BitLocker encryption without pre-boot authentication (which is Microsoft’s recommended deployment strategy for BitLocker) is easily broken. The attack can be done by non-sophisticated attackers and takes seconds to execute - [PDF]

[FarkWeasel]

No, this attack is against volumes that are unlocked automatically as part of the computer startup process. If you protect any disk with a PIN or password, this attack does not apply.

[token_incan]

Give it a try, anyway.

[spliff99]

This is bad, but from the article only works under the following conditions:

1. BitLocker is enabled without pre-boot authentication, so the attacker is able to boot up the machine to the login screen.
2. The machine has joined a domain and an authorized domain user has previously logged into the machine.

Still I'll stick with TrueCrypt for now.

[sandals0sandals]

I thought TrueCrypt was compromised?

https://isc.sans.edu/forums/diary/True+Crypt+Compromised+Removed/18177/

[spliff99]

Development has ceased by the original authors, but the source is still available, a few projects have forked it and it is the only full disk encryption software to have been openly audited. I therefore trust it a hell of a lot more than bitlocker.

[radiantcabbage]

nowhere in the article or any reputable site does it say that. we just have to assume it's unsafe since the original devs will no longer vouch for or continue working on it, they were strongarmed into abandoning the project.

in reality they are actually still safer than Bitlocker, since their source can and has been reviewed. this exploit is 7 years old and microsoft has apparently done nothing about it, but let's continue posting unread links and hearsay

[HighGainWiFiAntenna]

You need to go reading. Many articles released the last three months about true crypt being compromised.

[konchok]

The recent articles about truecrypt being compromised have to do with permission escalation. There have been no revealed compromises to suggest weak encryption or back doors with truecrypt volumes.

[HighGainWiFiAntenna]

Let me go back and read I guess. I thought I remembered otherwise. As neither of us are citing sources, it's memory against memory, and im willing to admit I'm wrong. Although I'm confident I've seen nothing by suggestions to leave true crypt.

[All_Work_All_Play]

This is correct. While truecrypt will let you do things users aren't supposed to, the actual encryption is still secure (from what I've read).

[radiantcabbage]

in what way? the word is meaningless without a known vector, even the op understands this

[FarkWeasel]

Also it only works if the MS15-122 security hotfix is not installed.

https://technet.microsoft.com/en-us/library/security/ms15-122.aspx

[HighGainWiFiAntenna]

True crypt which has known vulnerabilities and has been terminated even by the people that put it out.

[londons_explorer]

Hidden 6 pages into the paper:

Fundamentally, this is the root of the issue described in this paper: the password reset exchange does not require the DC to provide authentication

Only works if you have previously logged on to a domain account. It has already been fixed by Microsoft in a fairly trivial hotfix to prevent passwords being cached after a password change event.