I started using bitlocker yesterday and I have a TPM2.0 in my laptop. I enabled the option to enter a pin when starting and I enabled the option to use AES256 before encrypting. I don't really understand how it is safe to have the TPM unlock the drive automatically when starting. It has to start the OS so it has to decrypt it before starting windows right? If this is done automatically an attacker can just come to my laptop and start it and my data isn't encrypted, this seems very unsafe so I'm probably just understanding it wrong. Which is the safest way to use Bitlocker?
If this is done automatically an attacker can just come to my laptop and start it and my data isn't encrypted
This is the procedure. It isn't secure. For the average person, BitLocker and TPM is more secure than not using full-disk encryption.
TPM is a secure microcontroller with cryptographic capabilities designed to provide basic security-related functions involving encryption keys. now the specifics
BitLocker seals the master encryption key in the TPM and only allows the key to be released when code measurements have not changed from a previous secure boot. - Trusted Platform Module (TPM) and BitLocker Support
This is done with support from secure boot. Hence, directly booting and circumventing the normal boot procedure is not allowed. However, if you can find a vulnerability within Windows, you can circumvent this, as you do not physically need the decryption master key. E.g. Windows will boot to the lock screen, if you can identify a vulnerability here (when the drive is decrypted) you have access. Windows ’sticky keys’ exploit exploited a vulnerability where startup recovery would print the diagnostics within Notepad.exe with elevated administrator privileges. Notepad could open Windows Explorer and rename a program which would run at the login screen, sticky keys are one example. Renaming cmd.exe to sethc.exe allowed cmd.exe to be run with elevated administrator privileges at the login screen.
Which is the safest way to use Bitlocker
Use a strong password on BitLocker or setup a USB key. The USB key, will be a USB flash drive, just like TPM. Except you will control the storage mechanism, also you can easily remove the drive. However, both the options I said here can introduce other problems. This is very subjective depending upon your OpSec requirements. Bitlocker: USB Key vs Password?