Comment on Microsoft gave FBI a set of BitLocker encryption keys to unlock suspects' laptops: Reports | TechCrunch

empireOfLove2@lemmy.dbzer0.com ⁨3⁩ ⁨weeks⁩ ago

• dual_sport_dork@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

  They don’t have a copy of every single Bitlocker key. They do have a copy of your Bitlocker key if you are dumb enough to allow it to sync with your Microsoft account, you know, “for convenience.”

  Don’t use a Microsoft account with Windows, even if you are forced to use Windows.

  source

  • tabular@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

    To use Windows without a Microsoft account requires tech literacy these days, I thought. I would not be suprised if users didn’t choose to sync with a MS account but it’s doing it anyway, if that’s what MS want.

    source

    • dual_sport_dork@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

      If you sign in with a Microsoft account at all I don’t believe there’s the capability to opt out.

      I only use local accounts. I have never had a Microsoft account. I never will.

      source

      • suicidaleggroll@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

        You can’t do that anymore, at least not with a normal Windows installation. All of the tricks of forcing it offline, clicking cancel 10 times and jumping up and down don’t work anymore, they’ve disabled them all, the only way to install Windows 11 now (using the normal Microsoft installer) is by linking it to a Microsoft account.

        source

        • -> View More Comments
    • Feyd@programming.dev ⁨3⁩ ⁨weeks⁩ ago

      I’m not even sure if you can install without an MS account if you don’t use Rufus anymore. Rufus requires literacy for sure, and even if you can still do it without it is designed to make it impossible to know you can from within the installer itself.

      source

      • conorab@lemmy.conorab.com ⁨3⁩ ⁨weeks⁩ ago

        Main issue with Rufus is secure boot unfortunately, otherwise Rufus is easy enough that I gave a couple “click here, then here, then here and here are some screenshots” to a friend they were able to navigate it just fine. At this point I swear Rufus is easier than using the official installer provided Secure Boot is off.

        source

        • -> View More Comments
  • DeathByBigSad@sh.itjust.works ⁨3⁩ ⁨weeks⁩ ago

    Encryption doesn’t actually complete until you log in with a Microsoft account for Home Edition.

    Anyways: Use Veracrypt.

    Or just Linux + LUKS

    source
  • lemmyout@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago

    It’s a bit harsh and unfair to say “you are dumb enough to allow it”. Microsoft makes it damn near impossible to avoid this unless you are extremely particular and savvy about it, and never have an off day where you make a mistake while using your PC.

    source
  • realitaetsverlust@piefed.zip ⁨3⁩ ⁨weeks⁩ ago

    Don’t use a Microsoft account with Windows

    Ftfy

    source

    • 3laws@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

      Don’t use a Microsoft account with Windows

      FFTFY.

      Bethesda anything, Azure, Outlook, GitHub, Visual Studio, Office, Bing, XBox, LinkedIn, SharePoint (so disgusting this is a given), fuck it not even Skype (lmao what year is it?)

      source

      • realitaetsverlust@piefed.zip ⁨3⁩ ⁨weeks⁩ ago

        Still kinda hurts they own Bethesda now, but considering that company has only produced garbage since FO4 which only was kinda mid, I don’t even mind skipping them.

        source

        • -> View More Comments
    • quips@slrpnk.net ⁨3⁩ ⁨weeks⁩ ago

      Literally fix the anticheat problem and I’ll uninstall.

      source

      • realitaetsverlust@piefed.zip ⁨3⁩ ⁨weeks⁩ ago

        The anticheat problem already is fixed. It’s called “don’t play games that don’t support your choices”. These days, no game is worth being put through all that AI bullshit.

        source

        • -> View More Comments
      • DeathByBigSad@sh.itjust.works ⁨3⁩ ⁨weeks⁩ ago

        Dualboot, don’t store sensitive files in windows?

        (Although I’m having a bit of trouble trying to do dualboot myself so… idk lol)

        source

        • -> View More Comments
  • empireOfLove2@lemmy.dbzer0.com ⁨3⁩ ⁨weeks⁩ ago

    They do have a copy of your Bitlocker key if you are dumb enough to allow it to sync with your Microsoft account, you know, “for convenience.”

