In Windows 11, if the main user logs in with a Microsoft account (which is mandatory unless you do some hacks during the install), it automatically encrypts the main drive by default without asking the user consent and uploads the decryption key to Microsoft servers (again, without user consent, but usually this is appreciated because sometimes automatic BIOS updates via windows update wipe the tpm and keep all your data at ransom.)
I’m stupid. How do thet even produce the keys?
Wispy2891@lemmy.world 9 hours ago
Dlayknee@lemmy.world 14 hours ago
Microsoft built the encryption in Windows so know how to get around it. In theory that remains a closely guarded secret but there are the warrants and the NSA and…
DeathByBigSad@sh.itjust.works 13 hours ago
Nope, this isn’t even a “backdoor”. The key itself was automatically uploaded to your microsoft account, so they can just take the key from the microsoft servers and walk right in. This isn’t some secret, a quick online search will reveal this as public information. They literally tell you the key will get uploaded.
ChogChog@lemmy.world 3 hours ago
I’d go as far as to say it’s similar to a landlord requiring a key to access the apartment your renting from them. Sure, they probably won’t abuse that power, most don’t, but the doesn’t mean they can’t.
The bigger picture to me is it’s pretty clear then internally, Microsoft views you as a “tenant” of THEIR OS. Not a purchaser. This is why they use the words “This PC” in replace of “My PC”.
Yes, I think we can absolutely say that companies are pushing for consumers to use the cloud instead of their own hardware, but in this context, I’d say it’s more egregious showing their mindset that you’re just renting their software from them.
cley_faye@lemmy.world 14 hours ago
Your computer generate a random key using (hopefully) a trusted PRNG with good enough sources. This key is then used to encrypt your data. This key is stored in your computer’s TPM module, and provided to the OS only if the chip approves all the checks in places. In addition, you get that key displayed to you, so you can write it down (or alternatively save the key file somewhere of your convenience). This is relatively good as far as security goes (unless the TPM is broken, which can happen).
And then, unless you jumped through hoops to disable it, your PC sends the key to Microsoft so they can just keep it linked to your account. That’s the part that sucks, because then, they have the key, can unlock your drive on your behalf, and have to produce it if asked by a judge or something.
Note that there are relatively safe way to protect these keys even if they are backed up in “the cloud”, by encrypting them beforehand using your actual password. It’s not absolutely perfect, but can make it very hard/costly/impossible to retrieve, depending on the resources of the attacker/government agency. But MS didn’t chose this way. I don’t know if it’s because of sheer incompetence, inattention, or because this feature is claimed to be here to “help” people that lose their key, and as such are likely to lose their password too, but it is what it is.
DeathByBigSad@sh.itjust.works 13 hours ago
Funny enough, people have lost access to their bitlocker encrypted drive because of some weird issues that triggered the windows intallation to revert to asking for the full bitlocker encryption key (I think if you disable secure boot or mess with CPU upgrades or the TPM, or some weird update broke, that can happen), which they didn’t have and forgot the microsoft account. But microsoft can’t help because they forgot about their acount credentials.
They should’ve asked the FBI for help lolz
Wispy2891@lemmy.world 9 hours ago
It happened TWICE on my Lenovo laptop, when it automatically installed a firmware update from windows update
jnod4@lemmy.ca 13 hours ago
I’m pretty sure all tpms can be read with an electric interference reader when they’re probed, as an intended loophole
French75@slrpnk.net 9 hours ago
You’d probably also have to jump through the hoops to disable windows recall too.