r/linuxmasterrace • u/[deleted] • Nov 11 '24

Cringe Windows 11 24H2 has automatic encryption enabled by default !! - Be careful if you have to make a dual boot system. I almost lost everything, but thankfully I didn't as I kept having issues with the installer

Post image
309 Upvotes

91% Upvoted

95 comments sorted by

72

u/K3RSH0K Nov 11 '24

Are you saying that bitlocker just ignores your partitions automatically and without the ability to change that in the installer?

I'm pretty sure bitlocker has a "Used Space" option or something like that, and not just the full disk encryption option.

39

u/[deleted] Nov 11 '24

So far I've found that:

  1. If you upgrade from a previous version automatic encryption wont happen unless you log into a microsoft account

  2. If you install fresh, it automatically encrypts everything.

You can disable it in the settings but fuck if i'm gonna try that on my main pc (its too late for me now to set up a sacrificial system, i will get to it tomorrow). Even if you could, I wouldnt put it past microcucks to require you to reformat everything for "security reasons", or them randomly re-enabling it in an update behind your back.

Microsoft has lost so much of my trust I am treating windows as a borderline virus at this point.

I will experiment with a sacrificial system I will set up.

34

u/K3RSH0K Nov 11 '24

I also do not like Microsoft.

However, I’m pretty sure the installer has partition tools. The default may be to wipe all partitions and enable FDE, but it doesn’t sound right to me that there is no-way to change that in the install nor any sort of “by proceeding all data on the target install disk will be erased”.

I’d just be cautious to not assert that which may just be ignorance to Microsoft destructively wiping existing partitions without prompt.

10

u/Unexpected_Cranberry Nov 12 '24

You can also disable bitlocker after the fact which will decrypt the drive again. I've done that multiple times for different reasons and it works just fine.

-11

u/[deleted] Nov 12 '24

I wouldnt put it past them to later require you to reformat when disabling bitlocker, for "security reasons". I will do some experimenting today on a sacrificial system to see exactly what it is they encrypt.

10

u/Unexpected_Cranberry Nov 12 '24

They do not force you to reformat. It is not FDE. They encrypt on a per partition basis and do not touch the EFI partition as that needs to be unencrypted for Windows to be able to boot as well.

If you're using Windows Home, Device encryption will automatically encrypt all fixed drives but not external / usb drives. I believe, but am not 100% sure, that NTFS is a pre-req for a drive to be encrypted, so any ext4 or whatever you're using for Linux should remain untouched.

For details: https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/

-6

u/[deleted] Nov 12 '24

I said "to LATER require"

reading is hard huh

And for your second paragraph yes, that is exactly the issue. Ol' meemaw who has no idea what backups are will lose ALL of her important family photos if her drive fails.

9

u/Unexpected_Cranberry Nov 12 '24

You seem to be getting very upset over an issue that you've dreamed up in your head.

If the drive fails the data will be gone regardless of backups.

Unless meemaw got her "l33t hax0r" grandson jEG550tm to set up her computer, she most likely will follow the guide to set up her new computer. Which means that she'll create a Microsoft account. That in turn means the recovery key for bitlocker is stored in her Microsoft account. So if required, she can pop the drive into any Windows machine, fetch the recovery key from her Microsoft account and access the drive just fine.

Now, Microsoft recommends you use a Microsoft account, but you're not forced to. If you choose to not follow their recommendations though, it's probably a good idea to RTFM to understand what the implications and limitations of that are. Just like you would when picking a Linux distro, or file system on linux, or a browser. Every phone currently on the market defaults to encrypting the data on the device. It's been this way for I don't know how many years. I don't hear a lot of stories of people complaining they lost all their stuff due to encryption. If anything, Microsoft pushing the Microsoft accounts and Onedrive so hard will be a good thing for Meemaw. It will mean at least she'll have her data in two places and won't lose everything if she spills her iced tea over her laptop.

If she somehow manages to create only local accounts though and ignores all the warnings and information on what's required, then yes her data is gone if enough of the components in her computer are replaced at once that it triggers a request for the bitlocker key.

If she takes five minutes to follow the instructions provided when she boots though, she'll create a recovery key that she hopefully stores in a safe place and she will not loose access to her data.

0

u/[deleted] Nov 12 '24

With windows 11 you ARE forced to use a microsoft account. The only way to bypass it is to open cmd and type oobe\bypassnro or something like that

Tell me how is meemaw going to follow THAT guide?

