, "url": "https://news.ycombinator.com/item?id=48137163", "by": "bri3d", "date": "2026-05-14", "stance": "warn", "quote": "I've always found it silly that Microsoft's default BitLocker implementation doesn't make it easy to do the obvious thing", "excerpt": "https://blog.scrt.ch/2024/10/28/privilege-escalation-through-tpm-sniffing-when-bitlocker-pin-is-enabled/ https://post-cyberlabs.github.io/Offensive-security-publications/posts/2024_09_tpmandpin/ Yes, the PIN is entangled with the key material. The admin PIN recovery techniques all involve enrolling additional unlocking methods. Besides this, I completely agree with this post, especially: > I think the best you can do", "context": "", "use_case": "", "switched_from": "", "story": "Microsoft BitLocker \u2013 YellowKey zero-day exploit"}, {"id": 770157312, "item_id": 48134832, "url": "https://news.ycombinator.com/item?id=48134832", "by": "Borealid", "date": "2026-05-14", "stance": "neutral", "quote": "I don't think Bitlocker does that, because it's possible to set up admin PIN recovery techniques.", "excerpt": "> That's not how it works. The KEK is not stored inside the TPM, but encrypted/decrypted by the TPM. No, the KEK is stored inside the TPM, and the DEK is decrypted by it. If you have three layers (two KEKs, one encrypted with the other) then sure. But at the end of the day one private key is actually stored inside the TPM, taking up as much space as the length of the key. To be specific, Bitlocker uses a stored key, ", "context": "", "use_case": "", "switched_from": "", "story": "Microsoft BitLocker \u2013 YellowKey zero-day exploit"}, {"id": 770135856, "item_id": 48133491, "url": "https://news.ycombinator.com/item?id=48133491", "by": "pregnenolone", "date": "2026-05-14", "stance": "warn", "quote": "Bitlocker limits the PIN to 20 characters", "excerpt": "> Since there's a ton of misunderstanding in this thread True. It's unfortunate, amd a lot of false information being spread there. > the KEK is stored inside the TPM That's not how it works. The KEK is not stored inside the TPM, but encrypted/decrypted by the TPM. > You could say \"why not make the KEK be a hash-mixed combination of a PIN and something inside the TPM?\". Bitlocker does that. Cryptenroll doesn't (https", "context": "", "use_case": "", "switched_from": "", "story": "Microsoft BitLocker \u2013 YellowKey zero-day exploit"}, {"id": 770107808, "item_id": 48131738, "url": "https://news.ycombinator.com/item?id=48131738", "by": "jiggawatts", "date": "2026-05-13", "stance": "warn", "quote": "assume BitLocker can be popped by a well-equipped nation state attacker", "excerpt": "Microsoft quietly dropped support for encryption offload support (\"OPAL\") in SSD drives because the hardware vendors were doing absolute clown-shoes things like a single static hard-coded key or the key was literally empty / all zeroes! There's levels of trust/security. I generally trust Apple's device encryption, assume BitLocker can be popped by a well-equipped nation state attacker, and the rest I trust about as f", "context": "", "use_case": "", "switched_from": "", "story": "Mystery Microsoft bug leaker keeps the zero-days coming"}, {"id": 770096912, "item_id": 48131057, "url": "https://news.ycombinator.com/item?id=48131057", "by": "andrecarini", "date": "2026-05-13", "stance": "warn", "quote": "TPM+PIN is vulnerable", "excerpt": "The exploit developer themselves say [1] TPM+PIN is vulnerable, though no public PoC. [1]: https://deadeclipse666.blogspot.com/2026/05/were-doing-silent-patches-now-huh-also.html?m=1", "context": "", "use_case": "Full-disk encryption", "switched_from": "", "story": "Microsoft BitLocker \u2013 YellowKey zero-day exploit"}, {"id": 770092896, "item_id": 48130806, "url": "https://news.ycombinator.com/item?id=48130806", "by": "otterley", "date": "2026-05-13", "stance": "warn", "quote": "", "excerpt": "Here's the primary source: https://deadeclipse666.blogspot.com/2026/05/two-more-public-disclosures-it-will.html Other links: https://github.com/Nightmare-Eclipse/YellowKey https://github.com/Nightmare-Eclipse/GreenPlasma", "context": "", "use_case": "", "switched_from": "", "story": "Microsoft BitLocker \u2013 YellowKey zero-day exploit"}, {"id": 770090480, "item_id": 