Windows Vista To Make Dual-Boot A Challenge? 442
mustafap writes "UK tech site The Register is reporting on security guru Bruce Schneier's observation that the disk encryption system to be shipped with Vista, BitLocker, will make dual booting other OSs difficult - you will no longer be able to share data between the two." From the article: "This encryption technology also has the effect of frustrating the exchange of data needed in a dual boot system. 'You could look at BitLocker as anti-Linux because it frustrates dual boot,' Schneier told El Reg. Schneier said Vista will bring forward security improvements, but cautioned that technical advances are less important than improvements in how technology is presented to users."
And another EU Commision lawsuit in 3... 2... 1... (Score:3, Interesting)
Re:And another EU Commision lawsuit in 3... 2... (Score:5, Insightful)
Drive encryption is optional. It's something you may configure while setting up the system for systems carrying sensitive or important data. It's not like a standard Vista install automatically encrypts the entire drive. That would be ludicrous.
Bruce Schneier may be a brilliant security guy, but like every other person (and company) on the planet, he has an agenda. Don't automatically trust the guy telling you stuff because it's embarassing to the person he's telling you about.
Re:And another EU Commision lawsuit in 3... 2... (Score:5, Interesting)
Re:And another EU Commision lawsuit in 3... 2... (Score:3, Insightful)
Well it would be pretty hard to enable, unless they magically know who is buying the computer ahead of time,
The whole point is the END USER has to create their own key and pin/biometric at the TIME the drive is Encrypted.
So unless you see Dell becoming 1800 Ms Cleo, or see Gateway flying people to their factory just so they can enable the feature for that person, I think your tinfoil hat may be leading you down the wrong p
Re:And another EU Commision lawsuit in 3... 2... (Score:5, Interesting)
Actually this feature is pretty much as set in stone as you can get. The guy writing the article knows little to nothing about bitlocker, especially baiting people into believing it has any anti-Linux intentions.
As for it being a real feature and as the person above posted, they are correct and it is.
I am truly looking at the help file for Bitlocker in Vista as I type this. (We have also tested BitLocker on several systems, it does what it is supposed to do, and it has to be enabled by the END USER, as their key/pin is used to encrypt the drive.
And lets say as a goof Dell did enable this feature, and assigned a key and pin to the person buying the computer, all you do is type in your pin for access and then turn BitLocker off. (It can be turned on and off for the entire drive quite easily once it has been enabled.)
It is 100% optional, and not something recommended for the average person, it also is not recommended for volumes that need to be access from another OS in a multi-boot environment, so just don't use it.
You do realize it even locks out WindowsXP if you are dual booting WindowsXP and Vista and you use BitLocker to encrypt your Vista partiion?
This is NOT an evil plan against other OSes.
What the hell are you smoking? (Score:5, Insightful)
No, just anti-dual-boot. Microsoft makes their product more secure
Sorry, but since when does dual-boot mean "less secure"?
How many viruses are going to be stopped by preventing dual-booting? How many trojans?
Yeah, that's what I thought.
Re:What the hell are you smoking? (Score:5, Informative)
How many viruses are going to be stopped by preventing dual-booting? How many trojans?
Yeah, that's what I thought.
On the other hand, if you can convince a locked down Windows XP box to boot a Knoppix CD, you now own that box.
I think that is what they mean by "more secure".
Re:Stupid (Score:3, Insightful)
Please explain to me how this is going to prevent you from dual-booting
Whatever...try fat32 partition (Score:5, Insightful)
Re:Whatever...try fat32 partition (Score:3, Interesting)
Yes... and what extra limitations on FAT32 can we expect in Vista?
Re:Whatever...try fat32 partition (Score:2, Interesting)
Re:Whatever...try fat32 partition (Score:4, Informative)
Re:Whatever...try fat32 partition (Score:2)
Sure. For what values of fine is putting 32GB of data on a FAT32 file system a good idea?
Re:Whatever...try fat32 partition (Score:2)
When you've got 32GB of data you want to share between your Windows install and your Linux install. Say, your MP3 collection?
Re:Whatever...try fat32 partition (Score:5, Informative)
Put this [fs-driver.org] on your Windows install and make your common data-storage area ext2 or ext3 instead. If you start slinging around large (>2GB) files on a regular basis like I do, you won't have to worry about splitting/combining files.
Re:Whatever...try fat32 partition (Score:3, Insightful)
Re:Whatever...try fat32 partition (Score:3, Informative)
Re:Whatever...try fat32 partition (Score:2)
Re:Whatever...try fat32 partition (Score:2)
Microsoft isn't that stupid...