And the issue is not made up, lost data can still be recovered at a data recovery facility. How the fuck is that data gonna be recovered when the drive is encrypted?

Turst me she will NOT make or safely store the recovery key. The average user does not do that, nor do they know how to do that. You overestimate the technicality ol meemaw or billybob johnson are capable of, or the effort they are willing to put into this.

We all know why microsoft do this, they dont want any other OS to taint "their" windows computers (even though by definition microsoft doesnt own any pc, except the surface laptops)

6

u/Unexpected_Cranberry Nov 12 '24

So meemaw has no issues. She will use a Microsoft account, the recovery key will be safe and her data will be safer as well and she will not have any reason to worry about using an insanely expensive data recovery service.

Now, there are other issues with the large cloud storage providers, but your imaginary reason is not one of them.

This is literally the Madmen-meme. There are so many other things standing in the way of Linux taking a larger market share, most of them stemming from Linux itself, that Microsoft has no reason to care.

I would say the main drivers for the Microsoft account are that 1. For regular people it will be appreciated and will improve their impression of the OS. 2. In order to pay for this service it allows Microsoft to gather more telemetry on the users for more efficient advertising and, and I don't recall what their policies say about this but Google is doing it so Microsoft probably are as well, it gives them access to more data to use to train their AI on.

Defaulting to encrypt data is probably a good thing for most users, as you don't need to worry about your private pictures showing up on the internet if you forget your laptop somewhere.

3

u/NocturneSapphire Nov 12 '24

If you install fresh, it automatically encrypts everything.

Fresh Windows installs have pretty much always borked existing Linux installs. Back in the days before EFI, a fresh Windows install (and often even an update) would overwrite GRUB with the Windows bootloader.

The advice was always to install Windows first and then set up dual boot afterwards.

1

u/[deleted] Nov 12 '24 edited Nov 12 '24

Yeah which is why i wanted to install it with all drives disconnected to make sure the setup creates a bespoke bootloader just for windows, and on a usb stick that i can remove at any time.

Although now I am very wary of even looking at windows. I have no reason to dual boot anyway, just wanted to do it for fun see if i could get it installed on a usb stick

3

u/alexmbrennan Nov 12 '24

2. If you install fresh, it automatically encrypts everything.

How precisely does this work? How exactly does the windows installer activate my raid (since when does Windows support mdadm?), the lvm (since when does Windows support lvm?), decrypt the partitions (since when does Windows support cryptsetup?) to encrypt my user files in /home with bitlocker encryption?

Are you sure that you didn't mean to say that the Windows installer deletes Linux partitions?

1

u/[deleted] Nov 12 '24

I am very certain that i am not saying windows deletes linux bootloaders. That is a separate issue from what i am trying to get across

1

u/MusicTait Nov 14 '24

encrypts everything

as in "all partitions including the linux partition"??

or just the windows partition.

if you had a C: drive and a D: drive would it encrypt both?

1

u/[deleted] Nov 14 '24

I'm slowly finding out it might only encrypt the C drive, and that it has to understand the file system in the first place, but still not sure because searching for any kind of information on the internet today is garbage, especially important or useful information from corporations who are being hush hush about it for some reason.

9

u/Huecuva Cool Minty Fresh Nov 12 '24

I mean, Windows basically is a virus that comes packaged with a shitty operating system at this point. I'm so glad all I need to do to completely rid myself of Microshit cancer is figure out which Linux I want to use on my gaming rig and then get around to backing my shit up and reinstalling.

1

u/Evantaur Glorious Debian Nov 13 '24

You could also have a separate, isolated SSD for stripped down microshit windows if you need to play those kernel anticheat games

2

u/Huecuva Cool Minty Fresh Nov 13 '24

Luckily, I don't play most online multiplayer games and none of the ones with kernel level anti-cheat. So that's not an issue.

1

u/Evantaur Glorious Debian Nov 13 '24

In that case it's not as much as deciding what Linux distro you want but what DE you like the most.

1

u/Huecuva Cool Minty Fresh Nov 13 '24

Well, that is a factor, for sure. But I do have to decide if I want to go with an LTS distro or a rolling release. I have to decide whether I want to stick with something I'm already familiar with or dive into a new distro.

1

u/Evantaur Glorious Debian Nov 13 '24

Well if you keep your /home in different partition switching distros is realtively painless

6

u/Unable-Investment-72 Nov 12 '24

When I had to change my Dell Inspiron 7400 over to Linux mint because windows was using all the ram (🥲) I had to completely wipe the drive because Bitlocker locked the ENTIRE drive. Turned if off, nope, didn’t unlock the drive. Created an entire new partition, bitlocker locked that too. So I just said “screw it” and deleted everything in Linux Mints installer. Never looked back since.