48130655, "url": "https://news.ycombinator.com/item?id=48130655", "by": "ndiddy", "date": "2026-05-13", "stance": "warn", "quote": "not to use vendor provided encryption for any sensitive data", "excerpt": "I think the Bitlocker \"vuln\" is a good reminder not to use vendor provided encryption for any sensitive data. https://github.com/Nightmare-Eclipse/YellowKey/ You load a specific file onto a flash drive, plug it into a Bitlocker encrypted computer, reboot it while holding a key combination, and it pops up a command prompt with full access to the encrypted volume. There's no way this isn't a backdoor.", "context": "", "use_case": "full-disk encryption", "switched_from": "", "story": "Mystery Microsoft bug leaker keeps the zero-days coming"}, {"id": 766350802, "item_id": 47896925, "url": "https://news.ycombinator.com/item?id=47896925", "by": "aaravchen", "date": "2026-04-24", "stance": "recommend", "quote": "", "excerpt": "TPM locking is for ensuring the disk isn't removed from your machine. It's technically possible that someone could tap the hardware while the disk is still in your machine, but otherwise they're stuck contending with whatever other security setup you have on your machine. The TPM locked disk encryption is more like embedding your safe in concrete with deep foundations. It doesn't affect the thickness or quality of yo", "context": "", "use_case": "Disk encryption unlock", "switched_from": "", "story": "Ubuntu 26.04 LTS Released"}, {"id": 763382897, "item_id": 47711431, "url": "https://news.ycombinator.com/item?id=47711431", "by": "fuckinpuppers", "date": "2026-04-09", "stance": "neutral", "quote": "I actually moved away from VC back to Bitlocker for FDE just a couple weeks ago", "excerpt": "Hopefully this is just boot issues, and not VC in general moving forward for now. I just centralized on leveraging VC for container encryption. I actually moved away from VC back to Bitlocker for FDE just a couple weeks ago (I forget the exact reasons why) But I still like it for containers, and I hope they can figure out a way to get it fixed for VC and WireGuard or they can figure out alternate signing options and ", "context": "", "use_case": "full disk encryption", "switched_from": "VeraCrypt", "story": "Microsoft Abruptly Terminates VeraCrypt Account, Halting Windows Updates"}, {"id": 751978884, "item_id": 46998680, "url": "https://news.ycombinator.com/item?id=46998680", "by": "dangus", "date": "2026-02-12", "stance": "warn", "quote": "I just think the user experience of Bitlocker is piss poor", "excerpt": "We are in this discussion sometimes talking about things that are \"missing\" from Mac that are actually outdated omissions, no longer accurate. For example, Snap Layouts is now a built-in feature in macOS, but some folks are talking like it's impossible to snap windows in macoS. It's just not as robust/customizable as third-party tools and I think most people who started using the third-party tools should stick to the", "context": "", "use_case": "", "switched_from": "", "story": "Resizing windows on macOS Tahoe \u2013 the saga continues"}, {"id": 751585153, "item_id": 46974072, "url": "https://news.ycombinator.com/item?id=46974072", "by": "keepamovin", "date": "2026-02-11", "stance": "neutral", "quote": "I rely on LUKS/BitLocker for my daily driver too", "excerpt": "That is completely valid for personal threat models, I rely on LUKS/BitLocker for my daily driver too. The specific gap this fills is 'Defense in Depth' + compliance. OS-level encryption (like FDE) is transparent once you log in. If you walk away from an unlocked machine, FDE does nothing. App-level encryption, however, ensures the specific sensitive notes remain encrypted on disk even while the OS is running and the", "context": "", "use_case": "Full-disk encryption", "switched_from": "", "story": "Windows Notepad App Remote Code Execution Vulnerability"}, {"id": 748835442, "item_id": 46802215, "url": "https://news.ycombinator.com/item?id=46802215", "by": "vladvasiliu", "date": "2026-01-28", "stance": "compare", "quote": "It works the same as bitlocker", "excerpt": "You can have automatic unlock with tpm2, with or without a pin, in addition to passphrase, file, fido2, pkcs#11 cert, or whatever else