Heavy bitlocker user here, and up until now assumed the first approach is what's going on; how do I verify which system is used, and switch to the former in a few words?
Do you need to type a disk encryption password into a Bitlocker-branded screen before Windows boots? Or alternatively are you required to insert a specific USB stick with a key file?
If so, you are using one of the more secure configurations. If not, you are using the less secure (TPM-only) configuration.
> how do I verify which system is used, and switch to the former in a few words?
Check whether you are using pre-boot authentication. BitLocker offers true encryption only if pre-boot authentication is used. Here's a tutorial: https://www.howtogeek.com/262720/how-to-enable-a-pre-boot-bi... More information on BitLocker's implementation details and its threat model can be found in Microsoft's documentation [0].
> On computers with a compatible TPM, operating system drives that are BitLocker-protected can be unlocked in four ways:
> TPM-only. Using TPM-only validation does not require any interaction with the user to unlock and provide access to the drive. If the TPM validation succeeds, the user sign in experience is the same as a standard logon.
> TPM with startup key. In addition to the protection that the TPM-only provides, part of the encryption key is stored on a USB flash drive, referred to as a startup key. Data on the encrypted volume cannot be accessed without the startup key.
> TPM with PIN. In addition to the protection that the TPM provides, BitLocker requires that the user enter a PIN. Data on the encrypted volume cannot be accessed without entering the PIN.
> TPM with startup key and PIN. In addition to the core component protection that the TPM-only provides, part of the encryption key is stored on a USB flash drive, and a PIN is required to authenticate the user to the TPM.
TPM-only is the default option, it's better than no security, but arguably insecure (depending on your threat model). TPM with PIN or startup key offers true encryption, they are not vulnerable to this category of attacks. But clearly, using a user-supplied key or PIN has its own disadvantage (which is why TPM-only mode was invented in the first place).
> On the other hand, Pre-boot authentication prompts can be inconvenient to users. In addition, users who forget their PIN or lose their startup key are denied access to their data until they can contact their organization’s support team to obtain a recovery key. Pre-boot authentication can also make it more difficult to update unattended desktops and remotely administered servers because a PIN needs to be entered when a computer reboots or resumes from hibernation.
If you have auto-unlock on your system disk, then by the time you get to the login prompt the key from TPM was already read and used to decrypt your disk. Any sort of auto-unlock is inherently less secure.
Thanks for the heads-up!