Slashdot Log In
Windows Vista To Make Dual-Boot A Challenge?
Posted by
Zonk
on Thu Apr 27, 2006 05:48 PM
from the have-to-raise-a-fuss dept.
from the have-to-raise-a-fuss dept.
mustafap writes "UK tech site The Register is reporting on security guru Bruce Schneier's observation that the disk encryption system to be shipped with Vista, BitLocker, will make dual booting other OSs difficult - you will no longer be able to share data between the two." From the article: "This encryption technology also has the effect of frustrating the exchange of data needed in a dual boot system. 'You could look at BitLocker as anti-Linux because it frustrates dual boot,' Schneier told El Reg. Schneier said Vista will bring forward security improvements, but cautioned that technical advances are less important than improvements in how technology is presented to users."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
And another EU Commision lawsuit in 3... 2... 1... (Score:3, Interesting)
Re:And another EU Commision lawsuit in 3... 2... (Score:5, Insightful)
Drive encryption is optional. It's something you may configure while setting up the system for systems carrying sensitive or important data. It's not like a standard Vista install automatically encrypts the entire drive. That would be ludicrous.
Bruce Schneier may be a brilliant security guy, but like every other person (and company) on the planet, he has an agenda. Don't automatically trust the guy telling you stuff because it's embarassing to the person he's telling you about.
Parent
Re:And another EU Commision lawsuit in 3... 2... (Score:5, Interesting)
Parent
Re:And another EU Commision lawsuit in 3... 2... (Score:5, Interesting)
Actually this feature is pretty much as set in stone as you can get. The guy writing the article knows little to nothing about bitlocker, especially baiting people into believing it has any anti-Linux intentions.
As for it being a real feature and as the person above posted, they are correct and it is.
I am truly looking at the help file for Bitlocker in Vista as I type this. (We have also tested BitLocker on several systems, it does what it is supposed to do, and it has to be enabled by the END USER, as their key/pin is used to encrypt the drive.
And lets say as a goof Dell did enable this feature, and assigned a key and pin to the person buying the computer, all you do is type in your pin for access and then turn BitLocker off. (It can be turned on and off for the entire drive quite easily once it has been enabled.)
It is 100% optional, and not something recommended for the average person, it also is not recommended for volumes that need to be access from another OS in a multi-boot environment, so just don't use it.
You do realize it even locks out WindowsXP if you are dual booting WindowsXP and Vista and you use BitLocker to encrypt your Vista partiion?
This is NOT an evil plan against other OSes.
Parent
What the hell are you smoking? (Score:5, Insightful)
No, just anti-dual-boot. Microsoft makes their product more secure
Sorry, but since when does dual-boot mean "less secure"?
How many viruses are going to be stopped by preventing dual-booting? How many trojans?
Yeah, that's what I thought.
Parent
Re:What the hell are you smoking? (Score:5, Informative)
How many viruses are going to be stopped by preventing dual-booting? How many trojans?
Yeah, that's what I thought.
On the other hand, if you can convince a locked down Windows XP box to boot a Knoppix CD, you now own that box.
I think that is what they mean by "more secure".
Parent
Re:Stupid (Score:3, Insightful)
Please explain to me how this is going to prevent you from dual-booting
Whatever...try fat32 partition (Score:5, Insightful)
Re:Whatever...try fat32 partition (Score:3, Interesting)
Yes... and what extra limitations on FAT32 can we expect in Vista?
Re:Whatever...try fat32 partition (Score:4, Informative)
Parent
Re:Whatever...try fat32 partition (Score:5, Informative)
Put this [fs-driver.org] on your Windows install and make your common data-storage area ext2 or ext3 instead. If you start slinging around large (>2GB) files on a regular basis like I do, you won't have to worry about splitting/combining files.
