Yes. But this completely invalidates the encryption. If anyone can decrypt your data without you giving the keys to them, it is not really encrypted.
Buelldozer@lemmy.today 16 hours ago
The word “Gave” is really doing some heavy lifting in that title. Microsoft produced the keys in response to a warrant as required by law.
If you don’t want a company, any company, to produce your data when given a warrant then you can’t give the company that data. At all. Ever.
Not fast food joints, not Uber, not YouTube, not even the grocery store.
kokesh@lemmy.world 16 hours ago
Buelldozer@lemmy.today 16 hours ago
The encryption key is data, don’t give it to ANYONE. “Two people can keep a secret if one of them is dead.”
goferking0@lemmy.sdf.org 15 hours ago
Which means it’s useless if always uploaded to MS
EncryptKeeper@lemmy.world 7 hours ago
You’re confusing two different things here, in a really weirdly obtuse way.
MrScottyTay@sh.itjust.works 16 hours ago
Its not anyone though. Not anyone can get a warrant and demand the keys
jumping_redditor@sh.itjust.works 15 hours ago
if Microsoft has the power to give the keys to the feds what happens when Microsoft gets hacked?
Tollana1234567@lemmy.today 10 hours ago
or they give the keys or whatever data willingly, and then say they are hacked as an excuse.
Corporal_Punishment@feddit.uk 8 hours ago
Wouldn’t the hacker then need to track down your physical computer…steal it…use the bitlocker key…look to see if you actually have any data worth taking etc…?
ech@lemmy.ca 16 hours ago
Anyone as in “a single person”. They don’t mean everyone has access.
cley_faye@lemmy.world 15 hours ago
Sure. It’s not anyone. It’s anyone that can get a warrant. Or anyone that have enough power/underhanded influence to ask them nicely. Or any admin that have access to cloud storage at MS (remember they where caught with some exec having full access to that a while ago). Or any big leak that could exfiltrate these data. And probably a handful of other people, like, someone getting access to your MS account for whatever reason (which kinda happen, seeing how people lose their mail account to phishing/scams all the time) suddenly having access to your keys from there.
If your keys are in a DB somewhere, there’s a lot of way they could get out. Would these ways coincide with someone actually having your drive at hand? Probably not. Still, the key not existing in plaintext in some third party storage close all these holes.
EncryptKeeper@lemmy.world 7 hours ago
Anyone included Microsoft. You’re thinking of the word “everyone”
nutsack@lemmy.dbzer0.com 15 hours ago
what happens when fydor monikov from the kgb gets a copy of these master keys
DeathByBigSad@sh.itjust.works 9 hours ago
KGB is inside the oval office 💀
deczzz@lemmy.dbzer0.com 16 hours ago
I’m stupid. How do thet even produce the keys?
cley_faye@lemmy.world 15 hours ago
Your computer generate a random key using (hopefully) a trusted PRNG with good enough sources. This key is then used to encrypt your data. This key is stored in your computer’s TPM module, and provided to the OS only if the chip approves all the checks in places. In addition, you get that key displayed to you, so you can write it down (or alternatively save the key file somewhere of your convenience). This is relatively good as far as security goes (unless the TPM is broken, which can happen).
And then, unless you jumped through hoops to disable it, your PC sends the key to Microsoft so they can just keep it linked to your account. That’s the part that sucks, because then, they have the key, can unlock your drive on your behalf, and have to produce it if asked by a judge or something.
Note that there are relatively safe way to protect these keys even if they are backed up in “the cloud”, by encrypting them beforehand using your actual password. It’s not absolutely perfect, but can make it very hard/costly/impossible to retrieve, depending on the resources of the attacker/government agency. But MS didn’t chose this way. I don’t know if it’s because of sheer incompetence, inattention, or because this feature is claimed to be here to “help” people that lose their key, and as such are likely to lose their password too, but it is what it is.