Re:Whatever...try fat32 partition (Score:2)
Re:Whatever...try fat32 partition (Score:2)
Re:Whatever...try fat32 partition (Score:2)
Re:Whatever...try fat32 partition (Score:2)
Re:Whatever...try fat32 partition (Score:5, Informative)
Re:Whatever...try fat32 partition (Score:5, Insightful)
You know full well it isn't a bug. It's the same exact "feature" that has been shared by all in their OSes for the past 20 years. It's not in Microsoft's interest to make it any easier for users to stray from their ecosystem, so this intentionally designed limitation is not going to change.
Re:Whatever...try fat32 partition (Score:5, Informative)
Bitlocker is a whole-volume, hardware based encryption system (as opposed to file-specific techologies, such as Encrypted File System, which have overhead that requires a specific filesystem like NTFS. There is no filesystem specific overhead because it's transparent to the filesystem, and to the applications for that matter) -- there is no reason I am aware of for it to be tied to any specific filesystem, and it should encrypt FAT32 just as capably as NTFS.
Not only is this functionality optional, and requiring special hardware support, but it is a bonafide feature. The data of the world would be much safer if every laptop swiped, hard drive sold on ebay, and incident of unwanted physical access of machines couldn't give absolute access to every file on the machine.
Re:Whatever...try fat32 partition (Score:2)
Re:Whatever...try fat32 partition (Score:3, Informative)
i don't know if this is a troll or an actual problem, but how about you try -t vfat -o rw [die.net]?
Re:Whatever...try fat32 partition (Score:2)
Re:Whatever...try fat32 partition (Score:2)
And the other way? If you know of a Windows ext3 or Raiser driver, then please tell me. Basically, nothing has changed.
FAT32 is the only common ground both OS's have, and that sucks. It handles ungraceful shutdowns badly (chdsk001.dat anyone?) and has no ownership / execute flags whatsoever. As others have suggested,
Re:Whatever...try thinking right (Score:5, Informative)
Read: This has nothing at all to do with dual booting. Your ability to dual boot will remain completly unchanged, period. This, however, is about your ability to share data between OSs, not your ability to boot two. Learn to write a article headline, please.
FAT32 is dead. Period, get over it, dead. No, I take that back, it still has one use: flash drives, and other forms of removable media. Other than that, IT IS DEAD. Why? Simple: security. From Windows 2000 and on, Microsoft actually put some degree of effort into security. "Some degree?" you ask? End result, due to NTFS, you can actually secure your system. Compared to FAT32 anyways, where a *guest* user can drop a virus as c:\explorer.exe, and then the next time Johnny Admin logs in, it's over. NTFS added actual security measures. ACLs. Execute bit. And, well, quite a bit more. Due to this, I can say the following without doubt that I'm right:
1) BitLocker will ONLY work with NTFS.
2) Vista will do everything they can short of threatening to eat your children to get you to install on NTFS. (Side note: http://www.theinquirer.net/?article=30128 [theinquirer.net] vs. http://www.microsoft.com/technet/windowsvista/lib
3) If you're still using FAT32 as your primary OS partition, you're an idiot.
4) Due to #4, if your defense is, "my [windows] OS can't run on NTFS!", my response is still the same. Go upgrade, you're not helping anyone.
FAT32 is nice for removable media. That's about it.
(</troll>)
Re:Whatever...try thinking right (Score:3, Insightful)
Re:FAT32 (Score:4, Informative)
Re:Whatever...try fat32 partition (Score:3, Interesting)
Or, maybe we could actually put on a thinking cap and just not turn on BitLocker? Wow, what a concept...
Does anyone get this? It is NOT TURNED ON UNLESS YOU TURN IT ON?
So if you are Dual Booting, simply don't turn on BitLocker, because you would have NO reason to. Makes perfect sense to me, and I don't see any motive in this technology, and yes I have used it on test systems.
Suggesti
Anti-competative! Predatory! Monopoly! (Score:4, Funny)
Don't worry, once Leopard comes out with Apple's own implementation of the Win32 API, no one will need Windows ever again.
Mmmuh-hahaha!
I dream of the day (Score:3, Interesting)
I really do. If it was me in charge, first thing I'd do - day one - would be to either hire people currently working on the Wine project, or hire a bunch of other qualified people and have them contribute to it. Get Wine working, then get it working well. Get a contract with Transgaming too - have them help. Imagine a Mac that played all the Win32/DirectX games! You wouldn't have an excuse then, right? Then, I'd dump all that work back into the FOSS community so others could benefit, and have a brilli
Re:Anti-competative! Predatory! Monopoly! (Score:4, Insightful)
Way to go there, migrating to a locked in proprietary platform. Oh, and on top of that, one that's crippled to only run on mandated hardware.
