1

I am wondering which attacks can be prevented by using a different password for the lock screen and full disk encryption. The goal is to prevent people from accessing my data. The details of my setup would be as follows:

  • Windows 10 (up to date, freshly installed).
  • Bitlocker FDE for C: drive using the same password as the administrator user.
  • Administrator user using the same password as the FDE.

Now as far as I know things like encryption and lock screens are a form of protection against physical attacks. But please correct my if I am wrong about that. I am currently only considering physical access attacks (leaving laptop behind, theft, etc.).

If the device is turned off there should be no additional risk for having the same password. You have to pass FDE before you even get to pass the lock screen. The lock screen password hash is also encrypted. If you can pass FDE you can access the data anyway (using something like delocker+linux), so my goal to protect my data has already failed.

If the device is turned on, fde passed (decrypted), but locked it shouldn't be possible to bypass the lock screen. Afaik one can't retrieve the password in plain text, from the lock screen, on the newest version of Windows 10. Also a "cold boot attack" should already be possible at this stage even if the password is different.

If the device is turned on, fde passed (decrypted), and unlocked... well at this point all is lost.

My knowledge on security is limited, so I might be missing something. Because as far as I see it, this is one of those odd cases where using the same password has no real bad repercussions. So my question is, am I missing something?

3 Answers3

2

If you're the only user of the system and your password is string, then yes, there's minimal risk to using the same password.

Two caveats.

Even without FDE, your system encrypts certain data using your lockscreen password, for example DPAPI, which is used by some password managers like the one built into Chrome.

Also, consider that FDE password is something that you only need to type once for every boot, while the lockscreen password, you need to type everytime you lock your screen, which if you have good clean desk hygiene, you should be locking your screen everytime you leave your desk, so you'll likely be locking the screen dozens of times per day as you go for lunch, to the toilet, quick break, etc. Depending on how paranoid you are about your security, you have the opportunity to use a stronger password for the FDE password and to use an easier to type password for your lockscreen. If you use the same password for both, you'll have to find a compromise by finding one password that satisfies both requirements.

Lie Ryan
  • 31,089
  • 6
  • 68
  • 93
1

The FDE cipher is likely stronger than the Windows cipher.

Bitlocker seems to be PBKDF(sha256(sha256(UTF16(password))))), and Windows (NTLM) uses unsalted MD-4. PBKDf is much, much stronger than MD4. Nearly every NTLM password has been cracked.

Neither appear to be salted.

Using the same password on a single user system where you have little concern over privacy is likely fine.
If you have any concern about someone getting into your system while it is powered down, then use a different password for Bitlocker, even a longer more complex one.
If you have logged in, and the screensaver password is on, then only the NTLM password is keeping someone out.

Either way, forensics people can easily crack NTLM. Bitlocker is quite a bit harder, but not impossible.

Always assume that someone with enough compute power could break your encryption if they really wanted to.

MikeP
  • 1,159
  • 7
  • 12
1

Windows accounts can be subject to a number of attacks that FDE keys aren't.

Let's say an attacker somehow got elevated privileges onto your box. They can extract the SAM registry files and grab your NTLM key, feed that through a rather powerful machine and an onscenely large wordlist and they could have your password within minutes.

"But wait," you ask, "Surely if an attacker has elevated privileges on the box, there's no need for other kinds of attacks?". Well, in most cases you'd be right, however in this position there is one thing an attacker may not be able to do and that is start a machine up from cold boot and decrypt the data, which would be an important ability in physical-theft-based attacks. Perhaps your attacker is after a particularly large file, cant afford to get caught trafficking massive amounts of data but needs that file ASAP? Then having a different BitLocker password will throw a massive wrench in the works of that attack.

Community
  • 1
520
  • 723
  • 3
  • 5