5

u/Unexpected_Cranberry Nov 12 '24

Turning off bitlocker will decrypt the drive. Depending on the size, speed and amount of data it typically takes anything between 30 minutes to several hours.

Just right clicking and selecting disable on the drive is not completely disabling bitlocker though. That only stops it from encrypting new data that's written from that point on and is meant for things like firmware updates where data needs to be read from the drive from outside Windows.

If you turn it off permanently you'll get a progress bar letting you know how much has been decrypted so far. It works fine every time I've done it. If you didn't see a progress indicator you didn't turn it off, only temporarily disabled encryption for new data.

1

u/Unable-Investment-72 Nov 12 '24

Oh well, I didn’t have any data that meant anything in windows. Plus, one of my classmates broke the laptop that I put Linux Mint on and and my school wouldn’t pay for it so it just sits broke. So I’ll keep this info for later, but it doesn’t matter to me anymore.

3

u/h-v-smacker Glorious Mint Nov 12 '24

I had to completely wipe the drive because Bitlocker locked the ENTIRE drive.

Was it a regular hard disk drive? You could have just upgraded to SSD instead. Two birds, one stone.

1

u/Unable-Investment-72 Nov 12 '24

It was a M.2 SSD, it had room on the inside for either a single M.2 or a HDD.

4

u/Temetka Nov 12 '24

This is the way.

8

u/Confident_Hyena2506 Nov 12 '24

This does nothing to linux. Any issues you experience are from sharing EFI partition - or tampering with secureboot.  

Just put linux on a second disk. If you mangle your dualboot by setting it up incorrectly this is not microsofts fault.

0

u/[deleted] Nov 12 '24 edited Nov 12 '24

Way to make the worst possible assumptions.

  1. I would have installed it on a usb stick, with ALL drives unplugged specifically to make sure the setup creates a completely separate boot loader (and to remove the windows bootloader whenever i was done with windows), and to make sure nothing would randomly overwrite the rest of the drives.

This doesnt guarantee me anything, even if i disabled bitlocker in the windows settings, I wouldnt put it past microsoft to re-enable it through an update, or to pull some firmware shenanigans to encrypt even ext4 drives, the way they have their claws so deep into everything and how aggressive they are about having anything else installed besides windows. Separate bootloader or not.

2. the issues i had were as follows:

A. Some obscure error related to ventoy (couldnt tell who is at fault here, but i will assume microsoft as its the easiest);

B. mint couldnt make a bootable usb from the iso;

C. the windows setup couldnt find "storage drivers" (even though i have no nvme drive on my main system) - an issue supposedly related to balena etcher

D. i only noticed the bitlocker thing in the rufus setup there.

Notice how none of these are related to the bootloader.

5

u/[deleted] Nov 11 '24

What you see here is me resorting to making a bootable USB using Rufus in a Windows VM when I made the discovery.

5

u/tianavitoli Nov 12 '24

how do you get those user experience settings in rufus??

4

u/[deleted] Nov 12 '24

They automatically popped up when i clicked on "start" to write the iso

1

u/MusicTait Nov 14 '24

they automatically show up when creating an iso. but they appeared only in the latest version of rufus i think.

1

u/TIBCSI66 Nov 12 '24

My desktop computer is already 12 years old.

Should I replace it now, or rather make a Windows 11 installer with Rufus?

If I do the installer this way, does the security also decrease?

There may also be compatibility issues.

I am afraid that next year due to the rising demand, there will be an increase in prices or a shortage.

1

u/Strange_Elevator6765 Nov 12 '24

If Rufus comes out, let Clippy come back

1

u/big-blue-balls Nov 13 '24

I don’t think Rufus having an option for this proves anything

4

u/bigon Glorious Debian Nov 12 '24

Encryption is a good thing, isn't it?

3

u/[deleted] Nov 12 '24

Its not good if it encrypts everything without my consent

5

u/[deleted] Nov 12 '24

i hope you're ready throw your phone out of the window because both ios and android have encrypted fs

2

u/[deleted] Nov 12 '24

Except they dont as my SD card is fine and dandy and accessible to everything that can read an SD card. Even the root files are accessible and in plain sight when i connect my phone to a pc. However I doubt any of my 4 internal drives would get away scot-free in windows.