Parent
Re:Whatever...try fat32 partition (Score:3, Insightful)
Re:Whatever...try fat32 partition (Score:3, Informative)
Re:Whatever...try fat32 partition (Score:5, Informative)
Bitlocker is a whole-volume, hardware based encryption system (as opposed to file-specific techologies, such as Encrypted File System, which have overhead that requires a specific filesystem like NTFS. There is no filesystem specific overhead because it's transparent to the filesystem, and to the applications for that matter) -- there is no reason I am aware of for it to be tied to any specific filesystem, and it should encrypt FAT32 just as capably as NTFS.
Not only is this functionality optional, and requiring special hardware support, but it is a bonafide feature. The data of the world would be much safer if every laptop swiped, hard drive sold on ebay, and incident of unwanted physical access of machines couldn't give absolute access to every file on the machine.
Parent
Re:Whatever...try thinking right (Score:5, Informative)
Read: This has nothing at all to do with dual booting. Your ability to dual boot will remain completly unchanged, period. This, however, is about your ability to share data between OSs, not your ability to boot two. Learn to write a article headline, please.
FAT32 is dead. Period, get over it, dead. No, I take that back, it still has one use: flash drives, and other forms of removable media. Other than that, IT IS DEAD. Why? Simple: security. From Windows 2000 and on, Microsoft actually put some degree of effort into security. "Some degree?" you ask? End result, due to NTFS, you can actually secure your system. Compared to FAT32 anyways, where a *guest* user can drop a virus as c:\explorer.exe, and then the next time Johnny Admin logs in, it's over. NTFS added actual security measures. ACLs. Execute bit. And, well, quite a bit more. Due to this, I can say the following without doubt that I'm right:
1) BitLocker will ONLY work with NTFS.
2) Vista will do everything they can short of threatening to eat your children to get you to install on NTFS. (Side note: http://www.theinquirer.net/?article=30128 [theinquirer.net] vs. http://www.microsoft.com/technet/windowsvista/lib
3) If you're still using FAT32 as your primary OS partition, you're an idiot.
4) Due to #4, if your defense is, "my [windows] OS can't run on NTFS!", my response is still the same. Go upgrade, you're not helping anyone.
FAT32 is nice for removable media. That's about it.
(</troll>)
Parent
Re:FAT32 (Score:4, Informative)
Parent
Re:Whatever...try fat32 partition (Score:5, Informative)
Parent
Re:Whatever...try fat32 partition (Score:5, Insightful)
You know full well it isn't a bug. It's the same exact "feature" that has been shared by all in their OSes for the past 20 years. It's not in Microsoft's interest to make it any easier for users to stray from their ecosystem, so this intentionally designed limitation is not going to change.
Parent
Re:Whatever...try fat32 partition (Score:3, Informative)
i don't know if this is a troll or an actual problem, but how about you try -t vfat -o rw [die.net]?
Anti-competative! Predatory! Monopoly! (Score:4, Funny)
Don't worry, once Leopard comes out with Apple's own implementation of the Win32 API, no one will need Windows ever again.
Mmmuh-hahaha!
I dream of the day (Score:3, Interesting)
I really do. If it was me in charge, first thing I'd do - day one - would be to either hire people currently working on the Wine project, or hire a bunch of other qualified people and have them contribute to it. Get Wine working, then get it working well. Get a contract with Transgaming too - have them help. Imagine a Mac that played all the Win32/DirectX games! You wouldn't have an excuse then, right? Then, I'd dump all that work back into the FOSS community so others could benefit, and have a brilli
Re:Anti-competative! Predatory! Monopoly! (Score:4, Insightful)
Way to go there, migrating to a locked in proprietary platform. Oh, and on top of that, one that's crippled to only run on mandated hardware.
But Apple are hip at the moment, so it doesn't matter.
Parent
Huh? (Score:5, Insightful)
What you mean it could still be possible (Score:5, Informative)
Shocking.
Will it be possible to mount non-encrypted disks in Vista? Well, unless MS is finally prepared to kick backwards compatibilty then yes.
Even if unencrypted HD's ain't supported (unlikely) they would still need to support regular filesystems like FAT for all those flash disks from your camera and USB keys and such.
