Microsoft Gave FBI Keys to Unlock Encrypted Data, Exposing Major Privacy Flaw

⁨732⁩ ⁨likes⁩

Submitted ⁨⁨1⁩ ⁨day⁩ ago⁩ by ⁨floofloof@lemmy.ca⁩ to ⁨technology@lemmy.world⁩

https://www.forbes.com/sites/thomasbrewster/2026/01/22/microsoft-gave-fbi-keys-to-unlock-bitlocker-encrypted-data/

cross-posted from: lemmy.bestiver.se/post/879557

Comments

source

Comments

Sort:hotnew top

herseycokguzelolacak@lemmy.ml ⁨8⁩ ⁨hours⁩ ago
One more reason never to use a ~~Microsoft~~ Microslop product.

source
LMurch@thelemmy.club ⁨1⁩ ⁨day⁩ ago
Why can’t just one of our companies not be blood-sucking assholes?

source
- homesweethomeMrL@lemmy.world ⁨1⁩ ⁨day⁩ ago
  *laughs in rich*
  
  source
- Zephorah@discuss.online ⁨1⁩ ⁨day⁩ ago
  It’s all being dumped into data centers now. Google and Meta don’t need your face to prove who you are to create a new login, they need it to link data. What’s awful is the need to log in is so intense, it worked. Apparently YouTube aspirations are worth it. And shopping Facebook marketplace.
  
  Now, Amazon isn’t allowing returns for many an individual without a pic or upload of government issued ID. Amazon allowed you to both pay and have an item shipped without this ID. But for a return, they now need it. I’m not saying this ask isn’t multipurpose, but it also links your data together and is probably being dumped into data centers with everything else.
  
  source
- evol@lemmy.today ⁨1⁩ ⁨day⁩ ago
  Why would a company not be, not like people are going to stop using Windows
  
  source
  - FauxLiving@lemmy.world ⁨1⁩ ⁨day⁩ ago
    Gosh, if only there were another operating system that people could use rather than have their privacy and security raked over the coals by poor design fueld by next quarter’s profits.
    
    It’s a shame that, according to a recent study of social media respondents, 98% of the Internet are Professional Valorant streamers, who play League of Legends and side hustle as a Mechanical Engineer and Digital Artist or they could browse around the world of alternative operating system and mayhaps find some other Operating System which fits their needs (TempleOS).
    
    source
    -> View More Comments
- SkyeStarfall@lemmy.blahaj.zone ⁨1⁩ ⁨day⁩ ago
  Because if a company gives up profits to be nice, another company will swoop in and get inherently rewarded by doing the profitable thing instead
  
  source
- flandish@lemmy.world ⁨1⁩ ⁨day⁩ ago
  go ask adam smith.
  
  source
- Mynameisallen@lemmy.zip ⁨1⁩ ⁨day⁩ ago
  I mean, it was never going to be Microsoft
  
  source
- dreadbeef@lemmy.dbzer0.com ⁨1⁩ ⁨day⁩ ago
  It wasn’t gonna be M$ my guy
  
  source
Trewtrew@lemmy.today ⁨14⁩ ⁨hours⁩ ago
LINUX.

source
- herseycokguzelolacak@lemmy.ml ⁨8⁩ ⁨hours⁩ ago
  🐧
  
  source
- Lanske@lemmy.world ⁨7⁩ ⁨hours⁩ ago
  So glad im on Linux
  
  source
wuffah@lemmy.world ⁨1⁩ ⁨day⁩ ago
It’s not a security flaw, it’s by design. Microsoft has been building this surveillance apparatus for years, and seeking government access to your computer and data with your tax dollars is a lucrative alignment of state and corporate power.

It goes like this:

Force online Microsoft account creation.

Require TPM compliance to run Windows.

Encrypt the user’s data under the guise of “security”. (Encryption is safe and secure right?)

Link your identity, payment information, data, online activity, and encryption keys to your hardware ID.