is supported by luks. I've been using this for a few years now, and never had an issue. https://wiki.archlinux.org/title/Systemd-cryptenroll > Imagine a motherboard failure and boom there goes my entire disk. You can also set a long-ass key in addition to the other methods, and back i", "context": "", "use_case": "", "switched_from": "", "story": "Microsoft forced me to switch to Linux"}, {"id": 747964402, "item_id": 46747775, "url": "https://news.ycombinator.com/item?id=46747775", "by": "smileybarry", "date": "2026-01-24", "stance": "neutral", "quote": "technically running on BitLocker", "excerpt": "Not anymore, modern hardware running Windows 11 Home now also has FDE, technically running on BitLocker, just that it's called \"Device Encryption\" and doesn't have the same options: https://support.microsoft.com/en-us/windows/device-encryption-in-windows-cf7e2b6f-3e70-4882-9532-18633605b7df > For reference, I did accidentally login into my Microsoft account once on my local account (registered in the online accounts ", "context": "", "use_case": "Disk encryption", "switched_from": "", "story": "Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops"}, {"id": 747930801, "item_id": 46745675, "url": "https://news.ycombinator.com/item?id=46745675", "by": "Krssst", "date": "2026-01-24", "stance": "warn", "quote": "TPM unlock was broken with dual boot, needed to enter the recovery key after every boot to Fedora", "excerpt": "> A $60 difference Oh, the difference in dollar is less than I expected. And you're right, after checking, the difference in price in the USA is $60 ($139 Home and $199 Pro). In France, Windows 11 Home is 145\u20ac compared to 259\u20ac for Windows 11 Pro: https://www.microsoft.com/fr-fr/d/windows-11-famille/dg7gmgf0krt0 - https://www.microsoft.com/fr-fr/d/windows-11-professionnel/dg7gmgf0d8h4 (USB key is selected by default b", "context": "", "use_case": "full-disk encryption", "switched_from": "", "story": "Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops"}, {"id": 747891008, "item_id": 46743188, "url": "https://news.ycombinator.com/item?id=46743188", "by": "stego-tech", "date": "2026-01-24", "stance": "compare", "quote": "", "excerpt": "I honestly love how HN is missing the forest for the trees, here, in the sense that ya\u2019ll are upset Microsoft gave keys over for BitLocker to the feds but seemingly forget that Microsoft has been doing this in various forms since BitLocker released. Hell, they\u2019ve given alphabet agencies tools that just pop the decryption in the field before, for intelligence work. I trust BitLocker and Apple\u2019s encryption to protect m", "context": "", "use_case": "Disk encryption", "switched_from": "", "story": "Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops"}, {"id": 747885264, "item_id": 46742829, "url": "https://news.ycombinator.com/item?id=46742829", "by": "pregnenolone", "date": "2026-01-24", "stance": "recommend", "quote": "Your average thief won\u2019t be able to steal any data from a device protected with BitLocker\u2019s TPM-based encryption", "excerpt": "I\u2019m not trying to defend Microsoft, but so much of the stuff here is just painful to read. People shouting about backdoors, FBI, Linux, VeraCrypt \u2013 in completely bizarre combinations. It's astonishing what kind of garbage people come up with based on a superficial understanding of the topic. First of all, the fact that Windows uploads recovery keys to Microsoft accounts is nothing new and has been known for a long ti", "context": "", "use_case": "full-disk encryption on Windows", "switched_from": "", "story": "Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops"}, {"id": 747867728, "item_id": 46741733, "url": "https://news.ycombinator.com/item?id=46741733", "by": "nagaiaida", "date": "2026-01-23", "stance": "neutral", "quote": "you've baked in an unfounded assumption that bitlocker is even initially enabled", "excerpt": "you've baked in an unfounded assumption that bitlocker is even initially enabled intentionally by someone who knows that's a choice they can make: > Here's what happens on your Dell computer: > BitLocker turns on automatically when you first set up Windows 10 or Windows 11 > It works quietly in the background, you won't