I am wondering which attacks can be prevented by using a different password for the lock screen and full disk encryption. The goal is to prevent people from accessing my data. The details of my setup would be as follows:
- Windows 10 (up to date, freshly installed).
- Bitlocker FDE for C: drive using the same password as the administrator user.
- Administrator user using the same password as the FDE.
Now as far as I know things like encryption and lock screens are a form of protection against physical attacks. But please correct my if I am wrong about that. I am currently only considering physical access attacks (leaving laptop behind, theft, etc.).
If the device is turned off there should be no additional risk for having the same password. You have to pass FDE before you even get to pass the lock screen. The lock screen password hash is also encrypted. If you can pass FDE you can access the data anyway (using something like delocker+linux), so my goal to protect my data has already failed.
If the device is turned on, fde passed (decrypted), but locked it shouldn't be possible to bypass the lock screen. Afaik one can't retrieve the password in plain text, from the lock screen, on the newest version of Windows 10. Also a "cold boot attack" should already be possible at this stage even if the password is different.
If the device is turned on, fde passed (decrypted), and unlocked... well at this point all is lost.
My knowledge on security is limited, so I might be missing something. Because as far as I see it, this is one of those odd cases where using the same password has no real bad repercussions. So my question is, am I missing something?