shahine.com/omar/

I have been meaning to blog about BitLocker since I set it up on my new ThinkPad T60. Why did I use BitLocker? In case my laptop is stolen then my hard drive will just look like a bunch of unintelligible 1s and 0s. I would not use BitLocker on a desktop machine, but for a Laptop, especially one with confidential Microsoft info it's a no brainier.

BUT WHERE WAS THE BIG FAT EASY BUTTON?

Setting up BitLocker was a PITA for me. I followed the step by step instructions to enable BitLocker but each time I installed Vista I was told my drive configuration was not suitable. Finally I gave up, created a big fat partition and installed Vista. I then got the new Windows Vista Ultimate Extras BitLocker enhancement and it did all the dirty work for me. Why oh why didn't I know about this first? It would be nice if the Technet article mentioned this easy tool.

Anyhoo, I write this today because Lifhacker has an article comparing BitLocker to Apple's FileVault. Now I dig and respect Lifehacker but Gina totally missed the most important aspect of BitLocker. YOU DON'T NEED A USB Key to use BitLocker. My Laptop came with a Trusted Platform Module (TPM Chip). Most PCees come with one these days. They are usually disabled in the BIOS so you must turn them on (not sure why they are disabled as they are pretty benign when not being used). In fact I would never have considered BitLocker if I had to use a USB key (BitLocker does allow to you use a PIN and or USB Key in addition to the TPM Chip).

Anyway, with a TPM chip the "key" is essentially a chip on the motherboard. However, if the system detects and significant change it will force you to manually enter the key and disable/re-enable BitLocker. This ensures that if some one lifts your laptop and takes out your hard drive it won't be readable. This mode of operation is called Transparent Operation Mode:

Transparent operation mode: This mode leverages the capabilities of the TPM 1.2 hardware to provide for a transparent user experience – the user logs onto Windows Vista as normal. The key used for the disk encryption is sealed (encrypted) by the TPM chip and will only be released to the OS loader code if the early boot files appear to be unmodified. The pre-OS components of BitLocker achieve this by implementing a Static Root of Trust Measurement – a methodology specified by the Trusted Computing Group.

I had to experience this fist hand the other day when some kind of change caused my BIOS to think that my machine changed enough to require me to enter my key (I suspect it was one of the early boot files being modified by an OS update). Now you can insert a USB KeyChain with your key (which didn't work for me, not sure why, need to muck with the bios to find out) or enter it in manually from a print out or in my case the key that was backed up to the Windows MarketPlace Digital Locker (another Vista Ultimate Extra).

So, while it's nice that Gina gave BitLocker the win over FileVault, she neglects the two coolest features:

• Support for the TPM and hardware key
• Support for backup of your key to the Digital Locker on Windows Market Place

BTW, if you do use BitLocker with a TPM I highly recommend that you have a copy of your key somewhere you can get to if all you have is your laptop. In my case I store the key on my Samsung Blackjack using eWallet. I would be pissed if I were on a plane, tried to boot my laptop and I was locked out.