Record everything you do and use that data to train an AI model with onboard tensor hardware.

Exfiltrate the entire model, or just query it remotely for “online services.” Or, in this case, just have MS give you the fucking recovery keys. lol

All done “securely” with tamper resistance and mathematical verifiability that whatever is on your device is yours, and that you took that action with limited plausible deniability.

If you think you’ve got nothing to hide, think again about the current activities of ICE, law enforcement investigations based on reproductive health data, the pornography suppression movement, age verification, and the data harvesting of dissenting speech. What’s legal today can quickly become “illegal” tomorrow. The constitution is just a piece of paper in a fancy climate controlled box.
source
- Zephorah@discuss.online ⁨1⁩ ⁨day⁩ ago
  Linux, people. Linux.
  
  Suggest Pop!_OS for the fearful.
  
  source
  - Ludicrous0251@piefed.zip ⁨1⁩ ⁨day⁩ ago
    
    Suggest Pop!_OS for the fearful.
    
    Mint, I think you mean Mint.
    
    source
    -> View More Comments
  - nutsack@lemmy.dbzer0.com ⁨1⁩ ⁨day⁩ ago
    sorry, what is Linux? I’ve never heard of it
    
    source
    -> View More Comments
  - allriledup@piefed.blahaj.zone ⁨1⁩ ⁨day⁩ ago
    Yes, I am indeed Linux people.
    
    source
  - W98BSoD@lemmy.dbzer0.com ⁨1⁩ ⁨day⁩ ago
    Had Pop!_OS. Had multiple issues with sound and a work VDI.
    
    Went back to Mint. No issues at all. Same everything (hardware / headset / etc).
    
    source
    -> View More Comments
  - tomalley8342@lemmy.world ⁨1⁩ ⁨day⁩ ago
    Don’t most Linux distributions not enable full disk encryption by default? How would that have improved the situation in this case?
    
    source
    -> View More Comments
  - FauxLiving@lemmy.world ⁨1⁩ ⁨day⁩ ago
    Arch for the chads (and authors of future ‘Help my Linux Broke’ OPs)
    
    source
    -> View More Comments
- evol@lemmy.today ⁨1⁩ ⁨day⁩ ago
  You make Microsoft act like some mastermind genius carefully planning to take away everyone’s rights instead of a bunch of clueless DIrectors who are chasing KPI’s. Just happens more people relying on their technology means when the Government comes knocking they can give them all the data they want.
  
  source
- frongt@lemmy.zip ⁨1⁩ ⁨day⁩ ago
  If they were that interested, why would they push encryption at all?
  
  source
  - wuffah@lemmy.world ⁨1⁩ ⁨day⁩ ago
    That’s a great question, and it is because it enables a chain of cryptographic controls that enable verification, tamper resistance, and secrecy while selling Bitlocker as computer security. It is technically secure, except that MS has your recovery keys and can give them to whoever they want.
    
    This way, they can mathematically verify:
    
    Who you are and the exact unique machine you use (verification from a unique machine ID associated with your encryption keys and Windows account data)
    
    Know that the data has not been altered in transit (tamper resistance hash of your data)
    
    No one else knows except them (secret encryption keys only Microsoft controls, not you, Microsoft)
    
    Imagine what you could do with this power for every Windows machine on the planet.
    
    source
  - Xaphanos@lemmy.world ⁨1⁩ ⁨day⁩ ago
    Verification of identity.
    
    source
  - foodandart@lemmy.zip ⁨1⁩ ⁨day⁩ ago
    Marketing. Just that.
    
    source
- TWeaK@lemmy.today ⁨1⁩ ⁨day⁩ ago
  Project PRISM has matured.
  
  source
- JasonDJ@lemmy.zip ⁨1⁩ ⁨day⁩ ago
  Yeah but as long as you download CSAM you’re on this governments good list. Use that to throw them off your scent.
  
