Windows 8.1 steps up security with biometrics, encryption, and more

[Chiefcrowe]

http://www.pcworld.com/article/2044...rity-with-biometrics-encryption-and-more.html

So do I understand this correctly? In 8.1, those machines will automatically enable encryption?
Does this include the entire disk or just user files?

 

[MTDEW]

I would like to know also.
I'm wondering also if the encryption will mess with imaging programs like Acronis.

I'm surprised that encryption being enabled by default isn't creating more discussions on the topic online.

Unless my Google-fu just sucks.

 

[Broheim]

So do I understand this correctly? In 8.1, those machines will automatically enable encryption?
Does this include the entire disk or just user files?

they say it's a simplified version of bitlocker, so by the sound of it, it's full disk.

 

[Mushkins]

they say it's a simplified version of bitlocker, so by the sound of it, it's full disk.

Oh joy, IT departments the world over have one more reason to avoid Windows 8 and 8.1. Microsoft better provide us with some tools to be able to pull that drive and slave it to a working system for data recovery, or a centralized management system to safely recover/manage encryption keys, or a domain admin override, or something.

If someones windows install is hosed and theres no way to recover data because it's permanently encrypted with no recovery options companies are gonna be pissed. At least they presumably have vigilant IT support to disable this crap and use a real encryption solution with secure administrative recovery options. It's the small businesses and home users that are gonna get bit the worst over this for not knowing its on by default. Encryption is important, but it needs to be a carefully considered and intentionally implemented part of a security plan. The potential for critical data loss is just too great to approach it any other way.

 

[smakme7757]

Oh joy, IT departments the world over have one more reason to avoid Windows 8 and 8.1. Microsoft better provide us with some tools to be able to pull that drive and slave it to a working system for data recovery, or a centralized management system to safely recover/manage encryption keys, or a domain admin override, or something.

If someones windows install is hosed and theres no way to recover data because it's permanently encrypted with no recovery options companies are gonna be pissed. At least they presumably have vigilant IT support to disable this crap and use a real encryption solution with secure administrative recovery options. It's the small businesses and home users that are gonna get bit the worst over this for not knowing its on by default. Encryption is important, but it needs to be a carefully considered and intentionally implemented part of a security plan. The potential for critical data loss is just too great to approach it any other way.

I'd imagine; There's a group policy setting for that .

 

[Whisper2]

I performed I clean install of 8.1 and Bitlocker is off on both of my drives. I did not think about BitLocker until I read this post. I did not change the settings.

I do not know why it was not enabled -- could be my system is not new enough (Lynfield i7 860) or I because I did not link the install to a Microsoft Live account.

 

[Hugo Drax]

Rumors on the street that Microsoft might buy Startisback for 1.2 billion dollars and incorporate the product into Windows 8.2

So there is hope.

 

[MTDEW]

Rumors on the street that Microsoft might buy Startisback for 1.2 billion dollars and incorporate the product into Windows 8.2

So there is hope.

Now why would they pay for something they could have already implemented themselves and decided to remove instead?

I performed I clean install of 8.1 and Bitlocker is off on both of my drives. I did not think about BitLocker until I read this post. I did not change the settings.

I do not know why it was not enabled -- could be my system is not new enough (Lynfield i7 860) or I because I did not link the install to a Microsoft Live account.

That is interesting info.
The way the wording is, it is hard to tell if using a local account is the difference for sure. (i'd like to know)

For consumers who create and use a Microsoft account to log in to Windows 8.1 (or use a domain account on a corporate network), your entire PC or device will be encrypted.

 

[Mushkins]

I'd imagine; There's a group policy setting for that .

There are GPO settings for bitlocker, the point is how many organizations that aren't already using bitlocker have them specifically set to disabled instead of "not configured" considering they aren't using the feature and it's never been an issue. Yeah, it boils down to IT staff doing their due diligence before pushing out major updates so they understand exactly how they affect their environment, but this is a pretty big issue that would be very easy to slip through the cracks for smaller businesses that wont be caught until someone has lost data because of it.

Likewise, GPO doesn't help home users much. When John Smith installs crapware on his laptop that ruins his windows install and takes it to Best Buy to get fixed, they're gonna tell him "your drives encrypted, we can reinstall windows but it's gonna wipe all your data."

Hopefully it's as simple as slaving the drive to another good PC and having the users admin-enabled password to decrypt via a Microsoft provided software tool like it is with pretty much all enterprise-grade full disk encryption, but my worry is that since bitlocker is directly tied into the OS that the very issue of not being able to boot into the OS could make the data unrecoverable.

Has anyone actually had experience recovering data from a bitlocker encrypted drive? Is there any reliable documentation out there on the subject that might help explain why this is a good idea?

 

[Scooby Doo]

Now why would they pay for something they could have already implemented themselves and decided to remove instead?





That is interesting info.
The way the wording is, it is hard to tell if using a local account is the difference for sure. (i'd like to know)

So they can get rid of it :whiste:

 

[smakme7757]

There are GPO settings for bitlocker, the point is how many organizations that aren't already using bitlocker have them specifically set to disabled instead of "not configured" considering they aren't using the feature and it's never been an issue. Yeah, it boils down to IT staff doing their due diligence before pushing out major updates so they understand exactly how they affect their environment, but this is a pretty big issue that would be very easy to slip through the cracks for smaller businesses that wont be caught until someone has lost data because of it.

Likewise, GPO doesn't help home users much. When John Smith installs crapware on his laptop that ruins his windows install and takes it to Best Buy to get fixed, they're gonna tell him "your drives encrypted, we can reinstall windows but it's gonna wipe all your data."

Hopefully it's as simple as slaving the drive to another good PC and having the users admin-enabled password to decrypt via a Microsoft provided software tool like it is with pretty much all enterprise-grade full disk encryption, but my worry is that since bitlocker is directly tied into the OS that the very issue of not being able to boot into the OS could make the data unrecoverable.

Has anyone actually had experience recovering data from a bitlocker encrypted drive? Is there any reliable documentation out there on the subject that might help explain why this is a good idea?

Recovery depends on the security options put in place when its encrypted. In addition to the recovery key I have all my Bitlocker drives equipped with my own passwords even if its on a laptop with a TPM.



Extra options can be enaldd through Powershell with the manage-bde command.



As long as one of these are available and the drive is able to read the Bitlocker data then you just need to hook the drive up to another PC that has Bitlocker support.



*Mobile post

 

[Mushkins]

Recovery depends on the security options put in place when its encrypted. In addition to the recovery key I have all my Bitlocker drives equipped with my own passwords even if its on a laptop with a TPM.



Extra options can be enaldd through Powershell with the manage-bde command.



As long as one of these are available and the drive is able to read the Bitlocker data then you just need to hook the drive up to another PC that has Bitlocker support.



*Mobile post

That's good to know at least. Hopefully the full version of 8.1 has a prompt or something during installation to let users know this encryption is being turned on and tells them where to get the recovery key.

 

[smakme7757]

That's good to know at least. Hopefully the full version of 8.1 has a prompt or something during installation to let users know this encryption is being turned on and tells them where to get the recovery key.

it's now possible to link Bitlocker recovery keys to a Microsoft account. I would presume that's the default location for all devices.



I tested it and it works really well. If your threat model suggests that the government isn't a concern and you're happy with keeping the keys with Microsoft then its a nice solution.



Very easy to keep keys safe and available. I don't use it because I dint trust anyone but myself with encryption keys, but for the average Joe its very practical.