Re: PSA: Veracrypt has pre boot authentication (& why it's better for older PCs)

Paul wrote:
> On Sat, 1/24/2026 10:17 PM, Christoph Heinz wrote:
>> On 25/01/2026 02:57, Maria Sophia wrote:
>>> which has uniformity and protection advantages over Bitlocker FDE.
>> 
>> Welche "Schutzvorteile" meinen Sie?
> 
> The Wikipedia doesn't have a good FDE article.
> 
>    https://www.seagate.com/ca/en/support/kb/full-disk-encryption-faqs-technical-support-205983en/
> 
> The information on WDC is thinner.
> 
>    https://www.westerndigital.com/en-ca/solutions/data-security/data-protection
> 
>       ... TCG SSC
> 
>       https://en.wikipedia.org/wiki/Opal_Storage_Specification
> 
> The topic does not inspire awe, if it is so poorly documented.
> 
> It might have advantages or disadvantages -- we don't know.

It's a bit confusing the questions being asked but I will try to answer:
 Q: Which protective advantages does Veracrypt have over Bitlocker?
 
VeraCrypt has several protective advantages over BitLocker, IMHO... 

The most important in my opinion is that VeraCrypt always uses pre-boot
authentication, so the encryption key is never released until the user
enters a password. This protects the drive even if it is removed and
attached to another machine.

BitLocker Home cannot do this because it relies on TPM auto unlock and has
no pre boot PIN. BitLocker Pro, Enterprise, and Edu can use a pre-boot PIN,
but only when the hardware has a supported TPM. Protection therefore varies
by edition and by hardware.

By way of stark contrast, VeraCrypt does not depend on TPM features at all. 

It works the same on Home, Pro, Enterprise, and Edu, and it works the same
on older machines that lack a TPM. That consistency makes VeraCrypt a
stronger choice for older PCs and for mixed Windows environments in my
humble opinion, where BitLocker behaves differently depending on edition.

To me, Bitlocker is a solution dreamed up by Microsoft marketing teams,
whereas VeraCrypt is a better FOSS solution designed for users who don't
want to be restricted by the arbitrary constraints Microsoft inserted.

It seems to me that the "brilliant" Microsoft marketing added several
seemingly random constraints to BitLocker that do not exist in the FOSS
VeraCrypt. These arbitrarily random constraints are confusingly tied to
product edition and hardware features rather than to the actual
cryptographic needs of full disk encryption that we users actually use.

1. Edition based limitations
   BitLocker Home cannot use a pre boot PIN at all. Only Pro, Enterprise,
   and Edu can use it. This creates different security levels depending on
   which Windows edition is installed, even when the hardware is identical.

2. TPM dependency
   BitLocker requires a supported TPM for its strongest modes. Older PCs
   or systems with early TPM versions fall back to weaker protection or
   cannot use certain BitLocker features at all. VeraCrypt does not depend
   on TPM hardware, so protection is the same everywhere.

3. Recovery key handling
   BitLocker defaults to storing recovery keys in a Microsoft account.
   This behavior is automatic unless the user changes it. VeraCrypt never
   sends keys anywhere and leaves all key management to the user.

4. Feature fragmentation
   BitLocker capabilities differ across Home, Pro, Enterprise, and Edu.
   The result is inconsistent behavior in mixed environments. VeraCrypt
   behaves the same on all editions because it does not rely on Windows
   features.

These constraints are not technical requirements of encryption itself.
They are product and platform decisions that create different security
outcomes for different users. VeraCrypt avoids these constraints by using
a single pre boot password model that works on all hardware and all
Windows editions.

In summary, Veracrypt is the solution that is designed by users for users,
while, IMHO, Bitlocker is a marketing abomination designed for MS lock-in.
-- 
My conclusions follow the simplest model that fits every known fact.