DeathByBigSad@sh.itjust.works 14 hours ago
“help” people that lose their key
Funny enough, people have lost access to their bitlocker encrypted drive because of some weird issues that triggered the windows intallation to revert to asking for the full bitlocker encryption key (I think if you disable secure boot or mess with CPU upgrades or the TPM, or some weird update broke, that can happen), which they didn’t have and forgot the microsoft account. But microsoft can’t help because they forgot about their acount credentials.
They should’ve asked the FBI for help lolz
Wispy2891@lemmy.world 11 hours ago
It happened TWICE on my Lenovo laptop, when it automatically installed a firmware update from windows update
jnod4@lemmy.ca 15 hours ago
I’m pretty sure all tpms can be read with an electric interference reader when they’re probed, as an intended loophole
French75@slrpnk.net 10 hours ago
And then, unless you jumped through hoops to disable it, your PC sends the key to Microsoft so they can just keep it linked to your account.
You’d probably also have to jump through the hoops to disable windows recall too.
Wispy2891@lemmy.world 11 hours ago
In Windows 11, if the main user logs in with a Microsoft account (which is mandatory unless you do some hacks during the install), it automatically encrypts the main drive by default without asking the user consent and uploads the decryption key to Microsoft servers (again, without user consent, but usually this is appreciated because sometimes automatic BIOS updates via windows update wipe the tpm and keep all your data at ransom.)
Dlayknee@lemmy.world 15 hours ago
Microsoft built the encryption in Windows so know how to get around it. In theory that remains a closely guarded secret but there are the warrants and the NSA and…
DeathByBigSad@sh.itjust.works 14 hours ago
Nope, this isn’t even a “backdoor”. The key itself was automatically uploaded to your microsoft account, so they can just take the key from the microsoft servers and walk right in. This isn’t some secret, a quick online search will reveal this as public information. They literally tell you the key will get uploaded.
ChogChog@lemmy.world 5 hours ago
I’d go as far as to say it’s similar to a landlord requiring a key to access the apartment your renting from them. Sure, they probably won’t abuse that power, most don’t, but the doesn’t mean they can’t.
The bigger picture to me is it’s pretty clear then internally, Microsoft views you as a “tenant” of THEIR OS. Not a purchaser. This is why they use the words “This PC” in replace of “My PC”.
Yes, I think we can absolutely say that companies are pushing for consumers to use the cloud instead of their own hardware, but in this context, I’d say it’s more egregious showing their mindset that you’re just renting their software from them.
quips@slrpnk.net 13 hours ago
Not true with E2EE, they can’t give over shit when they don’t have the keys
MSids@lemmy.world 12 hours ago
Bitlocker is computer drive encryption. On W11 it’s supposed to be tied to the motherboards TPM. End to end encryption is not really applicable in this scenario. That phrase is more applicable to cloud services or storage where a telecom or CSP hosts or transports your data but can’t see what the data is.
ColeSloth@discuss.tchncs.de 13 hours ago
If you can’t possess the keys, you can’t give them when there’s a warrant. Microsoft designed a system that could obtain and decrypt those keys on purpose.
korazail@lemmy.myserv.one 3 hours ago
I’m certainly not a microslop supporter, but…
They designed a system that recommended that the average user use full disk encryption as part of device setup, and then provided a way that Grandma could easily recover her family photos when she set it up with their cloud.
This was built by an engineer trying to prevent a foreseeable issue. The intent was not malicious. The intent was to get more people more secure by default, since random hacker couldn’t compell ms to give them keys, while still allowing low tech literacy people to not get fucked.
It’s been a while since I installed a new Windows OS, but I’m pretty sure it prompts you to allow uploading your bitlocker key. It probably defaults to yes, but I doubt you can’t say no, or reset the key post onboarding if you want the privacy, and now it’s on you to record your key. You do have to have some technical understanding of the process, though, which is true of just about everything.
That all said, if a company has your data, it can be demanded by the government. This is a cautionary tale about keeping your secrets secret. Don’t put them in GitHub, don’t put them in Chrome, don’t put them online anywhere because the Internet never forgets.