I got this query while distrohopping. On Linux I have to enter my password erveytime I boot to decrypt the disk. But on windows I never had to do it. The first time windows bitlocker asked for password was when I booted into windows after installed Linux. Why is it so?
Ask yourself a different question:
What is the point of encrypting the drive if your computer decrypts it automatically?
Are you really worried about the case where a thief steals the hard drive but not the rest of the computer?
Even if the thief steals the entire computer, BitLocker/LUKS and SecureBoot provide a reasonable level of protection against data theft. Yes, the drive (or bits of it anyway) are automatically decrypted (the whole drive is never decrypted, just the data requested by the OS). However, it still prevents the attacker from accessing that data outside the intended operating system, which makes data theft much harder. An attacker would also need a valid account to login to the system to start accessing data. It’s not an insurmountable hurdle, but it does mean that just having the computer isn’t the same as having the data.
Without encryption, once a thief has the computer, they have the data. They don’t need a valid account to access the data and they can even boot into a tool to reset passwords on the primary OS and start using it. Last I checked, chntpw still works with Windows 11. That sort of thing fails with encryption, even with TPM only. The TPM will not release the encryption key to an OS if SecureBoot fails. Granted, there is the YellowKey backdoor, but that was probably Microsoft giving the FBI a helping hand. But, that falls outside the intended design.
Wouldn’t that data be inaccessible if encrypted? You would still need to login to access it. You wouldn’t be able to drop the drive on another machine if it’s encrypted.
Every once in a while a security researcher will highlight a new method for obtaining the key from the TPM, usually by tapping into the I2C comms between it and the CPU. They’ll say it’s ‘trvial’ and can be done ‘in seconds’, but that’s only after a lot of work figuring out that particular motherboard.
A few months ago there was yellowkey that just needed a special file on a USB drive to bypass bitlocker, making it so easy that it was arguably a backdoor.