I am as anti-ms as you can get (if I am ever diagnosed with an incurable disease Gates gets a bullet in the head the next day thanks to my Halo training. Eh non-MS FPS training) but this is just to much. Linux disk encryption makes it just as hard for linux to dualboot windows. In fact every linux distro should just use FAT to make sure windows can be dualbooted and read the linux data.
Geez.
Parent
Re:What you mean it could still be possible (Score:3, Interesting)
Also, on the note of using FAT32 so both OS'es can deal with each other's file systems; there is a nati
Re:What you mean it could still be possible (Score:4, Insightful)
the filesystems used in linux are free and open. MS is more than welcome to implement support for them in windows without having to pay a dime. The same is not true of the reverse situation.
MS does not support reading and writing to linux filesystems by choice to stifle interoperability. They keep their filesystems closed to the same end.
Parent
Linux partition support under Windows (Score:4, Informative)
Indeed. And in fact you see a lot of implementations for windows of which a lot are based on the open-source code.
This shows that :
Meanwhile, the opensource community is trying [linux-ntfs.org] to play nice with Microsoft's OS.
Parent
Re:What you mean it could still be possible (Score:4, Insightful)
You're missing the point.
Even if the user is given a choice in the matter, are they going to understand that they're signing away their data to Microsoft?
That nice boy down the street that helped them recover their data with a reinstall so easily- are these fictional users going to understand that checkbox means their next screwup means their data is gone for good?
Linux disk encryption makes it just as hard for linux to dualboot windows.
No it doesn't. The bootsector and partition tables are most certainly NOT encrypted because then the system wouldn't boot.
In fact every linux distro should just use FAT to make sure windows can be dualbooted and read the linux data.
I've got a better idea. Instead of trying to convince all those distributions that you're right and their wrong, why don't you just try and convince ONE distribution- say Microsoft- that they should support ext3 and cryptoloop out of the box.
Parent
Wait... (Score:4, Informative)
Re:Wait... (Score:4, Insightful)
Tom
Parent
No Sign Yet (Score:5, Interesting)
News Just In: (Score:5, Insightful)
Encrypting a filesystem prevents arbitrary operating system from accessing it!
I mean — what the fuck?! — isn't that the whole idea?
Non issue. (Score:5, Informative)
http://www.microsoft.com/technet/windowsvista/sec
FileVault Anyone? (Score:4, Interesting)
Anyway, most dual booters that go between Windows and Linux already have dealt with these issues due to the unfriendly nature of NTFS.
It will only be in Enterprise and Ultimate Vista (Score:5, Insightful)
As much as we all love to bash Microsfot, I'm guessing it's an optional feature.
Has everyone gone mad? (Score:5, Informative)
Bitlocker isn't going to be compulsory, and as such it isn't going to affect dual booting in any way shape or form. It's certainly not the sort of thing your average home user would be setting up anyway (IMHO). Seems like Mr Schneier is a good old fashioned troll.
Some more info on Bitlocker here : http://www.microsoft.com/technet/windowsvista/lib
Re:Has everyone gone mad? (Score:5, Insightful)
Slashdot has long had a strong anti-MS bias. Fine, they've never made a secret of it. Recently however, they've started to allow it to warp the facts, which is not fine.
Sure, this may well make dual-booting more difficult, in that you won't be able to get at your data. Ever tried getting at data on an NTFS partition with Fedora? ZOMG! Fedora is trying to lock out Windows!
I've been here a long time, and it's sad to see how the site has declined from a site you could trust, to one that will print almost anything as long as it bashes MS or praises FOSS.
Parent
That's it. I've had enough. (Score:3, Insightful)
Now if I also can't dual-boot then that's the last straw to drive me to a linux-only system.
And before anyone suggests it, no I don't want to be running Linux under a Microsoft VM.
We're getting good at FUD too! (Score:5, Informative)
First of all, vista won't have this activated by default. Here's how you can turn it on in Vista Beta:
http://www.microsoft.com/technet/windowsvista/lib
And yes it will make any data encrypted in this manner unavailable to another operating system. It does this by using TPM (Trusted Platform Module) in the BIOS and can base the key on the kernel and optionally: just the bios, a user supplied key, or a USB drive supplied key.
This allows for the option of encrypting/decrypting data from the very start of the boot process. And guess what? It's being implemented in linux too!
http://lwn.net/Articles/144681/ [lwn.net]
BitLocker from windows is just a kernel based drive encryption software that takes advantage of TPMs just like the linux system. If you're concerned about cross platform compatibility then use user space encryption rather than kernel space encryptiong. If you're that concerned about secure keys then don't dual boot! If you love dual booting and don't care about encryption at all, noone is going to beat you up and make you use encryptiong.
You may remove the tinfoil hat.
--David
Shame on you (Score:5, Insightful)
A company plans to include a very useful encryption tool with it's next OS.
This is good news in terms of security and privacy, and therefore /. readers will welcome it.
Oh wait, no they won't, because the company is Microsoft. Microsoft is baaad, therefore everything they do is sinister and evil. You people always manage to find the dark lining to their every silver cloud.
It's the herd-mentality at work, folks.
Yawn.
Bitlocker does NOT prevent dual booting (Score:5, Informative)
Duh (Score:5, Insightful)
That is the entire point of Bitlocker; Encrypt the drive so only the encrypting OS can decrypt it. Bitlocker would be rather pointless if any OS could read the encryped drive now wouldn't it?
Even if you move the bitlocked disk to another Vista machine, that machine wouldn't be able to read the disk without the decryption key, which I severly hoped you backed up.
We're dreading this feature in Vista becuase if its anything like XP encryption and it's easy to turn on, there's going to be a lot of unhappy students when we tell them "Your hard drive crashed and all of your files are unecoverable becuase you encryped the drive"
Re:Duh (Score:3, Insightful)
Most IT dept's do NOT want to deal with this thing. Encryption is nothing new for MS. They've had it since Windows 2000 but almost no one uses it. Why? because there is absoletly no easy way to do any kind of disaster recovery on an encrypted NTFS drive unless you have a Domain policy which supplies an encryption key from the server, and even then it's a pain to recover unless you added execption policies (think backdoor)
Re:Problem is secret algorithm (Score:3, Interesting)
Frankly, I don't see this being a big problem for Linux because MS encryption never goes to far in any company. NTFS encryption has been around since 2000 and I've yet to see a company swear by this system. This is going to be used by people who are paranoid about what's on their drives over recovering that said data and thats basicially it, and frankly this group w
Not just dual-booting... (Score:3, Funny)
I just don't get it, Part III (Score:3, Informative)
Mickeysoft can't stop anybody from boting anything. THe boot process is handled by the bios and the boot sectors on the disk, which can't be encrypted unless the bios cooperates.
If the bios cooperates, it still has to be able to read said boot sectors, and if it can read windows boot info, it can read linux boot info, or anything ELSE you want to put in there.
So "difficult to dual-boot" is as far as I can tell, CRAP.
As for sharing data between the two systems
Re:Experience with Bitlocker (Score:5, Informative)
Also, Bitlocker is only available on Vista, so are you saying you're running your production users on the Vista beta?
The final straw came when one employee lost several hours work when Bitlcoker suddenly had an error reading from our intranet file server and corrupted his project.
Bitlocker doesn't affect files read from network locations, it's merely a hard disk encryption technology. I think you're confused about what Bitlocker is.
Parent
Re:It's not a big deal (Score:3, Interesting)
I still use Windows XP at work because I have to, but recently several of our tools have migrated to platform-indepe
Re:Not only dual booting (Score:3, Informative)
Your wish is granted. Open certmgr.msc or add the Certificates snap-in to a mmc window. Your personal keys are located in the Personal\Certificates folder, including the one for EFS (note that there won't be an EFS c
Re:Not in Vista 64 (Score:3, Interesting)
Which is moot to everyone who does not require fancy-userfriendlyness.
WinZip and WinRAR can display the contents of an archive. It's not much of a jump to manually read the partition and display the contents in the same fashion - the only difference is that you write the code to work at the user level rather than a Kernel Level.
BTW, drivers need to be debugged somehow. From the site you linked to: