6

I recently got Windows 10, and I am not overly thrilled at Microsoft having a copy of my password on their servers. I will also be forced to make a hotmail account, instead of just using a local account. I am forced to use Windows because of my job, so iOS and Linux are out of the question.

Is there a way of using Bitlocker full disk encryption with just a local account, and without sending Microsoft a copy of my key?

If I have to use VeraCrypt (without the plausible deniability) would I have problems because I am using a branded Samsung laptop with an SSD which likely uses TRIM.

I miss the old days of local Windows accounts, and mechanical hard drives, but I am forced to stick with my current setup.

Improve this question
8
  • 5
    Why are you forced to make a Hotmail account to use Windows 10? Do you mean that you couldn't create a local account on your laptop? Do you have admin rights on the laptop? Also, is this a company-owned and managed device?
    – User829193
    Commented Mar 15, 2021 at 2:24
  • 2
    @MarcWoodyard It's a personal device. When I bought it and went through the options there was no way to create a local account, so I disconnected the WiFi to trick it. The next problem is when I clicked "Enable Bitlocker" it said to continue I needed a hotmail account or something equally annoying.
    – questioner
    Commented Mar 15, 2021 at 3:04
  • 3
    I'm pretty sure Windows 10 still allows you to create local accounts. Here are some links you can look into support.microsoft.com/en-us/windows/… tomshardware.com/how-to/create-local-account-windows-10
    – User829193
    Commented Mar 15, 2021 at 3:07
  • 3
    Also, BitLocker shouldn't need a Microsoft account to be enabled. support.microsoft.com/en-us/windows/… superuser.com/questions/1507217/…
    – User829193
    Commented Mar 15, 2021 at 3:08
  • 6
    @questioner I recall the setup screen. While it asks for a Hotmail account in bold large text, there should be a very tiny Ignore this step option at some corner of the screen. I had the same concern on my personal laptop and I double checked that my Live account does not pwn my BitLocker keys.
    – usr-local-ΕΨΗΕΛΩΝ
    Commented Mar 15, 2021 at 9:28

2 Answers 2

Reset to default
13

VeraCrypt (or any other full volume encryption) can be (and has been for many years) used with SSDs. An attacker with the tools to access the drive metadata will be able to determine some things about what blocks are used or not, but won't be able to actually decrypt anything or otherwise compromise your data.

As a side note: Win10 still supports both local and domain accounts (in addition to Microsoft accounts), and neither one sends your recovery key to MS. So, this entire question is based on a false premise. I also suspect it's possible to use BitLocker with a MS account but not send them the recovery key - worst case, you can remove the recovery key from the drive - but it sounds like you don't want to do that anyhow.

Improve this answer
6
  • When I tried to login, I clicked the "forgotten password" option and it asked me to sign into my hotmail account to recover it proving Microsoft must have the key...
    – questioner
    Commented Mar 15, 2021 at 3:05
  • 9
    That means your Windows account is a Microsoft account. You couldn't have not done that. They don't make it obvious - it's small text under the box where you're supposed to put your email address at account creation - but there's an option "Create a local account instead". It might be possible to convert an MS account to a local one, even (the other direction works). Also, at the login screen, you're past where BitLocker would matter anyhow. So it doesn't prove anythign at all about any encryption keys (using a MS account and BL without giving MS the recovery key might be possible? Unsure).
    – CBHacking
    Commented Mar 15, 2021 at 5:21
  • 1
    @Haukinger If you're running Windows, you are letting Microsoft decide whether you're allowed to login into your machine.
    – gronostaj
    Commented Mar 15, 2021 at 8:01
  • 2
    Microsoft accounts can be used fine offline, at least for a while (I'm not sure if there's an offline time limit but they definitely don't have to check with MS every time you log in). Regardless, though... like I said, just don't do that! Use a local account instead. It's a bit less convenient (mostly things like needing to separately sign in to OneDrive and no clipboard sync option) but it works fine, and the option is available on all editions of Windows 10. EDIT: Also, "couldn't" in previous comment should have been "could" but I can't re-edit it.
    – CBHacking
    Commented Mar 15, 2021 at 8:10
  • 3
    @gronostaj not on an individual case-by-case basis. Of course, does microsoft-created code decide whether I'm allowed to login on classic/offline windows, but using Windows 10 is different - Microsoft can selectively deny or allow each individual login attempt without me making any changes to my machine. Essentially, I'd be saying "this isn't my machine" - which one has been doing forever in the context of domains, but there, the machine actually isn't my machine but the company's.
    – Haukinger
    Commented Mar 15, 2021 at 8:55
10

Disk encryption of an SSD is safe. If you do enable TRIM, the system will reveal which sectors have been erased, as described in this blog post (although this references dm-crypt, it applies equally to any disk encryption technology, including VeraCrypt). This may or may not be a big deal, depending on your threat model. However, even with TRIM, the confidentiality of encrypted data remains.

You can disable TRIM to reduce this metadata leakage even with disk encryption, but it will reduce drive performance and increase wear on the SSD. This happens because the SSD does not know which blocks are no longer in use and cannot optimize writes by erasing them.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .