2

I assume if I use Bitlocker on Windows 10 on a laptop with a TPM chip without a password, then if the laptop gets stolen, then the attacker can simply turn the machine on and then he gets to the windows logon screen without any problems.

To prevent this I assume I need the preboot pin, but how secure is that (with a 9 character numerical pin)?

The scenario I want to protect myself against:

  1. A simple thief steals the notebook
  2. They want to access the data by basic "googling around" hacking skills, like using a tool or typing in random passwords.

Meanwhile I will have time to change all the passwords of the online services, disable VPN accounts, etc. that were used on that notebook, so even if they eventually gain access, our systems will stay secure.

  • Shouldn't a strong password be enough for your scenario? As in to gain access to your data the thief would have to guess the password and that would be impossible if that is a strong passphrase. If I am correct bitlocker doesn't decrypt the drive until you are logged in (please correct me if I am wrong in this) – Wealot Jan 22 '18 at 15:23
2

The scenario I want to protect myself against: 1. A simple thief steals the notebook 2. They want to access the data by basic "googling around" hacking skills, like using a tool or typing in random passwords.

A 9 digit PIN should be sufficient to protect against an attacker of this level of sophistication for long enough for you to change the passwords on all your online services. A TPM will ensure that only a trusted computer can unseal it, in combination with your PIN. Since the attacker has the whole computer, all that is needed is the PIN. What matters now is several factors:

  • How motivated your attacker is (are you a random victim of this attacker, one of 100 others?).
  • How clever he is (one person's "basic Googling skills" is another person's advanced Google-fu).
  • How long it will take you to notice the theft and to change your passwords.

Both defenders and attackers need to do cost-benefit analysis. You have to determine how much of your time and effort your assets are worth, but the attacker has to do the same. If it takes them two weeks to gain access to your computer, that is two weeks of lost opportunities for theft. Why spend all that time on your computer if it would be more profitable to steal three more computers in that time?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.