notice it's there > Your computer creates a special recovery key (like a backup password) that's s", "context": "", "use_case": "Disk encryption", "switched_from": "", "story": "Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops"}, {"id": 747839296, "item_id": 46739956, "url": "https://news.ycombinator.com/item?id=46739956", "by": "masfuerte", "date": "2026-01-23", "stance": "recommend", "quote": "if you explicitly enable bitlocker then the key is no longer stored on the disk and it is secure", "excerpt": "There was a great blog post a few years ago that reverse engineered the on-disk data structures and demonstrated extracting the key. Of course, I can't find it now. Microsoft themselves [1] say: > If a device uses only local accounts, then it remains unprotected even though the data is encrypted. There is a further condition: if you explicitly enable bitlocker then the key is no longer stored on the disk and it is se", "context": "", "use_case": "", "switched_from": "", "story": "Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops"}, {"id": 747833504, "item_id": 46739594, "url": "https://news.ycombinator.com/item?id=46739594", "by": "Krssst", "date": "2026-01-23", "stance": "neutral", "quote": "password-based Bitlocker requires Windows Pro which is quite a bit more expensive", "excerpt": "Note that password-based Bitlocker requires Windows Pro which is quite a bit more expensive. > sign into your Microsoft account or link it to Windows again. For reference, I did accidentally login into my Microsoft account once on my local account (registered in the online accounts panel). While Edge automatically enabled synchronization without any form of consent from my part, it does not look like that my Bitlocke", "context": "", "use_case": "", "switched_from": "", "story": "Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops"}, {"id": 747828752, "item_id": 46739297, "url": "https://news.ycombinator.com/item?id=46739297", "by": "Esophagus4", "date": "2026-01-23", "stance": "neutral", "quote": "Microsoft does not sell / use for advertising data from your Bitlocked laptop.", "excerpt": "I think you\u2019re conflating lots of different types of data into one giant \u201cdata.\u201d Microsoft does not sell / use for advertising data from your Bitlocked laptop. They do use the following for advertising: Name / contact data Demographic data Subscription data Interactions This seems like what a conspiracy theorist would imagine a giant evil corporation does. https://www.microsoft.com/en-us/privacy/usstateprivacynotice", "context": "", "use_case": "", "switched_from": "", "story": "Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops"}, {"id": 747822096, "item_id": 46738881, "url": "https://news.ycombinator.com/item?id=46738881", "by": "Coeur", "date": "2026-01-23", "stance": "warn", "quote": "We now know that BitLocker is not secure", "excerpt": "Remember when the original dev of TrueCrypt (the VeraCrypt predecessor) suddenly abandoned the project and wrote that people should use BitLocker instead? [1] [2] We now know that BitLocker is not secure, and an intelligent open source dev saying that was probably knowingly not saying the truth. The best explanation to me is that this was said under duress, because somebody wanted people to move away from the good Tr", "context": "", "use_case": "Disk encryption", "switched_from": "", "story": "Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops"}, {"id": 747798176, "item_id": 46737386, "url": "https://news.ycombinator.com/item?id=46737386", "by": "shakna", "date": "2026-01-23", "stance": "warn", "quote": "if you connect your account to Microsoft, then they do have the ability fetch the bitlocker key", "excerpt": "All \"Global Reader\" accounts have \"microsoft.directory/bitlockerKeys/key/read\" permission. Whether you opt in, or not, if you connect your account to Microsoft, then they do have the ability fetch the bitlocker key, if the account is not local only. [0] Global Reader is builtin to everything +365. [0] https://github.com/MicrosoftDocs/entra-docs/commit/2364d8da9f1544c258161ad93cb4641f100d952a", "context": "", "use_case": "", "switched_from": "", "story": "Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops"}]}