The thing is on desktop pcs… If someone got physical access to it you don’t want to… You got way bigger issues haha
Comment on Microsoft Is Now Being Sued Over Sunsetting Windows 10
Hobo@lemmy.world 1 day agoOkay but you should enable secure boot on any device you want to keep any level of private data on. It’s trivial to break into a device that doesn’t have it enabled if you can physically access it. Laptops especially should have secure boot enabled.
Evono@lemmy.dbzer0.com 1 day ago
Hobo@lemmy.world 1 day ago
I’d argue that you now have two major issues. Someone breaking into a house and stealing a desktop isn’t unheard of. Full disk encryption with secure boot deployed will save you the headache of also having your identity/bank account/cc info a few days later.
DacoTaco@lemmy.world 1 day ago
… Secure boot has nothing to do with encryption and your data. Bitlocker can work without secure boot superuser.com/…/does-enabling-bitlocker-require-s…
Hobo@lemmy.world 1 day ago
I mean yeah that’s why I made the distinction in my comment… Without secure boot you’re still opening yourself up to a whole host of other attack vectors even if you have bitlocker enabled.
Evono@lemmy.dbzer0.com 1 day ago
I’d argue that 99,9% don’t use full disk encryption cause it’s Infact a performance degrading feature.
And there’s nothing to be stolen , all my passwords are in a password manager , all important accounts including the password manager have 2fa.
If someone isn’t a pw manager or 2fa it’s all their fault honestly.
Blackmist@feddit.uk 1 day ago
Yeah, but I might need to break into it to access it, e.g. if hardware dies, or Windows has a fit and breaks something.
BJ_and_the_bear@lemmy.world 1 day ago
This also why I don’t do whole disk encryption; it makes recovery impossible
conorab@lemmy.conorab.com 22 hours ago
You can work around it in both cases. SecureBoot will only prevent you from running non-signed boot loaders. If that breaks then you just turn off SecureBoot while you work on the issue (assuming SecureBoot failing isn’t due to a compromised boot loader) and the machine will boot normally minus any data stored in the TPM such as the encryption key. For the encryption key, this is something you are supposed to keep a copy of outside the TPM for scenarios like this. On Windows consumer PCs, this is stored in your Microsoft account or the place you specify when enabling it. For Azure or AD-joined PC’s this can be stored in Azure or AD.
The only ways SecureBoot and encryption will burn you are if there is data stored in the TPM that you don’t have a backup of or way of re-creating, or if the encryption headers on the drive are lost. That said, if you aren’t using a TPM some Windows features will break regardless and if the drive is so messed up that the encryption headers are lost then you’re probably back to backups anyway.