BitLocker
No written verdict yet. Here is what commenters said.
Why people recommend it
“I'm not aware of any bitlocker exploits that work on TPM + pin”
“Your average thief won’t be able to steal any data from a device protected with BitLocker’s TPM-based encryption”
Show 3 more
“if you explicitly enable bitlocker then the key is no longer stored on the disk and it is secure”
“I use BitLocker on my Windows box without uploading the keys.”
“BitLocker wraps the key, meaning even if the TPM were compromised, one would still have to brute-force the PIN for the actual key.”
Caveats and dissent
“https://www.techspot.com/news/112410-security-researcher-microsoft-secretly-built-backdoor-bitlocker-releases.html”
“I would never trust it a second, being property and known for issues.”
Show 2 more
“bitlocker had a backdoor for the NSA so it's actually possible to use that to recover the data”
“Bitlocker is insecure and backdoored”
Often compared with
1 moved from VeraCrypt to BitLocker
Threads where it came up
- Microsoft gave FBI set of BitLocker encryption keys to unlock suspects' laptops 15 mentions
- Security researcher says Microsoft built a Bitlocker backdoor, releases exploit 11 mentions
- Microsoft BitLocker – YellowKey zero-day exploit 6 mentions
- Mystery Microsoft bug leaker keeps the zero-days coming 3 mentions
- Since Linux 6.9, LUKS suspend stopped wiping disk-encryption keys from memory 2 mentions
- Windows 11 users are tired of MS account requirements creeping into everything 1 mention
Data: bitlocker.json. Quotes are verbatim; the verdict and theme labels are written by a model from these comments, and every clause links to its sources.
All comments 40
“https://www.techspot.com/news/112410-security-researcher-microsoft-secretly-built-backdoor-bitlocker-releases.html”
“I would never trust it a second, being property and known for issues.”
“bitlocker had a backdoor for the NSA so it's actually possible to use that to recover the data”
“Bitlocker is insecure and backdoored”
“But the files on the disk must still be decrypted somehow. The key must be stored somewhere.”
“Bitlocker was laughed at whenever you mentioned it by name, there was not a single engineer I met that took it seriously”
“even if I think it exposes an unwisely large attack surface”
“it is perniciously misleading to ship a sabotaged product on which these legally consequential decisions get made around the world”
“I seriously doubt it because that would require breaking or exploiting the TPM itself.”
“when I do use bitlocker, I use it with a PIN”
“This doesn't seem an attack on BitLocker so much as it is an attack on the secure boot chain.”
“I'm not aware of any bitlocker exploits that work on TPM + pin”
They claim they have TPM + PIN exploit too, though how credible it is remains to be seen. https://deadeclipse666.blogspot.com/2026/05/were-doing-silent-patches-now-huh-also.html
“without which Bitlocker isn’t secure anyway”
“The non-cloud methods for recovering the key have been the same since Bitlocker was released 19 years ago.”
“TPM tamper detection and bitlocker disagree.”
> If the TPM required a PIN to extract anything, I think there would be no need to manually decrypt anything in software as they show with the python code. Like I specifically pointed out, it's belt and suspenders. > Of course I could be wrong... please feel free to provide more info. From https://blog.scrt.ch/2024/10/28/privilege-escalation-through-tpm-sniffing-when-bitlocker-pin-is-enabled/ : > Indeed, by analysing
> you can just get an LPE to access the running Windows environment after it boots Or if you have physical access, you can probe the TPM chip with a SPI decoder to get the key directly: https://post-cyberlabs.github.io/Offensive-security-publications/posts/2024_09_tpmandpin/ Another method is via PXE (still not patched on most systems apparently): https://github.com/andigandhi/bitpixie > TPM+PIN should actually mean
“I've always found it silly that Microsoft's default BitLocker implementation doesn't make it easy to do the obvious thing”
“I don't think Bitlocker does that, because it's possible to set up admin PIN recovery techniques.”
“Bitlocker limits the PIN to 20 characters”
“assume BitLocker can be popped by a well-equipped nation state attacker”
“TPM+PIN is vulnerable”
Here's the primary source: https://deadeclipse666.blogspot.com/2026/05/two-more-public-disclosures-it-will.html Other links: https://github.com/Nightmare-Eclipse/YellowKey https://github.com/Nightmare-Eclipse/GreenPlasma
“not to use vendor provided encryption for any sensitive data”
TPM locking is for ensuring the disk isn't removed from your machine. It's technically possible that someone could tap the hardware while the disk is still in your machine, but otherwise they're stuck contending with whatever other security setup you have on your machine. The TPM locked disk encryption is more like embedding your safe in concrete with deep foundations. It doesn't affect the thickness or quality of yo
“I actually moved away from VC back to Bitlocker for FDE just a couple weeks ago”
“I just think the user experience of Bitlocker is piss poor”
“I rely on LUKS/BitLocker for my daily driver too”
“It works the same as bitlocker”
“technically running on BitLocker”
“TPM unlock was broken with dual boot, needed to enter the recovery key after every boot to Fedora”
I honestly love how HN is missing the forest for the trees, here, in the sense that ya’ll are upset Microsoft gave keys over for BitLocker to the feds but seemingly forget that Microsoft has been doing this in various forms since BitLocker released. Hell, they’ve given alphabet agencies tools that just pop the decryption in the field before, for intelligence work. I trust BitLocker and Apple’s encryption to protect m
“Your average thief won’t be able to steal any data from a device protected with BitLocker’s TPM-based encryption”
“you've baked in an unfounded assumption that bitlocker is even initially enabled”
“if you explicitly enable bitlocker then the key is no longer stored on the disk and it is secure”
“password-based Bitlocker requires Windows Pro which is quite a bit more expensive”
“Microsoft does not sell / use for advertising data from your Bitlocked laptop.”
“We now know that BitLocker is not secure”
“if you connect your account to Microsoft, then they do have the ability fetch the bitlocker key”