    Which I don’t believe is the only way it can leak. It’s well known Microsoft can access anything and everything on an internet connected Windows PC whether there’s a Microsoft account or not. If the nazi’s push for the device of someone on a local account only, you know they’ll magically find a way.

    source
  • goferking0@lemmy.sdf.org ⁨3⁩ ⁨weeks⁩ ago

    But, by default, BitLocker recovery keys are uploaded to Microsoft’s cloud, allowing the tech giant — and by extension law enforcement — to access them and use them to decrypt drives encrypted with BitLocker, as with the case reported by Forbes.

    I mean it’s dumb to sync but at same time it’s not like MS isn’t great at either making it almost impossible to not sync it re-enable syncing for a bit after updates.

    You can constantly tell it not to sync but all it takes is MS saying we want it now and they’ll get it

    source

    • Pika@sh.itjust.works ⁨3⁩ ⁨weeks⁩ ago

      Whats dumb is this issue is very easily resolved by encrypting the users security pin or password against the bitlocker keys and then only storing that.

      or better yet have the pin/password an isolated thing from the microsoft system, so when a key gets uploaded, it requests the recovery pin, and if the pin matches it uploads, otherwise it states invalid pin and offers to change it while warning that it will remove existing keys, then optionally next time a system whom contains a drive with an identifier (which wouldn’t need to be encrypted only the key) goes online, it can prompt the user “note: due to recovery pin, this drive recovery key needs to be backed up again, would you like to do so?”

      source
  • iterable@sh.itjust.works ⁨3⁩ ⁨weeks⁩ ago

    Save a copy of your bitlocker keys to a Veracrypt drive with a password no shorter then 15 mixed characters. Then upload that encrypted container to any free service. They wont be able to open it and now you have a remote backup copy.

    source

    • dual_sport_dork@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

      I employed the super secure expedient of never exporting my keys. I have no idea what they are, I never did, and I never will.

      There’s really no irreplaceable data on my Windows machine. If I have to reformat it some day A) that’s no big deal, and B) it’s Windows, what else is new.

      source
    • wischi@programming.dev ⁨3⁩ ⁨weeks⁩ ago

      Why not save a step, fuck bitlocker, and use veracrypt to encrypt your drive in the first place?

      source

      • Nyx0r@discuss.online ⁨3⁩ ⁨weeks⁩ ago

        Why not save a step and don’t install Windows in the first place.

        source

        • -> View More Comments
      • iterable@sh.itjust.works ⁨3⁩ ⁨weeks⁩ ago

        That is a option but it’s performance is bad and you need at least fifteen mix character password every time you boot. If you game you need to use bitlocker sadly or load times dive hard. Having a second drive in full Veracrypt is fine for things like basic documents but not to game on.

        source
    • Wispy2891@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

      If the password is long 15 characters that means you use a password manager. At that point just put the bitlocker password in the password manager

      source

      • iterable@sh.itjust.works ⁨3⁩ ⁨weeks⁩ ago

        nope use password sentences easy when you make it a sentence you can remember

        source
  • JustEnoughDucks@feddit.nl ⁨3⁩ ⁨weeks⁩ ago

    Are you naive enough to believe the surveillance OS that uploads literally all of your activity along with screenshots of your desktop doesn’t automatically upload you keys no matter what little box you tick on the installer?? 😂 there is absolutely not one single 3rd party auditing that they actually follow any of the options at all that they give.

    source
  • obinice@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

    Why is that dumb?

    I encrypt my drive to protect my data from burglars and thieves who might steal my laptop, how would they obtain the recovery key from Microsoft? O_o

    source
  • Tollana1234567@lemmy.today ⁨3⁩ ⁨weeks⁩ ago

    i heard win11 its automatically used online for home.

    source
• bw42@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

  No they do not have copies of every Bitlocker key.

  Bitlocker by default creates a 48-bit recovery code that can be used to unlock an encrypted drive. If you run Windows with a personal Microsoft account it offers to backup that code into your Microsoft account in case your system needs recovered. The FBI submitted a supoena to request the code for a person’s encrypted drive. Microsoft provided it, as required by law.

  Bitlocker does not require that key be created, and you don’t have to save it to Microsoft’s cloud.