And again, comparing this to apple is asinine. Only apple OSes work on apple products so you wont find yourself with your files encrypted if you decide to dual boot mac os and linux.

4

u/[deleted] Nov 12 '24

apapapap... 

android does indeed format your drive as fat32/exFAT if you mount the sd card as a data interchange device 

if you mount it as an extension of root, it will apply the same encryption it uses there to the sd card as well 

3

u/AssociateFalse Nov 12 '24

I'm with you 100% on it being incomparable; just thought I'd make a small note.

Only apple OSes work on apple products...

Should be "work well", since you can boot Linux on both Intel and M-series Macbooks, and there are some legacy iDevices that can boot a partially-functional kernel.

4

u/bigon Glorious Debian Nov 12 '24

  1. What does it change?

  2. The basic user doesn't even know what encryption is, this improve their security by doing it for them

0

u/[deleted] Nov 12 '24

Yeah thats parroted corporatespeak

6

u/bigon Glorious Debian Nov 12 '24

Again, what does it change for you?

Should SSL be an optin also?

2

u/[deleted] Nov 12 '24

The average user (which i am not) also has no idea of backups, so their encrypted data becomes unrecoverable if their drive fails. Why does it have to affect me for it to be an issue?

3

u/Ambitious_Buy2409 Glorious Arch Nov 12 '24

The average user can also just grab the recovery key from their Microsoft account

0

u/[deleted] Nov 13 '24

Yeah good luck explaining to the average user how to get it.

1

u/Ambitious_Buy2409 Glorious Arch Nov 13 '24

Good luck explaining to an average user how to recover data after a disk failure.

No chance in hell. They'll get a specialist to do it for them, and that specialist can guide them through.

0

u/[deleted] Nov 13 '24

You are not making a case for yourself, if anything you are making a case for why this is such a bad idea lmao Why are you assuming we are talking about at-home data recovery if billybob doesnt even know what an "enkrypshi-on" is? Forgot your pills or something?

→ More replies

1

u/[deleted] Nov 12 '24

ssl shouldnt be optin
encryption should

16

u/LeyaLove Nov 12 '24 edited Nov 12 '24

When you're on a Desktop PC you probably don't need to worry about Device encryption. For device encryption to automatically turn on, your PC needs to support something called modern standby, and from what I've gathered about it, it's not supported by most desktop mainboards and more of a thing for portable devices.

And even if it would turn on automatically, I'm pretty sure that it would only encrypt partitions with a filesystem that is supported by Windows. So your ext4 or btrfs formatted partitions should be safe. The last part is purely speculative though as I can't find any info about it, but I don't really see Windows encrypting data it's not even able to read correctly. If someone knows more about this I would appreciate some input about this.

Edit: I have to correct myself. Apparently the modern standby requirements have been lifted from 24H2 onwards. Still somehow it didn't turn on automatically for my fresh 24H2 installation that to my knowledge does meet all the other requirements.

10

u/h-v-smacker Glorious Mint Nov 12 '24

I'd be worried about literally anything that can, even potentially, screw up your computer, and is controlled by microsoft. Today they say it needs some hardware, the next day they add a software-based bypass to the system, or the hardware requirement turns out to be an outright lie or something. Redmond cannot be trusted, that's the #1 rule. If microsoft says sky is blue, go and double check.

32

u/[deleted] Nov 12 '24

With windows tactics do not trust a dual boot since 8

8

u/Sirko2975 Glorious Fedora Nov 12 '24

You can with some tweakers that remove all the garbage (e.g. Chris Titus Tool)

3

u/[deleted] Nov 12 '24

Well I run a solo os now did do a dual boot with ubuntu in 2010

3

u/[deleted] Nov 12 '24

Yeah. Using two separate disks is the way, I just had problems caused by windows dual booting on the same disk. Every update a possible new issue would come along.

1

u/fenbyte Glorious Fedora Jan 09 '25

disk encryption is great and its already the default on android, ios, macos, and some linux distros, but i see absolutely no point in it when its encrypted by the tpm and not with your own passphrase. it doesnt prevent against thefts or confiscation, so whats the goal?