  source
toppy@lemy.lol ⁨7⁩ ⁨hours⁩ ago
Apple is more secure than microsoft.

source
- m8052@lemmy.world ⁨4⁩ ⁨minutes⁩ ago
  Because you think they didnt do the same ?
  
  source
kn0wmad1c@programming.dev ⁨1⁩ ⁨day⁩ ago
If they’re selling bitlocker as “full-disk encryption”, doesn’t that open them up to a class action since encryption with a backdoor isn’t encryption?

source
- roran@sh.itjust.works ⁨1⁩ ⁨day⁩ ago
  Nah, it’s encryption all right, they just back up the key in case you lose it. Which is a feature. aka.ms/bitlockerrecovery
  
  I hear iMessage e2e-encrypted messages are also backed up into cloud as plaintext…
  
  source
- Appoxo@lemmy.dbzer0.com ⁨8⁩ ⁨hours⁩ ago
  The keys were very likely uploaded to the linked MS-account.
  This is communicated as a backup in case you loose the key.
  
  Breach of trust? Yep
  Backdoor? Not very much.
  
  source
  - herseycokguzelolacak@lemmy.ml ⁨8⁩ ⁨hours⁩ ago
    Uploading the key to the cloud is a backdoor. The encryption is only as secure as the your key.
    
    source
    -> View More Comments
- rumba@lemmy.zip ⁨1⁩ ⁨day⁩ ago
  Grey area, user chose to store the private bitlocker key to their online Microsoft acct, it’s optional. It’s still a dirtbag move, but probably less illegal.
  
  source
  - jj4211@lemmy.world ⁨1⁩ ⁨day⁩ ago
    While optional, it is also the default behavior.
    
    source
    -> View More Comments
- IhaveCrabs111@lemmy.world ⁨1⁩ ⁨day⁩ ago
  lol. Last time I checked the rule of law in the US only matters if corporations want it to
  
  source
  - DeathByBigSad@sh.itjust.works ⁨1⁩ ⁨day⁩ ago
    Oh you can sue if you have Epic Games level of money and access to lawyers. Otherwise corporate says “fuck you”.
    
    source
- DeathByBigSad@sh.itjust.works ⁨1⁩ ⁨day⁩ ago
  No they’re not really technically “selling” it. Its bundled with Windows.
  
  Its the home edition thing where they require a microsoft account. Afaik, the Pro version doesn’t require a microsoft account.
  
  source
  - TWeaK@lemmy.today ⁨1⁩ ⁨day⁩ ago
    They’re selling Windows and one of the selling points is that it includes full disk encryption. Thus they are selling full disk encryption.
    
    source
    -> View More Comments
halcyoncmdr@piefed.social ⁨1⁩ ⁨day⁩ ago
Exposing? Microsoft has made it very clear for a while that your Bitlocker keys are synced to your Microsoft account.

Hell, they even have a support page for it. Most of their support pages are nearly useless, but this one is even readable by a normal person.

And before someone mentions the part about Microsoft Support not having access to keys (because some smart ass always does for this stuff)… Just think for a second. Of course customer support doesn’t have access to the keys. What Support can do is not a limit for legal disclosure. A legal warrant (like used here) means they’ll give any info they have in a heartbeat.

source
phutatorius@lemmy.zip ⁨22⁩ ⁨hours⁩ ago
Don’t store your secrets on the cloud.

EVER.

source
Bakkoda@lemmy.world ⁨15⁩ ⁨hours⁩ ago
Regarding this as a flaw is a bit thin right? Massive breach of trust and huge legal issues.

source
drmoose@lemmy.world ⁨1⁩ ⁨day⁩ ago
This is not directly on Microsoft as you have to be either ignorant or special kind of stupid to upload your encryption keys to US cloud. The government can request access to any data and a company can’t do anything.

