Entering BitLocker PIN: keyboard shows up but doesn't work

[Ahiru]

Hi,

I have enabled BitLocker in Win10 x64 and entered a PIN for system unlock at startup. Of course it works great with the physical keyboard attached, but not so as a tablet. If no physical keyboard is present a virtual keyboard should show up to enter the PIN. It does show up when I touch the text box, as seen in the photo below, but it doesn't respond to any key press. It just sits there, static and oblivious to any input.

It must be a bug in the UEFI, as this is not a keyboard provided by Windows (ths OS hasn't even started at this point). Is there any chance of HP fixing this? The keyboard is there, so the functionality was thought into this device, but it's broken. I guess very few people actually care to encrypt their devices and even less to set up a PIN, it was probably an overlooked bug.

Anyone had this issue on this or any other touch enabled device? If you use BitLocker, do you have a working virtual keyboard?

[IT_WinSec]

Hello,

Welcome and thank you for posting in the HP Support forum.

I work in a security team and I deal with encryption software and others. What you see if very common problem - I have seen similar issues on various tablet devices from various vendors with lots of encryption programs. Yes, you are correct, it usually is some incompatibility with the BIOS/UEFI.

What I (and most my colleagues configure) and what I generally recommend is people NOT to use active preboot authentication screen for their encryption software - when the device is tablet with not physical keyboard.

So, workaround 1:

- Disable PBA screen for Bitlocker = stop PIN authentication and leave it boot authmatically to Windows relying on TPM only.

On theory, this is less secure option but practically, it does requires resources and time on a tablet to be broken.

Workaround 2:

- Disable PBA screen for Bitlocker = stop PIN authentication .

Not applicable for all tablets and not available in any device - Enter the BIOS/UEFI and if possible activate the BIOS power on password - everytime the device boots from the internal "SSD" device, it will ask you for a password. This is not the encryption password but is also ~secure and acts like a PBA. Not sure for your device but you may try.

Potential solution :

Try to upgrade the BIOS - may be you use an old version ?  You can download it from the HP support site or better use HP Support Assistant to check for BIOS/UEFI updates >> http://support.hp.com/us-en/document/c03467905

[Ahiru]

Hi,

Sorry for the late reply. I like the BIOS power on password, in fact I adopted it as a workaround. It's a pretty good solution it seems. Windows is using Bitlocker with TPM, so the only way to read the disk is with this same machine BIOS/TPM combination. And if the BIOS asks for a password the only way to get around it would be re-flasing it. But if you do so the TPM keys are gone and the disk is left unrecoverable (unless you have the key Bitlocker asked you to save in a txt). Is this correct?

More than anything, without the BIOS password you can't do anything unless you take out the chips and read them somewhere else.

Not that I have data THAT sensitive, but if the resources are available why not use them to remain secure? Even if all I have are naughty pictures with someone (?)

Well, now to what's actually interesting. I liked this little device so much that in another of my travels I found the "same" one with a 64GB disk at the same price I payed before for 32. I grabbed it in a heartbeat and put the other one for sale.

The "same"... or not. It turns out that HP has 10 or 20 models of this same notebook/tablet. When I tried the BIOS update I used on the first model on the new one, it said it was not compatible. I then searched HP for the exact model and surprise surprise, they didn't bother AT ALL to post drivers or BIOSes for this "different" model. Nothing. Just a message to go f... yourself. Mad at first and swearing not to buy HP again I contacted the support by Facebook. Not any help at all, so I went and searched mighty Google. There I found about the gazillons models of this "HP X2 210", "HP Pavilion X2" or whatever you fancy call them. Some models have nothing, others a little software tool and others have the full selection of drivers and BIOSes. I started trying them one by one and voila, one of BIOSes worked and updated from F04 to F11. The drivers are all the same of course, the components are the same across the models. The only real differneces must be the eMMC and RAM capacities (actually I checked with HWInfo and the mainboards designations on my two devices are different, also despite having both 2GB DDR3L 1600, the one I just bought has faster timings).

Now, back to the original issue of this thread. I tried the Bitlocker PIN with this BIOS' virtual keyboard and... IT WORKS! Well, mostly. The keys act kinda erratic. With a single press of a key it sometimes registers two inputs, so you get the same letter twice. You have to press each key as if a butterfly posed on it. The Caps lock key engages and disengages itself several times with a single press. You have to try a couple of times to get upper case function. And the shift key simply does not work. The upper case letters show on the keybord but a lower case is entered instead. Still, if you use it to input numbers or lowercase it works more or less acceptable.

Both models are on their lastest BIOSes, the first one on F4 and the second on F11 (it appears to be a higher version but the release date is before the F4 on the other). The keyboards are now CLEARLY a bug. On one model it doesn't work at all, on the other it works with some issues. Would it be possible to pass this to the people developing the BIOSes? Tomorrow I'll post the exact models and the numbers of both machines I have, I don't have them at hand now. As I'll sell one I'm mostly interested on the other one. Still, now I use a combination of BIOS and Winodws picture password so this isn't a very terrible situation. One I type, the other draw on the screen, they work well together and don't feel like a burden.

And another thing, a brightness setting would be a KILLER feature to introduce. Before the Windows driver takes control of the brightness it's always at full blast. Having to type the password on the Bitlocker blue screen makes you blind (the BIOS one is mostly a black screen fortunately). It's also a pain when installing Windows and doing anything before the driver takes control.

A simple setting in the BIOS between 25, 50, 75 and 100% would be perfect. So from the very start the screen doesn't kill your eyes in interiors or worse, in dark places. 50% would be a perfect all-around setting. I know this won't be done for this model, but where can you suggest this to HP for future models at least? For all notebooks in general. This is assuming the BIOS can or can be made to control screen brightness.

P.S.: The Windows I installed on my recently acquaired model is from a new Redstone ISO. On the old one I still have TH2 or something from back then. As I have to format it for selling, I'll try Bitlocker again when I install from the same Redstone ISO. Just in case the issue is actually caused by something in Windows 😛

And now that I found the new F11 BIOS for my model I'm happy again. I'll buy HP in the future.... but first I think I should closely check the actual models to see if mine will have drivers or proper updates (it's still a bit of a lottery if you have to try the updates from other similar models) <_<