Windows 10 Bitlocker will use software encryption by default on SSDs

[biffzinker]

Most people who buy SSDs and use the baked in hardware encryption capabilities as provided by manufacturers trust their data to be safe. However, it turns out the firmware on these devices is prone to relatively simple attacks that offer hackers an easy way to access your data, so Microsoft is changing the default Windows 10 behavior to use software-based AES encryption regardless of any encryption done internally by the SSD itself.

SSDs are getting faster and cheaper every year, but there's one feature that is as important to professionals, and that is security and encryption. Judging by a security advisory issued by Microsoft last year, it looks like manufacturers are leaving a lot be desired in that regard.

The company received many reports of vulnerabilities in the hardware encryption used by self-encrypting drives, so it made some changes with a recent Windows 10 update to enable software encryption by default on any newly connected SSDs. This was discovered by SwiftOnSecurity, who believes Microsoft no longer trusts SSD manufacturers after research has shown that firmware can be easily exploitable thus making locked down data accessible. Even more concerning is that manufacturers like Seagate expose the update process so much that a determined hacker can easily compromise a storage drive.

Windows 10's Bitlocker feature will now use software encryption on SSDs by default

SSDs are getting faster and cheaper every year, but there's one feature that is as important to professionals, and that is security and encryption. Judging by a...

www.techspot.com

 

[R-T-B]

Meh. If they really care about encryption, and insist on hardware, they'll use an OPAL cert'd drive anyways.

Hardware encryption just isn't trustworthy these days, though. The chips are black boxes, and that's bad.

 

[Bayfront Benny]

Maybe a hidden volume inside another encrypted volume or drive would help in the case of a stolen laptop. This would not apply to a (complete) boot drive as the OS would not be able to get in.

 

[Solaris17]

Meh. If they really care about encryption, and insist on hardware, they'll use an OPAL cert'd drive anyways.

Hardware encryption just isn't trustworthy these days, though. The chips are black boxes, and that's bad.

yeah even in the sec field I don’t even think I can name any of my colleagues that use the built in encryption

 

[R-T-B]

Maybe a hidden volume inside another encrypted volume or drive would help in the case of a stolen laptop. This would not apply to a (complete) boot drive as the OS would not be able to get in.

Someone hasn't met Truecrypt/veracrypt.

That's software encryption, and hardware encryption is likewise bootable. Not much isn't anymore.