The only way to resist this is to not store anything unencrypted from your customers which is quite doable but clearly microsoft has no interest in this.

source
- herseycokguzelolacak@lemmy.ml ⁨7⁩ ⁨hours⁩ ago
  Just not use Microslop. It’s easier.
  
  source
- jj4211@lemmy.world ⁨1⁩ ⁨day⁩ ago
  It’s a bit directly on Microsoft, unless you go out of your way, bitlocker will upload the keys to Microsoft. They assume you want them to help recover your data if your tpm becomes unavailable.
  
  Interesting fun fact, when I tried to swype type bitlocker it really wanted to put bootlicker instead.
  
  source
- TeddE@lemmy.world ⁨1⁩ ⁨day⁩ ago
  
  In most situations, your BitLocker recovery key is automatically backed up when BitLocker is first activated:
  
  • …microsoft.com/…/back-up-your-bitlocker-recovery-…
  
  Unless your base argument is “Microsoft users are all stupid”, then I remind you that this is not only default behavior, but is mandatory if your account is associated with an EmtraID account (i.e. any business or school)
  
  source
  - drmoose@lemmy.world ⁨15⁩ ⁨hours⁩ ago
    Yes, my point stands.
    
    source
- ayyy@sh.itjust.works ⁨22⁩ ⁨hours⁩ ago
  Windows no longer allows local accounts.
  
  source
  - Appoxo@lemmy.dbzer0.com ⁨8⁩ ⁨hours⁩ ago
    It does.
    
    A user in the EU
    
    source
- Appoxo@lemmy.dbzer0.com ⁨8⁩ ⁨hours⁩ ago
  Finally some users with a level and rational brain…
  I was heavily downvoted in another instance (eyeroll).
  
  lemmy.dbzer0.com/comment/23957762
  
  source
- BoJackHorseman@lemmy.world ⁨18⁩ ⁨hours⁩ ago
  I thought only the Chinese government had access to Chinese company data.
  
  source
HootinNHollerin@lemmy.dbzer0.com ⁨1⁩ ⁨day⁩ ago
2026 linux

source
potatopotato@sh.itjust.works ⁨1⁩ ⁨day⁩ ago
On Linux, selecting LUKS when you install encrypts the disk without the potential for this problem. So far it’s proven to be very reliable at stopping state level actors, just don’t use a password that you use elsewhere

source
- raldone01@lemmy.world ⁨11⁩ ⁨hours⁩ ago
  But don’t forget to upload a recovery key to your favorite pastebin site. It is easy to loose access otherwise!
  
  source
- FauxLiving@lemmy.world ⁨1⁩ ⁨day⁩ ago
  You can also, with a bit of fiddling use hardware security keys like Yubikey: gist.github.com/…/470a49038e919cf5bc98cd0d2299c48… if you don’t want to remember passwords (You can also install a password in another LUKS slot and it will fall-back to the password if your key fails)
  
  source
FauxLiving@lemmy.world ⁨1⁩ ⁨day⁩ ago
Oh no, who could have possibly seen this coming when Microsoft decided to back up your full-disk encryption key automatically to OneDrive.

Smart of them to deploy automatic full disk encryption just as open source projects like Trucrypt and Veracrypt were starting to become mainstream and wouldn’t you know, they also include many glaring backdoors that completely defeats the encryption that they offer.

In addition to being vulnerable to law enforcement through subpoenas on the stored key. Anytime you run a Windows update and the system has to reboot, it writes a ‘clear key’ to the hard drive which can be easily retrieved if the disk is stolen and also they bypass TPM Validation.

You know, the thing that is so important to have that you were forced to buy an entirely new computer… it is not active during a system update and anybody who has your hard drive.

Well, you would think that this isn’t very useful, after all they would have to have pretty good timing to catch you updating your computer to remove the hard drive, right?

Nope, if they steal your whole computer and plug it into power and a network connection, the next time a Windows update hits the system will automatically apply the update (absent a very specific Group Policy) and write the full-disk encryption key to the hard drive before shutting down.