But Apple are hip at the moment, so it doesn't matter.
It's not a big deal (Score:2, Insightful)
Re:It's not a big deal (Score:2)
Re:It's not a big deal (Score:3, Interesting)
I still use Windows XP at work because I have to, but recently several of our tools have migrated to platform-indepe
Re:It's not a big deal (Score:2)
This is exactly why my desktop still uses Win98 SE.
Huh? (Score:5, Insightful)
What you mean it could still be possible (Score:5, Informative)
Shocking.
Will it be possible to mount non-encrypted disks in Vista? Well, unless MS is finally prepared to kick backwards compatibilty then yes.
Even if unencrypted HD's ain't supported (unlikely) they would still need to support regular filesystems like FAT for all those flash disks from your camera and USB keys and such.
I am as anti-ms as you can get (if I am ever diagnosed with an incurable disease Gates gets a bullet in the head the next day thanks to my Halo training. Eh non-MS FPS training) but this is just to much. Linux disk encryption makes it just as hard for linux to dualboot windows. In fact every linux distro should just use FAT to make sure windows can be dualbooted and read the linux data.
Geez.
Re:What you mean it could still be possible (Score:3, Interesting)
Also, on the note of using FAT32 so both OS'es can deal with each other's file systems; there is a nati
Re:What you mean it could still be possible (Score:4, Insightful)
the filesystems used in linux are free and open. MS is more than welcome to implement support for them in windows without having to pay a dime. The same is not true of the reverse situation.
MS does not support reading and writing to linux filesystems by choice to stifle interoperability. They keep their filesystems closed to the same end.
Re:What you mean it could still be possible (Score:2, Insightful)
Or maybe they just don't see any value in spending money developing a feature only 0.0001% of customers are interested in, something better handled by a third party.
Linux partition support under Windows (Score:4, Informative)
Indeed. And in fact you see a lot of implementations for windows of which a lot are based on the open-source code.
This shows that :
Meanwhile, the opensource community is trying [linux-ntfs.org] to play nice with Microsoft's OS.
Re:What you mean it could still be possible (Score:4, Insightful)
You're missing the point.
Even if the user is given a choice in the matter, are they going to understand that they're signing away their data to Microsoft?
That nice boy down the street that helped them recover their data with a reinstall so easily- are these fictional users going to understand that checkbox means their next screwup means their data is gone for good?
Linux disk encryption makes it just as hard for linux to dualboot windows.
No it doesn't. The bootsector and partition tables are most certainly NOT encrypted because then the system wouldn't boot.
In fact every linux distro should just use FAT to make sure windows can be dualbooted and read the linux data.
I've got a better idea. Instead of trying to convince all those distributions that you're right and their wrong, why don't you just try and convince ONE distribution- say Microsoft- that they should support ext3 and cryptoloop out of the box.
Re:Huh? (Score:2)
Dell images hard drives. If they image everyone's hard drive with this encryption enabled, then every dell machine shipped will use the same encryption keys.
The default is surely going to be OFF and recommended only for laptop users.
Jason.
Wait... (Score:4, Informative)
Re:Wait... (Score:4, Insightful)
Tom
Re:Wait... (Score:2)
Not until Reiserfs for windows makes some more progress, anyway.
On that subject, are there any third party drivers allowing you to access reiser (and other) file systems from within windows?
Re:Wait... (Score:2)
Re:Wait... (Score:2)
No Sign Yet (Score:5, Interesting)
News Just In: (Score:5, Insightful)
Encrypting a filesystem prevents arbitrary operating system from accessing it!
I mean — what the fuck?! — isn't that the whole idea?
Re:News Just In: (Score:2)
Re:News Just In: (Score:2)
Re:News Just In: (Score:2)
Non issue. (Score:5, Informative)
http://www.microsoft.com/technet/windowsvista/sec
Who knew? (Score:2, Insightful)
Once again, the headline is hideously misleading.
FileVault Anyone? (Score:4, Interesting)
Anyway, most dual booters that go between Windows and Linux already have dealt with these issues due to the unfriendly nature of NTFS.
It will only be in Enterprise and Ultimate Vista (Score:5, Insightful)
As much as we all love to bash Microsfot, I'm guessing it's an optional feature.
Not only dual booting (Score:2)
Re:Not only dual booting (Score:2)
I can certainly lock my disk up beyond recoverability now (at least using current public software/hardware) with publicly known encryption. I can lock up my machine so that the only think a thief could do is reinstall the OS (and even then they'd need to flash the firmware to get it to boot off CD without entering a password). If I was in the 'secrets' business that is what I'd want.
