Hacker News Reader

Comment by f233f2 | Hacker News Reader

It's absurd that this web site is advocating for people to disable bitlocker.

Also there is no source for the 45% figure.

The sources are their own tests described further down in the article. It mostly describes slowdowns of between 0–20%, but does say:

> But the critical aspect is that software BitLocker dropped random write performance by 45% compared to hardware BitLocker.

I don't think consumers are engaging in a lot of sustained random writes. On the other hand, it might be a reason to avoid software encryption on a database server with a lot of writes.

> I don't think consumers are engaging in a lot of sustained random writes.

Let me introduce you to Windows update. It is both random and sustained permanently.

Windows Update must be such an energy hog, if you consider it across all users globally. I wonder how many MWh it consumes per year?

Ha, good point. Definitely wasn't thinking of OS updates.

Though if those are (hopefully) applied overnight, speed doesn't really matter.

Overnight...

https://www.google.com/search?q=windows+update+forces+random...

Yikes, so sorry. I'm on a Mac, and while they certainly have their own share of problems, at least it's not that specific one.

TIL that second tuesday every month is random.

They show graphs of their tests with PCMark 10 Storage and Crystal Disk Mark. Using Crystal Disk Mark to test random 4k writes and they are massively slower when using software bitlocker.

I'll do what I like on my own computer, thank you very much.

No one said you can't. And no one said people can't debate the issue.

FDE is overrated, most leaks are not "someone stole my laptop" but "user clicked malicious links" ad other stupid stuff like that.

And it is also entirely useless for good amount of data volume-wise on machine.

I never need video game files to be encrypted for example. It's entirely waste of power and CPU time to do it.

If an unencrypted laptop is lost or stolen you have to assume all the data on it is compromised, send breach notifications to affected customers, etc.

But this is just Windows 11 Pro, though, not Enterprise. I guarantee you gamers (who are probably a big contingent of people who buy Pro but not Enterprise) are going to be turning this off so fast.

I’m a gamer and have it on.

Everything is unnecessary until you need it.

Why pay cops if I’m not being murdered or robbed?

Why keep nukes behind launch codes, nobody’s trying to launch them?

Why eat every day, I don’t start to die until like 3 days in…

> Why pay cops if I’m not being murdered or robbed?

Why pay cops, they're already being bribed by criminals (batman, punisher, etc cops anyway :D )

> Why keep nukes behind launch codes, nobody’s trying to launch them?

Because if you get rid of launch codes you'll decimate the Hollywood Political Thriller movie industry

> Why eat every day, I don’t start to die until like 3 days in…

Why do you hate farmers?

You've got closer to a month or more with no food. Starving takes a long time, halfway starving even longer. Water is what takes three days.

Ah shit you’re right. I didn’t study biology because I didn’t need to operate on myself, so it was unnecessary.

If someone breaks into my car and steals my laptop I can sleep better with bitlocker on. Has nothing to do with the clicking links or not.

Only if you shutdown. Otherwise tpm is still in memory and everything is unlocked. Going off how many people compliance have to chase to restart for updates, a lot of people think sleep is fine

Your average thief has no idea how to get into a system which asleep but screen-locked. FDE means your machine gets wiped and resold, or sold for parts...but your data on the system remains private.

Better maybe, but you'll never sleep well if you leave your laptop in your car. In fact, none of us can park in peace because people leave laptops in vehicles.

Correction: none of us can park in peace because the state does not punish those who break into cars to steal laptops severely enough.

It’s a political problem not a technical one.

Why is your laptop in your car without you?

FDE is not overrated and should have a 0% impact on performance if your CPU has AES instructions.

Modern CPUs can do AES faster than your SSD, sometimes faster than an NVME can read/write

That's not how you asses performance at all. Maybe you can saturate the NVMe link with AES in idea circumstances, but you may be killing memory mapping and churning I$.

To say anything interesting about performance on these modern machines, you would have to benchmark some real workload.