I’m no expert computerologist, but I think that any system that requires anybody but you to have your key is insecure. If this is the kind of poor design choices that they make in regards to disk encryption then I would personally have no confidence that their proprietary code is not equally porous.

source
- adespoton@lemmy.ca ⁨1⁩ ⁨day⁩ ago
  This is configurable; you can set BitLocker to always require a password on boot. If you do that, the clearkey doesn’t get placed (yet). If you set this mode, the key also doesn’t get uploaded to OneDrive. Of course, there’s a big warning when you set it up, and it recommends you print off and save the one time recovery key list.
  
  Easier just to use an OS that doesn’t require you to jump through hoops to secure it though.
  
  source
  - FauxLiving@lemmy.world ⁨1⁩ ⁨day⁩ ago
    You can also disable it with a Group Policy too and delete any keys that were uploaded to Microsoft with manage-bde while adding your own keys, but for the average person Bitlocker is going to be how it comes by default.
    
    Pre-builts are even worse because that’s another party who has had access to your keys and there are not laws that they would violate by keeping copies (for your convenience, of course)
    
    source
- massacre@lemmy.world ⁨1⁩ ⁨day⁩ ago
  
  ’m no expert computerologist, but I think that any system that requires anybody but you to have your key is insecure.
  
  Computerologist here. You are 100% correct. If anyone says otherwise, they are selling you something.
  
  source
  - FauxLiving@lemmy.world ⁨1⁩ ⁨day⁩ ago
    My pa always told me that if someone says something on the Internet you can take them at their word, so I trust these credentials.
    
    source
- otacon239@lemmy.world ⁨1⁩ ⁨day⁩ ago
  TrueCrypt, my beloved. Such an amazing set of features and super easy to use. I so wish there was a modern open-source equivalent with the same ease-of-use.
  
  source
  - FauxLiving@lemmy.world ⁨1⁩ ⁨day⁩ ago
    How about a modern fork of Truecrypt that looks and works exactly like it?
    
    veracrypt.io/en/Home.html
    
    source
  - Eezyville@sh.itjust.works ⁨1⁩ ⁨day⁩ ago
    Have you looked at Veracrypt?
    
    source
    -> View More Comments
homesweethomeMrL@lemmy.world ⁨1⁩ ⁨day⁩ ago
“Flaw”

source
buttmasterflex@piefed.social ⁨1⁩ ⁨day⁩ ago
I’m not surprised. The standard Microsoft disclosure on my work laptop at the login screen states any use ofbthw computer may be monitored and/ or recovered by Microsoft and law enforcement. That’s why Microsoft products are not present in my home.

source
Peter_Arbeitslos@feddit.org ⁨1⁩ ⁨day⁩ ago
Image

source
magic_smoke@lemmy.blahaj.zone ⁨1⁩ ⁨day⁩ ago
1000025390

source
DaddleDew@lemmy.world ⁨1⁩ ⁨day⁩ ago
If you really were still naive enough to think that a public tech company cares about your right to privacy at that point, it’s pretty much on you.

source
doug@lemmy.today ⁨1⁩ ⁨day⁩ ago
Didn’t this happen with an iPhone a few years back? FBI couldn’t get into his phone, Apple stood firm publicly, but then somehow the FBI got in anyway? Maybe I’m misremembering.

source
m3t00@lemmy.world ⁨14⁩ ⁨hours⁩ ago
who would use that for illegal stuff? prison is full of them.

source
nul9o9@lemmy.dbzer0.com ⁨1⁩ ⁨day⁩ ago
Well, if thats not enough of a reason to move off of Microsoft products, then i don’t know what is.

source
NarrativeBear@lemmy.world ⁨1⁩ ⁨day⁩ ago
Yay! /s

source
goatinspace@feddit.org ⁨1⁩ ⁨day⁩ ago
convenience

source