  This is just a case of people not knowing how things work and getting surprised when the data they save in someone else’s computer is accessed using the legal processes.

  source

  • user28282912@piefed.social ⁨3⁩ ⁨weeks⁩ ago

    Except that Microsoft basically puts a gun to every users head to login with a Microsoft account which can/does backup the recovery keys.

    source

    • Agent641@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

      This is why we Jason Bourne style snatch the gun out of their holster before they can draw it and beat them unconcious with it.

      source

      • felsiq@piefed.zip ⁨3⁩ ⁨weeks⁩ ago

        Iirc bypassnro no longer works on recent builds of windows

        source

        • -> View More Comments
    • SalamenceFury@piefed.social ⁨3⁩ ⁨weeks⁩ ago

      Rufus: “Am I a joke to you?”

      source
  • greybeard@feddit.online ⁨3⁩ ⁨weeks⁩ ago

    If you sign into a Microsoft account during setup, Microsoft automatically turns on bitlocker and sends the key off to Microsoft for safe keeping. You are right, there are other ways to handle bitlocker, but that’s way beyond most people, and I don’t think Microsoft even tells you this during setup. It’s honestly a lifesaver for when bitlocker breaks(and it does), but it comes at a cost. In the business world, this is seen as a huge benefit, as we aren’t trying to protect from the US government, mostly petty theft and maybe some corporate espionage.

    As is often the case, the real solution is Linux, but that, too, is far beyond most people until manufacturers start shipping Linux machines to big box stores and even then they’d probably not enable any encryption.

    source

    • SkyeStarfall@lemmy.blahaj.zone ⁨3⁩ ⁨weeks⁩ ago

      I question whether we are rapidly approaching the point where Linux is simply easier to use in a safe, secure, and practical way for the average user, because it doesn’t try to actively fuck you over like Microsoft does

      It’s easier when you don’t need to jump through hoops to make a local account. It’s easier when you don’t need to turn off a dozen settings you might not know about regarding data collection or advertisements. It’s easier when you don’t have an antagonistic system that treats you like the product, not a user, not pushing you towards confusing things you don’t want

      source
• NatakuNox@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

  Hey copilot, give me the bitlocker key to the nuclear football!

  source
• x0x7@piefed.social ⁨3⁩ ⁨weeks⁩ ago

  Microsoft is already a bad actor and they have them. Or a bad actor could threaten microsoft physically and microsoft will hand them over. Wait, that already happened.

  source
• Kongar@lemmy.dbzer0.com ⁨3⁩ ⁨weeks⁩ ago

  And people make fun of me for turning off secure boot and tpm. They just cause grief for no benefit.

  source

  • frongt@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago

    Well this isn’t directly related to those, so maybe some derision is warranted.

    source
  • partial_accumen@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

    As long as you’re doing your own whole disk encryption, you have a valid path to still be secure. However, if you’re running an unencrypted disk, you’re much more likely to lose your data to a non-state actor.

    source
  • cley_faye@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

    Both are completely unrelated to the discussion. TPM sometimes have issues regarding their security, but you can certainly use Secure Boot with your own signing keys to ensure the kernel you run is one you installed, which improves security. And you can use TPM to either keep your FDE keys, or only part of them combined with a PIN if you don’t fully trust them to be secure, so you keep strong encryption but with a bit of convenience.

    Without a (properly configured) Secure Boot startup, anyone could just put a malware between the actual boot and your first kernel. If the first thing that happens when you boot is something asking for a password to be able to decrypt your storage, then an attacker can just put something here, grab your password, and let you proceed while storing in a a place it can be retrieved.

    Is this scenario a concern for most people? That’s unlikely. But every computer sold these last five years (at least!) can be setup to reduce this risk, so why not take advantage of it.

    source
• Kissaki@feddit.org ⁨3⁩ ⁨weeks⁩ ago

  So, this means Microsoft has copies of every single bitlocker key

  But, by default, BitLocker recovery keys are uploaded to Microsoft’s cloud

  Not everyone follows the default. So no, it doesn’t mean Microsoft has copies of every single BitLocker key.

  source
• Appoxo@lemmy.dbzer0.com ⁨3⁩ ⁨weeks⁩ ago

  More likely stupid users storing their bitlocker key in the microsoft account instead of printing it out or storing it somewhere not owned by MS lol

  source
• Arcane2077@sh.itjust.works ⁨3⁩ ⁨weeks⁩ ago

  Could be worse. Could have skeleton keys

  source

  • corsicanguppy@lemmy.ca ⁨3⁩ ⁨weeks⁩ ago

    You’re assuming there isn’t a master pubkey baked into the software.

    source