5 year old CPUs (Intel i7-6700, for example) do 2.6GB/s.

https://calomel.org/aesni_ssl_performance.html

First gen Ryzen (similar age) does 8.2GB/s, which is faster than PCIe 4 NVMe drives.

https://www.vortez.net/articles_pages/amd_ryzen_7_1800x_revi...

Somewhat recent intel i7-12700H does 14.8GB/s, which is about the limit of PCIe 5 NVMe drives.

https://www.notebookcheck.net/Intel-Core-i7-12700H-Processor...

Edit: here's a list of AES speeds via truecrypt. top of the charts is the Ryzen 9 7950X at 32GB/s.

https://www.notebookcheck.net/Benchmarks-and-Test-Results.14...

Thank you for looking up the most recent performance numbers. People have no idea how incredible they are and how "free" FDE has become.

How much does this affect other processes happening at the same time? If I'm playing an open world game that streams the environment off the ssd, how much is this going to contend with my cpu issuing draw calls, doing physics calculations, etc.

Speaking of which, software that doesn’t use the AES-NI instructions is becoming glaringly obvious because the performance difference is so huge.

In the era of mechanical drives and 2 Mbps “broadband” nobody would notice. Now with SSDs and gigabit home internet, people do notice but vendors are still pretending they can just ignore the need to offload encryption.

VPN products and IPsec especially is almost always a disaster in my experience.

When evaluating any kind of network security product like a virtual WAN appliance, tunnel, or whatever, check the throughput. If it can get tens of gigabits for a single stream then it is using some sort of offload. If it seems to hit the wall at around 1.5 Gbps per core, do not buy.

AES instructions still fill CPU's time regardless of how fast they run

Doing 2.6GB/s in single thread means you have one core less to use...

I run FDE on all my machines, encryption and sector sizes are aligned, I can still do a 3000MB/s IO no problem. Doesn't affect anything I'm running, even databases like Postgres.

AES-NI is not 100% offloading. It only offloads the heaviest parts.

The penalty is not huge especially compared to fully software implementations but it's not zero. And it takes memory bandwidth too.

I don't use FDE on my gaming system for this reason. It's a big heavy PC that never leaves my house with not really any personal data anyway.

It's not if you do any meaningful work on it.

FDE's purpose isn't just to prevent you from pulling a disk out and imaging it to get all the data. It also makes it far quicker to do disk wipes. If someone yanks your laptop you can have the IT guy wipe it in a minute or two. Without FDE, whatever bossware is enforcing the device management would have to actually overwrite every sector of the disk, which can take hours and would be extremely noticeable to anyone extracting data off the machine.

Moreover, SSDs cannot be 100% erased, as not all capacity is user-addressable at any point in time.

Why would it need to wipe every sector of the disk? As ilyt stated, there's no need to encrypt game files. There's also no need to wipe them. Just the directories where important data resides.

FDE means you don't leak data to unencrypted parts of the file system. Temporary files and browser cache are areas sensitive information can be inadvertently left behind. With FDE you can check off the box "encrypted at rest" without having to qualify it with asking if the data is in the right folder or vault, if temp files are overwritten, etc.

Right. But technically "every sector of the disk" isn't necessarily what bossware needs to wipe if an unencrypted laptop is taken. Only eelements which allow access to crown jevels, relevant credentials, etc.

I'm an advocate for FDE across the board (literally all of my devices are on Windows 11 Pro, primarily so I at least have access to Bitlocker across the board), but it's disingenuous to claim that the only alternative to FDE when a device is taken would be to initiate a sector-by-sector wipe. He was responding to ilyt's comment about how only certain data is worth encrypting on pretty much every personal device (and we are talking about Win 11 Pro, not Enterprise).

It is simpler to encrypt all than to pick and choose which partition to store your files.

We're not talking about what's simpler. The conversation was clearly focused on efficiency.

Reply on news.ycombinator.com