1

My personal laptop is very important for me, and I'm kind of paranoid with personal security. I want a way to block the BIOS Password from being reset, because anyone searching on internet how to recover it will do in a minute. Resumly:

  • set a BIOS password
  • be sure the password cannot be recovered and the BIOS is not accessed without the password.

I did not find anything about this question. My goal is to disable the pc if it is stolen.

  • Anybody who steals your laptop can just remove the hard disks bypassing any BIOS password ... – DavidPostill Jan 12 '19 at 20:23
  • Depends on the laptop, good ones store the bios password on a chip on the motherboard, changing hard drive will do nothing. – Moab Jan 12 '19 at 20:58
  • I do somewhat agree that it’s fruitless to try to make it impossible for someone to repurpose your computer. But if you consider the purpose the laptop is stolen and what will happen with it (traded for drugs, sold on Craigslist, etc), it’s going to become pretty useless for that purpose with some simple techniques. There are many laptops the BIOS password can not be reset on and it is getting to be that way more so. I would say don’t worry about that and instead encrypt your hard drive to protect yourself and set a system BIOS password on the computer to make it obviously unusable. – Appleoddity Jan 12 '19 at 21:14
  • So no concern of someone flashing the BIOS? – vol7ron Jan 13 '19 at 0:04
  • @vol7ron - BitLocker/VeraCrypt/LUKS are independent of a machine's BIOS. – Ramhound Jan 13 '19 at 0:31
2

Encrypt the drive - make it useless to anyone who steals it rather than try [& fail] to make it impossible for them to repurpose it. There is [almost] no computer which cannot be stolen & repurposed.

Your data needs to be stored in more than one location, so if a bad actor does get hold of one device, they have the device [which cannot be prevented] but they do not have your data.

0

@Tetsujin answer is almost correct. Unfortunately just encrypting the drive will not prevent certain ways of circumventing your system by planting trojans (as you claim to be paranoid)

The correct solution is to "encrypt your drive with a system that uses TPM" - Bitlocker, BTW, does this (but LUKS, and, to the best of my knowledge Truecrypt/Veracrypt don't by default). TPM ensures the integrity of the entire boot process and derives the unlock key from modifiable registers - meaning your data can't practically be accessed unless the master passphrase (kept away from the computer etc) or the regular password is known. Logging in to the BIOS and changing anything will invalidate the regular password.

Unfortunately making your computer unusable if its stolen is not possible - its pretty much always possible to reset to factory defaults - even if this means removing the BIOS/UEFI support battery.

  • I am not entirely sure, how your answer differs from Tetsujin's answer, outside of explaining that BitLocker will require a recovery key if the TPM is tampered with. Even when TPM is not used, BitLocker protected drive will be protected and inaccessible, until the passphrase is provided. – Ramhound Jan 13 '19 at 0:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.