this post was submitted on 24 Feb 2024
98 points (77.2% liked)
Linux
48220 readers
658 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Afaik you can't. Disk encryption requires entering the password every time and it asks for it BEFORE the OS is started so you can't use biometric login either
That's not technically true as enabling bitlocker on windows and filevault on Mac don't require two different passwords.
I recently dug into this because I accidentally trashed my wife’s OS which was encrypted with bitlocker. PITA btw and I couldn’t beat the encryption
Bitlocker encryption key hash is stored in 2 possible places. First is an unencrypted segment of the encrypted drive. This is bad because it’s pretty easy to read that hash and then decrypt the drive. The second place is on a Trusted Platform Module (TPM) which is a chip on the motherboard. This is better because it’s much more difficult to hack. It can be done but requires soldering on extra hardware to sniff the hash while the machine boots up. Might even be destructive… I’m not sure.
Either way a motivated attacker can decrypt the drive if they have physical access. For my personal machines, I wouldn’t care about this level of scrutiny at all.
Anyways you can see if any open source solutions support TPM.
Sorry idk much about Windows and Mac. But what you said sounds like their encryption systems aren't full disk encryption, they somehow found a way to store the password for login or they just disable the login password completely when the encryption is enabled
They are full disk encryption, and it's using the hardware TPM.
Oh then I guess idk what TPM actually is
Mac will ask you to “log in” very early in the boot process to decrypt the disk, I assume it keeps the drive key encrypted with your password somewhere.
That's just not true I have two macs with it enabled on both and it requires a single "normal" password
Yes normal password but it happens super early on mine, and once you log in there is a boot progress bar afterwards. This is an Intel Mac, might be different on apple chips.
That's likely because your Macs are using the TPM. Does your Linux machine have a TPM, and are you using it?
I don't think so, they are both intel macs over 10 years old and Macs didn't start adding TPM until 2017. On Mac, when you check the box to encrypt the drive during install you're prompted for an encryption password which you never need to use again unless you remove the drive and put it into another mac (or in my case add a second hard drive and use the original as "extra" storage).
Macs had TPMs before Windows PCs, IIRC.