BitLocker Security concerns

das10 · 05 Aug 2018

In your case you can do some simple tests.

1: Start your laptop without any USB stick whatsoever.
2: Start your laptop with your USB stick with the bitlocker key file.

If you get to the logon screen with test 1, without any Password or PIN then you are NOT safe whether there is any random USB or no USB at all. If this is the case then bitlocker has not been set up properly.

If you only get to the logon screen with test 2, then you have set up bitlocker the way you wanted, ie you have to insert your special USB stick or input a password/PIN.

Hope that helps.

win10freak · 05 Aug 2018

When my USB stick (or any USB stick) is NOT inserted to my laptop, then yes, I do get the BitLocker PIN before the Windows logon screen.

When I delete that hidden BEK file from my USB stick, and boot the laptop while the USB stick plugged in, then it will ask me for the BitLocker PIN.

If I leave the BEK file in the USB stick, and boot up my laptop while the USB is plugged in, then it goes directly to the Windows logon screen.

So, having this said, can ANY USB stick even with no BitLocker recovery key files can bypass the BitLocker PIN prompt? If so, BitLocker is not secure.

das10 · 05 Aug 2018

In your setup if the USB key does not have any recovery key files (either BEK or TXT), Bitlocker PIN prompt CANNOT be bypassed. Anybody who wants to access your laptop will need either the BEK file or the TXT file. In that sense it is secure.

For ANY USB stick to work that stick needs to have either the BEK or the TXT file. If neither are present you are secure.

win10freak · 05 Aug 2018

Thanks so much for the help!
Now it’ makes more sense.

das10 · 05 Aug 2018

You are welcome.