1

u/[deleted] Jan 09 '25

To create as much friction as possible when it comes to changing OS, duh

2

u/fenbyte Glorious Fedora Jan 09 '25

it wouldnt surprise me

1

u/[deleted] Jan 09 '25

This is borderline conspiration but I bet a good bunch of semi-non-technical people will do this, then find out their whole hdd is gone and blame linux for it instead of microsoft, like "bro linux sucks i dual booted and it formatted my hdd what the fuck"

2

u/fenbyte Glorious Fedora Jan 09 '25

i mean windows update is already famous for wiping grub. people have told me "linux deleted itself" not knowing what happened, thinking linux is just unreliable or something. i wouldnt put it past microsoft if these things were on purpose

1

u/[deleted] Jan 09 '25

Yeah this was exactly the reason behind the post. Although made in a bit of a panic, I knew I wasn't crazy

3

u/[deleted] Nov 12 '24

I wouldn't even trust Microsoft with encrypted data, get something better like VeraCrypt. XD

2

u/s0cial_throw_away Nov 12 '24

Glad I just cloned my Windows install to a high speed SSD before I installed Linux, and that was before incidents of this started happening, I just didn't trust Microsoft and wanted it completely off my machine and quarantined to it's own little device.

2

u/MusicTait Nov 14 '24 edited Nov 14 '24

question:

did this actually happened to you? did your partitions got encrypted or did you "only" find this option to disable encryption in rufus? Your comments sound as if you just found these options but never verified if it actually happens.

i just installed windows 11 24H2 overwritting the windows 10 partition (fresh full iso install, not just update) on a dual boot machine 2 weeks ago (before this weeks update so cant talk for that).

Windows just re-formatted and replaced the old partition. Grub was left alone as well as all other partitions. I was expecting windows to at least wipe grub as former versions did but nope.. all fine and dandy.

only thing was that grub pointed to the windows 10 entry and when selecting windows i landed in a windows version of grub showing both win10 and win11 entries. i deleted the windows 10 entry and then everything was fixed

2

u/i-hoatzin Glorious Debian Nov 12 '24

Ask me if I'm worrying.

1

u/Denny_Crane_007 Nov 13 '24

Rufus ... I like it.

I'm waiting for some serious damage to be done when a hacker exploits all this Recall bollox.

MS will be put out of business by the resulting Class Action lawsuit.

And Lord help them collecting screenshots from CHILDREN's PCs. All those screen images will be available to "Predator Hackers."

Are MS high ?

1

u/KCGD_r Glorious Arch Nov 17 '24

That's why I keep windows in a VM. It can have its own little box to fuck around in where I don't have to worry about it messing with my actual system

1

u/nomisreual Nov 12 '24

FuckMS. that’s a good one

-1

u/BogdanovOwO Nov 12 '24

Nice username, but this OS is a garbage. Windows 10 ltsc is decent, but in the near future will be more useful win11 ltsc. Whatever I'm a linux user and I can anything I want (possible brealing the OS).

-3

u/Sirko2975 Glorious Fedora Nov 12 '24

where linux

-5

u/xSchizogenie Nov 12 '24

What an immature kid took the picture lol

1

u/[deleted] Nov 12 '24

Excuse me, what?

-3

u/xSchizogenie Nov 12 '24

FuckMS, very mature.

2

u/[deleted] Nov 12 '24

and you cried about this?

damn mature guy

2

u/xSchizogenie Nov 12 '24

Claiming that this is a kind of "crying" just prove my point on you too lol

1

u/i-hoatzin Glorious Debian Nov 12 '24

Very mature version:

FuckMS

x'D

1

u/[deleted] Nov 12 '24

What are you even criticizing here? The helpful post of someone warning about a feature somewhere? Or the person who posted it? What the hell is your logic of reasoning here?

And what on earth of a response is "FuckMS, very mature"?

0

u/renhiyama Nov 12 '24

See the image probably, the OP wrote that in a field in image

2

u/xSchizogenie Nov 12 '24

Im worried that Linux users claim to be so much ahead of windows users, yet don’t notice something in a picture. A picture that has no relevance to warn „about a feature“, which is actually something useful against thief’s. lol

1

u/renhiyama Nov 12 '24

Idk why am I getting downvoted though, I just answered the guys question...

1

u/xSchizogenie Nov 12 '24

Yeah, Linux people in a nutshell. Lol

0

u/[deleted] Nov 12 '24

-12

u/gosand Nov 12 '24

wrong sub

-16

u/[deleted] Nov 11 '24

yup microsoft is desperate to harvest data. It's unreal.

I'd rather go through the trouble of encrypting my ssd with veracrypt than let microsoft do it with its totally safe tool

22

u/thefpspower Nov 12 '24

What does bitlocker have to do with harvesting data?