A more serious concern is whether it will
Re:Not only dual booting (Score:3, Informative)
Your wish is granted. Open certmgr.msc or add the Certificates snap-in to a mmc window. Your personal keys are located in the Personal\Certificates folder, including the one for EFS (note that there won't be an EFS c
Re:Story Title FUD... (Score:3, Informative)
2. There is not a problem here. Bitkeeper (EFS with a name created by the marketing department) will not be enabled by default unless your company enables the policy. If your company does enable the policy, you should also create a Data Recovery Agent. This can also be done on a standalone workstation.
Bitkeeper is not "EFS with a name created by the Marketing Dept" but rather a very different sort of encryption scheme. EFS uses an encryption key stored within the CAPI store in the OS
Has everyone gone mad? (Score:5, Informative)
Bitlocker isn't going to be compulsory, and as such it isn't going to affect dual booting in any way shape or form. It's certainly not the sort of thing your average home user would be setting up anyway (IMHO). Seems like Mr Schneier is a good old fashioned troll.
Some more info on Bitlocker here : http://www.microsoft.com/technet/windowsvista/lib
Re:Has everyone gone mad? (Score:2)
He's the type who always has an opinion on something regardless as to his actual contribution to the discovery.
He differs from me [for those who are going to reply to this] in that I don't seek media attention everytime SOMEONE does the hard work to figure something out (Sony rootkit anyone?).
Besides, why can't the MBR be on
Re:Has everyone gone mad? (Score:2)
Re:Has everyone gone mad? (Score:2)
Sounds like the real problem is that a botique platform has significant hardware limitations that adversely impact convenience and utility across the board.
Re:Has everyone gone mad? (Score:5, Insightful)
Slashdot has long had a strong anti-MS bias. Fine, they've never made a secret of it. Recently however, they've started to allow it to warp the facts, which is not fine.
Sure, this may well make dual-booting more difficult, in that you won't be able to get at your data. Ever tried getting at data on an NTFS partition with Fedora? ZOMG! Fedora is trying to lock out Windows!
I've been here a long time, and it's sad to see how the site has declined from a site you could trust, to one that will print almost anything as long as it bashes MS or praises FOSS.
That's it. I've had enough. (Score:3, Insightful)
Now if I also can't dual-boot then that's the last straw to drive me to a linux-only system.
And before anyone suggests it, no I don't want to be running Linux under a Microsoft VM.
Virtualization? (Score:2)
So dual boot for games... (Score:2)
What has changed?
We're getting good at FUD too! (Score:5, Informative)
First of all, vista won't have this activated by default. Here's how you can turn it on in Vista Beta:
http://www.microsoft.com/technet/windowsvista/lib
And yes it will make any data encrypted in this manner unavailable to another operating system. It does this by using TPM (Trusted Platform Module) in the BIOS and can base the key on the kernel and optionally: just the bios, a user supplied key, or a USB drive supplied key.
This allows for the option of encrypting/decrypting data from the very start of the boot process. And guess what? It's being implemented in linux too!
http://lwn.net/Articles/144681/ [lwn.net]
BitLocker from windows is just a kernel based drive encryption software that takes advantage of TPMs just like the linux system. If you're concerned about cross platform compatibility then use user space encryption rather than kernel space encryptiong. If you're that concerned about secure keys then don't dual boot! If you love dual booting and don't care about encryption at all, noone is going to beat you up and make you use encryptiong.
You may remove the tinfoil hat.
--David
Re:We're getting good at FUD too! (Score:2)
Re:We're getting good at FUD too! (Score:2)
Will it be possible to write a driver for these encrypted file systems without having to reverse engineer the encryption? Or will Microsoft tell people their encryption algorithms so that competitors can write drivers? Or is Microsoft using some standard algorithm (DES, RSA, or whatever)?
If Microsoft does the, "Oh, sorry, we won't tell you how to decrypt the data because you
Oh jeebus. Save us from ignorance. (Score:2, Interesting)
Where's the hardware? (Score:2)
The hardware part worries me. Is it just that the hardware is used to speed up the encrypt/decrypt stage? Or is it that disc encryption is actually tied to a specific unique chip on the system?
What happens if my motherboard dies one day and I need to copy files from the dead computer onto a new computer? Will there be a failsafe software-based decoder that will let me copy my files?
And how are backups goin
Shame on you (Score:5, Insightful)
A company plans to include a very useful encryption tool with it's next OS.
This is good news in terms of security and privacy, and therefore /. readers will welcome it.
Oh wait, no they won't, because the company is Microsoft. Microsoft is baaad, therefore everything they do is sinister and evil. You people always manage to find the dark lining to their every silver cloud.
It's the herd-mentality at work, folks.
Yawn.
doesn't matter to me (Score:2)
Not to discount this story... (Score:2)
Systems are cheap, watch for specials from the big guys and pick up a box for $399 or less.
I haven't had to dual boot a system in over 5 years and I'm certainly not independantly wealthy.
big deal?? (Score:2)
Bitlocker does NOT prevent dual booting (Score:5, Informative)
DRM. (Score:2)
Booting wont be a problem, sharing/copying data will. At the bright side, the ability to make a very potent copy
Duh (Score:5, Insightful)
That is the entire point of Bitlocker; Encrypt the drive so only the encrypting OS can decrypt it. Bitlocker would be rather pointless if any OS could read the encryped drive now wouldn't it?
Even if you move the bitlocked disk to another Vista machine, that machine wouldn't be able to read the disk without the decryption key, which I severly hoped you backed up.
We're dreading this feature in Vista becuase if its anything like XP encryption and it's easy to turn on, there's going to be a lot of unhappy students when we tell them "Your hard drive crashed and all of your files are unecoverable becuase you encryped the drive"
Problem is secret algorithm (Score:2, Insightful)
Bitlocker would be rather pointless if any OS could read the encryped drive now wouldn't it?
If any OS could read the encrypted drive given the key, then there would be no problem. The problem comes when Microsoft does not specify how to turn the ciphertext plus the key into the cleartext.
Re:Problem is secret algorithm (Score:3, Interesting)
Frankly, I don't see this being a big problem for Linux because MS encryption never goes to far in any company. NTFS encryption has been around since 2000 and I've yet to see a company swear by this system. This is going to be used by people who are paranoid about what's on their drives over recovering that said data and thats basicially it, and frankly this group w
Re:Duh (Score:3, Insightful)
Most IT dept's do NOT want to deal with this thing. Encryption is nothing new for MS. They've had it since Windows 2000 but almost no one uses it. Why? because there is absoletly no easy way to do any kind of disaster recovery on an encrypted NTFS drive unless you have a Domain policy which supplies an encryption key from the server, and even then it's a pain to recover unless you added execption policies (think backdoor)
So? (Score:2)
Not just dual-booting... (Score:3, Funny)
I just don't get it, Part III (Score:3, Informative)
Mickeysoft can't stop anybody from boting anything. THe boot process is handled by the bios and the boot sectors on the disk, which can't be encrypted unless the bios cooperates.
If the bios cooperates, it still has to be able to read said boot sectors, and if it can read windows boot info, it can read linux boot info, or anything ELSE you want to put in there.
So "difficult to dual-boot" is as far as I can tell, CRAP.
As for sharing data between the two systems
Re:Experience with Bitlocker (Score:5, Informative)
Also, Bitlocker is only available on Vista, so are you saying you're running your production users on the Vista beta?
The final straw came when one employee lost several hours work when Bitlcoker suddenly had an error reading from our intranet file server and corrupted his project.
Bitlocker doesn't affect files read from network locations, it's merely a hard disk encryption technology. I think you're confused about what Bitlocker is.
Re:Experience with Bitlocker (Score:2)
Mod Parent DOWN (Score:2)
I find it so odd the lengths people go sometimes to trash a company/person. Outright lies? It's one thing to hate M$ for things they've actually done, but to drive others to hate them for things you've claimed, but never actually happeneed to you? You are what's wrong with society.
Re:Mod Parent DOWN (Score:2)
Basically, it still doesn't add up. (I'll le
Re:Dirty socks (Score:2)
It would smell like dirty sockets.
Re:Not in Vista 64 (Score:3, Interesting)
Which is moot to everyone who does not require fancy-userfriendlyness.
WinZip and WinRAR can display the contents of an archive. It's not much of a jump to manually read the partition and display the contents in the same fashion - the only difference is that you write the code to work at the user level rather than a Kernel Level.
BTW, drivers need to be debugged somehow. From the site you linked to:
DRM is going to backfire big time. (Score:3, Informative)
True.
DRM is going to cost them their majority market share. The more they make things suck, the less people will want to use them. WMP 10 is an indicator of where things are going. Check out this satisfied customer's opinion of it [advogato.org]:
Then Digital Restrictions Management (DRM) started harassing me and asking to connect to the internet to check for licenses where none had been needed before. The worst part of this "upgrade" is how